In The Know - Charles Van Heusen's Weblog

Windows Server 2008 - Bitlocker Drive Encryption

While delivering a TS2 event in El Paso, Texas this week, questions came up regarding the ability to extend Bitlocker Drive Encryption onto a RAID Array.  The Whitewater I have goes over a lot of the changes to Bitlocker in Windows Server 2008 over what was previously available in Windows Server 2003 SP1, but it doesn't mention anything regarding encrypting data on RAID Arrays so I will keep digging.  I thought the information I did find was worth sharing so check it out below...

I pulled the following information on Windows Bitlocker from the "Windows Server 2008 Changes in Functionality from Windows Server 2003 with SP1 to Windows Server 2008", Whitepaper that was put together in September 2007 by Simon Farr and Carolyn Eller.

BitLocker Drive Encryption

Windows BitLocker™ Drive Encryption (BitLocker) is a security feature in the Windows Vista® and Windows Server® 2008 operating systems that can provide protection for the operating system on your computer and data stored on the operating system volume. In Windows Server 2008, BitLocker protection can be extended to volumes used for data storage as well.

What does Windows BitLocker Drive Encryption do?

BitLocker performs two functions:

· BitLocker encrypts all data stored on the Windows operating system volume (and configured data volumes). This includes the Windows operating system, hibernation and paging files, applications, and data used by applications.

· BitLocker is configured by default to use a Trusted Platform Module (TPM) to help ensure the integrity of early startup components (components used in the earlier stages of the startup process), and "locks" any BitLocker-protected volumes so that they remain protected even if the computer is tampered with when the operating system is not running.

In Windows Server 2008, BitLocker is an optional component that must be installed before it can be used. To install BitLocker, select it in Server Manager or type the following at a command prompt:

ServerManagerCmd -install BitLocker -restart

Who will be interested in this feature?

The following groups might be interested in BitLocker:

· Administrators, IT security professionals, and compliance officers who are tasked with ensuring that confidential data is not disclosed without authorization

· Administrators responsible for securing computers in remote or branch offices

· Administrators responsible for servers or Windows Vista client computers that are mobile

· Administrators responsible for the decommissioning of servers that have stored confidential data

Are there any special considerations?

To make use of its full functionality, BitLocker requires a system that has a compatible TPM microchip and BIOS. A compatible TPM is defined as a version 1.2 TPM. A compatible BIOS must support the TPM and the Static Root of Trust Measurement as defined by the Trusted Computing Group. For more information about TPM specifications, visit the TPM Specifications section of the Trusted Computing Group's Web site (http://go.microsoft.com/fwlink/?LinkId=72757).

BitLocker requires that the active partition (sometimes called the system partition) be a non-encrypted partition. The Windows operating system is installed to a second partition that is encrypted by BitLocker.

Whenever dealing with the encryption of data, especially in an enterprise environment, you must consider how that data can be recovered in the event of hardware failure, changes in personnel, or other situations in which encryption keys are lost. BitLocker supports a robust recovery scenario, which is described later in this article.

What new functionality does this feature provide?

The major features of BitLocker include full-volume encryption, verification of the integrity of early startup components, a robust recovery mechanism, and support for a secure decommissioning process.

Full-volume encryption

Everything written to a BitLocker-protected volume is encrypted. This includes the operating system itself, and all applications and data.

Why is this functionality important?

This helps protect data from unauthorized access. While the physical security of servers remains important, BitLocker can help protect data whenever a computer is stolen, shipped from one location to another, or otherwise out of your physical control.

Encrypting the disk helps prevent offline attacks such as the removal of a disk drive from one computer and its installation in another in an attempt to bypass Windows security provisions, such as permissions enforced by NTFS access control lists (ACLs).

What works differently?

BitLocker is implemented in code in the early startup components ((master boot record (MBR), boot sector, boot manager, Windows Loader)), and as a filter driver that is an integral part of the operating system.

When BitLocker is first enabled, existing data on the volume must be encrypted. You can continue to use the computer during this process, but you might notice reduced performance during this initial encryption.

After the initial encryption is complete, using the encrypted volume causes a slight performance penalty on disk access. While highly dependent on particular hardware and usage patterns, an estimate of 3 to 5 percent is reasonable. On client systems, this is not usually noticeable to users. On heavily-loaded servers, you should evaluate the performance of the disk subsystem.

Using a BitLocker-enabled disk is transparent to the operating system and all applications.

For more information about the specifics of the BitLocker encryption algorithm, see AES-CBC + Elephant diffuser (http://go.microsoft.com/fwlink/?LinkId=82824).

How should I prepare for this change?

For information about planning, see How should I prepare to deploy this feature?.

Integrity checking

In conjunction with the TPM, BitLocker verifies the integrity of early startup components, which helps prevent additional offline attacks, such as attempts to insert malicious code into those components.

Why is this functionality important?

Because the components in the earliest part of the startup process must be available unencrypted so that the computer can start, an attacker could change the code in those early startup components, and then gain access to the computer, even though the data on the disk was encrypted. Then, if the attacker gains access to confidential information such as the BitLocker keys or user passwords, BitLocker and other Windows security protections could be circumvented.

What works differently?

On computers equipped with a TPM, each time the computer starts, each of the early startup components (such as the BIOS, the MBR, the boot sector, and the boot manager code) examines the code about to be run, calculates a hash value, and stores the value in the TPM. Once stored in the TPM, that value cannot be replaced until the system is restarted. A combination of these values is recorded.

These recorded values can also be used to protect data, by using the TPM to create a key that is tied to these values. When this type of key is created, the TPM encrypts it, and only that specific TPM can decrypt it. Each time the computer starts, the TPM compares the values generated during the current startup with the values that existed when the key was created. It decrypts the key only if those values match. This process is called "sealing" and "unsealing" the key.

By default, BitLocker examines and seals keys to the measurements of the Core Root of Trust (CRTM), the BIOS and any platform extensions, option read-only memory (ROM) code, MBR code, the NTFS boot sector, and the boot manager. This means that if any of these items are changed unexpectedly, BitLocker will lock the drive and prevent it from being accessed or decrypted.

By default, BitLocker is configured to look for and use a TPM. You can use Group Policy to allow BitLocker to work without a TPM, and store keys on an external USB flash drive; however, BitLocker cannot then verify the early startup components.

How do I resolve these issues?

You should consider the availability of a TPM as part of your hardware purchasing decision. In the absence of a TPM, the physical security of the server becomes even more important.

BitLocker should be disabled during planned maintenance that will change any of the measured early startup components. BitLocker can be re-enabled after the maintenance is complete, and new platform measurements will be used for the keys. Disabling and re-enabling does not require the decryption and re-encryption of the disk.

How should I prepare for this change?

For information about planning, see How should I prepare to deploy this feature?.

Recovery options

BitLocker supports a robust series of recovery options to ensure that data is available to legitimate users.

Why is this functionality important?

It is essential that an organization's data can be decrypted, even if the most commonly used decryption keys become unavailable. Recoverability is designed into BitLocker, without any "back doors," but enterprises can easily ensure that their data is both protected and available.

What works differently?

When BitLocker is enabled, the user is prompted to store a "recovery password" that can be used to unlock a locked BitLocker volume. The BitLocker setup wizard requires that at least one copy of the recovery password is saved.

In many environments, however, you might not be able to rely on users keeping and protecting recovery passwords; therefore, you can configure BitLocker to save recovery information to Active Directory or Active Directory Domain Services (AD DS).

We recommend that recovery passwords be saved to Active Directory in enterprise environments.

How do I resolve these issues?

Group Policy settings can be used to configure BitLocker to require or prevent different types of recovery password storage, or to make them optional.

Group Policy settings can also be used to prevent BitLocker from being enabled if the keys cannot be backed up to Active Directory.

For more information about how to configure Active Directory to support recovery options, see Configuring Active Directory to Back up Windows BitLocker Drive Encryption and Trusted Platform Module Recovery Information (http://go.microsoft.com/fwlink/?LinkId=82827).