Disk encryption - implementation choices

Disk vs File Encryption

- File Encryption

Choose a file, decrypt, use, encrypt, secure erase unencrypted file

- Disk Encryption

Encrypts and decrypts all files (including temporary files) "on the fly". This process is extremely transparent to the end user.

Issues for 'pooled' resources

- If laptop L is encrypted with user A's key then users B,C,D... cannot use the laptop.

Use a device access key rather than a user authentication key

'Master' Keys

- If a user loses their key, or is not present can IT Support read the disk?

Encrypt the disk encryption key using the user's key and a key owned by IT Support staff