Difference between revisions of "Bitlocker To Go"
Line 5: | Line 5: | ||
Every year the university and its employees purchase dozens (if not hundreds) of external storage devices that are, for all intents and purpose, disposable. These storage devices have become quite large in capacity and are capable of storing significant quantities of sensitive university data. At the same time, annual Business Office audits have shown that many employees are not capable of accounting for these devices during audits. Requiring Bitlocker To Go ensures data being copied off of WSU computers remains in a protected state. This risk mitigation control reduces the requirement for the university to do asset tracking and inventory control on low cost storage devices. The implementation of this technology not only significantly reduces the risk of losing university data, but also reduces costs associated with tracking and securely disposing of the devices themselves. | Every year the university and its employees purchase dozens (if not hundreds) of external storage devices that are, for all intents and purpose, disposable. These storage devices have become quite large in capacity and are capable of storing significant quantities of sensitive university data. At the same time, annual Business Office audits have shown that many employees are not capable of accounting for these devices during audits. Requiring Bitlocker To Go ensures data being copied off of WSU computers remains in a protected state. This risk mitigation control reduces the requirement for the university to do asset tracking and inventory control on low cost storage devices. The implementation of this technology not only significantly reduces the risk of losing university data, but also reduces costs associated with tracking and securely disposing of the devices themselves. | ||
==Will it impact me?== | ==Will it impact me?== | ||
− | Bitlocker To Go will likely not impact most employees. | + | '''Bitlocker To Go will likely not impact most employees.''' |
− | * First, it is currently only being deployed to Windows based computers that have access to classified university data. | + | * First, it is currently only being deployed to Windows-based computers that have access to classified university data. |
− | * Second, it will only impact you if you use removable storage devices, which most employees do not use. | + | * Second, it will only impact you if you use removable storage devices (like a flash drive), which most employees do not use. |
− | * Third, it will only impact you if you need to WRITE data to these devices. If you only need to read data from external | + | * Third, it will only impact you if you need to '''WRITE''' data to these devices. If you only need to '''read''' data from external devices, Bitlocker To Go does not need to be enabled. Remember, WSU recommends using network storage (i.e. your R drive, department storage, or WSU OneDrive) and not removable media such as flash drives or external hard drives. These types of devices are both expensive and easily lost. |
− | * Fourth, | + | * Fourth, Bitlocker technology is very stable and has been thoroughly adopted and tested across almost every industry. WSU has used Bitlocker on our Windows PCs with great success for well over a decade. |
==How will it impact me if I do use removable storage?== | ==How will it impact me if I do use removable storage?== | ||
− | In the event your job requires the use of removable media Bitlocker To Go will require those drives to be | + | In the event your job requires the use of removable media, Bitlocker To Go will require those drives to be encrypted '''PRIOR''' to you putting data on them. For example, if you plug in a USB storage stick and right click and select paste: |
1. Sorry, you can’t copy files to this without Bitlocker being enabled. Would you like to enable it? | 1. Sorry, you can’t copy files to this without Bitlocker being enabled. Would you like to enable it? | ||
2. Click NO and all you may do is read the contents of the drive. Click Yes and it will walk you through a very quick set of steps to put a password on it. | 2. Click NO and all you may do is read the contents of the drive. Click Yes and it will walk you through a very quick set of steps to put a password on it. |
Revision as of 19:50, 20 December 2017
What is Bitlocker To Go?
Bitlocker is the built-in Windows encryption tool that helps protect data from being accessed by the wrong party. The data is scrambled it in a way that only your credentials can read. This is the core technology implemented on every employee Windows PC across campus. Bitlocker To Go is the portable version of this technology that extends to peripheral equipment such as thumb drives, flash drives, external hard drives, SD/XD/SSD/Mini/Micro/CF cards, cameras that connect via USB, scanners, and every attachable device that is capable of storing data. Basically, Bitlocker To Go allows us to password protect the removable devices that are the most likely to contain university data.
Why is Bitlocker being enforced?
Every year the university and its employees purchase dozens (if not hundreds) of external storage devices that are, for all intents and purpose, disposable. These storage devices have become quite large in capacity and are capable of storing significant quantities of sensitive university data. At the same time, annual Business Office audits have shown that many employees are not capable of accounting for these devices during audits. Requiring Bitlocker To Go ensures data being copied off of WSU computers remains in a protected state. This risk mitigation control reduces the requirement for the university to do asset tracking and inventory control on low cost storage devices. The implementation of this technology not only significantly reduces the risk of losing university data, but also reduces costs associated with tracking and securely disposing of the devices themselves.
Will it impact me?
Bitlocker To Go will likely not impact most employees.
- First, it is currently only being deployed to Windows-based computers that have access to classified university data.
- Second, it will only impact you if you use removable storage devices (like a flash drive), which most employees do not use.
- Third, it will only impact you if you need to WRITE data to these devices. If you only need to read data from external devices, Bitlocker To Go does not need to be enabled. Remember, WSU recommends using network storage (i.e. your R drive, department storage, or WSU OneDrive) and not removable media such as flash drives or external hard drives. These types of devices are both expensive and easily lost.
- Fourth, Bitlocker technology is very stable and has been thoroughly adopted and tested across almost every industry. WSU has used Bitlocker on our Windows PCs with great success for well over a decade.
How will it impact me if I do use removable storage?
In the event your job requires the use of removable media, Bitlocker To Go will require those drives to be encrypted PRIOR to you putting data on them. For example, if you plug in a USB storage stick and right click and select paste: 1. Sorry, you can’t copy files to this without Bitlocker being enabled. Would you like to enable it? 2. Click NO and all you may do is read the contents of the drive. Click Yes and it will walk you through a very quick set of steps to put a password on it. 3. The next time that drive is plugged into a computer, it will prompt for a password to unlock it. If it is your primary computer, you can choose to remember the password and it will never prompt again. If it is your home computer, just enter the password and it will open and look normal. ** special software is available to open these secure drives on a Mac **
Detailed documentation of the setup process are as follows:
First time use of unencrypted drive on in scope workstation
User presented with a dialog box. If “Don’t encrypt” is chosen, then the drive is read-only.
Choosing Encrypt option: The BitLocker process is initiated
Password creation is required to continue. Length (8 characters) and complexity requirements are enforced. Error messages for each are displayed below
Once an acceptable password is entered, a backup method is required. We back up to Winona State University's Active Directory server, but I would highly recommend using the “Save to a file” method and saving the file to your personal R:\ drive on the network. After that has completed, simply click Next.
Note: The drive should not be encrypted until the computer can access Active Directory (via being on campus or connected to VPN). This ensures that the key is properly backed up.
Final check, and encryption begins. Note: Only the used space on the drive is encrypted. This greatly decreases the amount of time needed to encrypt.
Encrypted drive on any PC computer
When you insert the drive you are prompted to unlock with user-created password
- Minimum password length of 8 characters, and complexity rules are enforced