Bitlocker To Go

What is Bitlocker To Go?

Bitlocker is the built-in Windows encryption tool that helps protect data from being accessed by the wrong party. The data is scrambled it in a way that only your credentials can read. This is the core technology implemented on every employee Windows PC across campus. Bitlocker To Go is the portable version of this technology that extends to peripheral equipment such as thumb drives, flash drives, external hard drives, SD/XD/SSD/Mini/Micro/CF cards, cameras that connect via USB, scanners, and every attachable device that is capable of storing data. Basically, Bitlocker To Go allows us to password protect the removable devices that are the most likely to contain university data.

Why is Bitlocker being enforced?

Every year the university and its employees purchase dozens (if not hundreds) of external storage devices that are, for all intents and purpose, disposable. These storage devices have become quite large in capacity and are capable of storing significant quantities of sensitive university data. At the same time, annual Business Office audits have shown that many employees are not capable of accounting for these devices during audits. Requiring Bitlocker To Go ensures data being copied off of WSU computers remains in a protected state. This risk mitigation control reduces the requirement for the university to do asset tracking and inventory control on low cost storage devices. The implementation of this technology not only significantly reduces the risk of losing university data, but also reduces costs associated with tracking and securely disposing of the devices themselves.

Will it impact me?

Bitlocker To Go will likely not impact most employees.

First, it is currently only being deployed to Windows based computers that have access to classified university data.
Second, it will only impact you if you use removable storage devices, which most employees do not use.
Third, it will only impact you if you need to WRITE data to these devices. If you only need to read data from external sources Bitlocker To Go does not need to be enabled. Remember, WSU recommends using network storage and not removable media whenever possible. These devices are expensive and easily lost.
Fourth, the technology is very stable and has been thoroughly adopted and tested across almost every industry.

How will it impact me if I do use removable storage?

In the event your job requires the use of removable media Bitlocker To Go will require those drives to be protected PRIOR to you putting data on them. In a nutshell, if you plug in a USB storage stick and right click and select paste: 1. Sorry, you can’t copy files to this without Bitlocker being enabled. Would you like to enable it? 2. Click NO and all you may do is read the contents of the drive. Click Yes and it will walk you through a very quick set of steps to put a password on it. 3. The next time that drive is plugged into a computer, it will prompt for a password to unlock it. If it is your primary computer, you can choose to remember the password and it will never prompt again. If it is your home computer, just enter the password and it will open and look normal. ** special software is available to open these secure drives on a Mac **

Detailed documentation of the setup process are as follows:

First time use of unencrypted drive on in scope workstation

User presented with a dialog box. If “Don’t encrypt” is chosen, then the drive is read-only.

Choosing Encrypt option: The BitLocker process is initiated

Password creation is required to continue. Length (8 characters) and complexity requirements are enforced. Error messages for each are displayed below

Once an acceptable password is entered, a backup method is required. We back up to Winona State University's Active Directory server, but I would highly recommend using the “Save to a file” method and saving the file to your personal R:\ drive on the network. After that has completed, simply click Next.

Note: The drive should not be encrypted until the computer can access Active Directory (via being on campus or connected to VPN). This ensures that the key is properly backed up.

Final check, and encryption begins. Note: Only the used space on the drive is encrypted. This greatly decreases the amount of time needed to encrypt.