The first risk is everyone’s worst-case scenario: Our computer is stolen. Laptops especially seem likely to “sprout legs and walk away.” While our first worry might be the cost of replacing the laptop, many people also worry about identity theft. Some thieves exploit the data stored on the hard drive to masquerade as the laptop’s owner. Identity theft is a booming business, and personal computers often contain extensive financial records and lists of online passwords.

The theft risk poses even greater problems for large organizations. A stolen laptop may contain large databases of sensitive information about customers. According to statistics collected for the first half of 2009, there were 19 incidents in the United States where a misplaced or stolen laptop placed databases at risk. The incidents involved private companies, schools, hospitals, and government agencies at all levels. The smallest data loss involved 50 personal records, while one incident involved more than a million records.

If a stolen computer contains a customer database, many companies are legally required to contact all affected customers and warn them that their information may have been stolen. If the database includes credit card numbers or Social Security numbers, then the company may need to provide some defense against identity theft.

The eavesdropping attack vector arises if we can’t always keep our drive physically safe or under appropriate software protection. When Bob and Alice started using file encryption, they decided to keep the encrypted file on a shared USB drive. Because the file was encrypted, they assumed it was safe from eavesdropping. For convenience, they left it on the bulletin board in their suite.

This attack vector poses a risk even if we don’t share a drive on a bulletin board. If we back up the data to a separate drive, we need to physically protect the backup drive. If attackers have physical access to our computer, then we can try to protect our data by protecting our Chain of Control; we can disable booting of other drives and enable file protections. However, these defenses don’t protect us if the attacker cracks open the computer’s case. An attacker can bypass any BIOS or operating system by connecting the drive to a different motherboard.

When we upgrade our devices, we usually acquire new storage. We copy our data from our old storage volumes. The old devices disappear along with their storage volumes. What happens to our sensitive data?

Modern mobile devices often have mechanisms to erase all personal data when the owner turns in, donates, or discards the equipment. Smartphones and other mobile devices typically use flash storage, which is hard to erase reliably. (See Section 7.4.3.)

Drive erasure has long posed a challenge for desktop computers. Research at MIT by Simson Garfinkel in the 2000s found that many companies and individuals were selling or discarding computers without properly erasing the hard drives. The researchers found that most people took very simple steps to “clean” their drive of data before passing the computer onto the next owner. Using “undelete” programs and other file-recovery tools, researchers were able to recover numerous personal and business files.

There are four strategies for cleaning a hard drive of personal data:

1. Delete personal files and “empty the trash.”

2. Reformat the hard drive.

3. Run a “disk wipe” program.

4. Physically damage the hard drive so that it can’t be read.

The first two strategies yield similar results. As noted earlier, files continue to exist in a ghostly form after they have been deleted. The same is true for reformatting. When we reformat a drive, especially a “quick format,” we just rewrite the first few blocks of the hard drive with a new directory that contains no files. Disk-recovery software looks at the other blocks on the disk and tries to reconstruct the previous directories. The attempt often succeeds. Once the directories are restored, the software recovers as many files as possible.

Either of the last two strategies may eliminate the risk of recovered files. We examined disk wiping as part of encrypting a file in Section 7.4.3, but there are also utility programs that wipe a drive by overwriting every one of its blocks. Some hard drives have a built-in mechanism to wipe the drive, but these mechanisms are rarely evaluated for effectiveness. Even with the built-in wipe, an attacker might be able to retrieve data.

Note that it may be challenging to physically destroy a modern hard drive. The major components are metal and are assembled to operate at very high rotational speeds. For all but the more extreme threats, we render the data irrecoverable if we open the drive case and remove all of the drive’s read/write heads.

There are several ways to identify critical data. In some cases, we already know which files we need to protect and which aren’t important. However, it’s best to develop policy statements that help define critical data.

For example, if we handle information that others deem sensitive (like credit card numbers, health information, or proprietary information), we are obliged to safeguard it. In some cases, there are specific security measures we must use. In all cases, however, we need a way to tell which files might contain the sensitive information so that we may protect those files.

Critical data should always be marked as such. We should clearly distinguish between critical and noncritical data. This makes it easier to ensure that we adequately protect critical data. For example, we may restrict critical data to specific folders or to folders with particular names.

We also may put readable markings in documents to remind us that they contain sensitive information. For example, government agencies routinely put classification markings or other warnings about restricted distribution in the document’s page header and/or footer. Law firms may do this for documents that are restricted according to judicial orders. Many companies systematically mark all proprietary information.

We also should physically mark any removable storage volumes that might contain sensitive or critical information. Even if the volume is encrypted, it is essential to be able to tell easily whether sensitive information should—or should not—be stored on a particular volume.

If an unencrypted volume contains data we can’t afford to leak, then we must guarantee its physical protection. It is very hard to guarantee such protection in practice. We often need to leave hardware unattended, even laptops. This opens the risk of a peeping Tom, even if we aren’t risking theft. If we don’t encrypt the drive and we store sensitive information on it, then we need the policy statements shown in TABLE 9.2.

In practice, the policy statements should be more specific about the information and storage. Somewhere, our policy should identify what we mean by sensitive data. We should also be more specific about which mass storage devices we protect.

These policy statements are easy to write but difficult to implement. If we keep the drives locked in a private office, we may also have to consider the risk of cleaning staff having access to it. If the drive is in a laptop, we need a locked cabinet for it, and we should avoid carrying it in public.

In practice, we can justify volume encryption for almost any computer hard drive or USB drive. Although it may not protect against every attack, volume encryption prevents many common risks. In most cases, we cannot keep a hard drive or laptop safe continuously. As of 2010, however, volume encryption remains a relatively rare and sophisticated feature, although this should change as the technologies evolve.

TABLE 9.3 presents policy statements for volume encryption. As with the previous statements, a practical policy needs to tell people how to identify sensitive data. Policy and procedures also should provide a way to distinguish between volumes containing sensitive data and those that don’t.

Now that we know that we need volume encryption, we must figure out how to implement it. Volume encryption places a serious burden on an encryption algorithm. Most algorithms become vulnerable if we encrypt a great deal of information, especially if it includes known plaintext and duplicated information. This is exactly what happens on a large encrypted hard drive.