How do I enable Bitlocker encryption

Orson_Deforest

The title is pretty straightforward, I'm trying to enable Bit locker encryption on my server, anything I should thing of before. Are there any tips or useful advice's? What are the pros and the cons?

Urban

On the plus side your data will be more secure with encryption, you never know if the drives are properly destroyed or who might be looking in the trash for old components, better safe than sorry. On the negative side however you'll be forced to enter the passphrase every time you boot which would require some kind of physical access as Remote desktop might not work until the system is unlocked.

Josef

The easy way would be:

Open explorer and go to "This PC"
Right click on the drive you want to encrypt
Choose "Manage Bitlocker encryption"

Here's also a tutorial about how you can enable the usage of AES-256 bit encryption instead of AES-128 (which is default). The first one is slightly slower but much safer according to NSA. Enable AES 256 bit encryption.

The tricky part here is however what unlock method you choose, entering the passphrase on boot may be tricky. While it shouldn't be any trouble considering that you have access to the KVM terminal which is like connecting your machine directly to a monitor I'm not fully sure that works. The physical hardware should be modern enough to have TMP modules but I hardly doubt those are accessible by the virtual machines (Linux host and Windows guests).

You may get away if you load your keys from an external server (hard to setup and requires network access) or if you use a small local FAT32 partition to store the keys. In any case I think Bitlocker in this environment would cause more trouble than what it solves. I'm pretty sure that KVM does some encryption on the virtual drives so disk encryption won't really be needed unless you have a multi user system of course and want to prevent users from accessing other users files.

Orson_Deforest

So you're saying that it won't make much difference?

Donald_Alcorn

It will make your stored data more secure, however it's already secure enough in this environment I would say. You should focus on securing your data transfers, i.e when uploading/downloading data from your instance. That's where mot attackers will try to steal it.

Orson_Deforest

Alright thanks mate