BitLocker Drive Encryption is a data protection feature available in Windows Vista Enterprise and Ultimate for client computers and in Windows Server 2008. BitLocker is Microsoft’s response to a frequent customer request: address these very real threats of data theft or disclosure from lost, stolen or inappropriately decommissioned PC hardware with a tightly integrated solution in the Windows Operating System.

Solid protection for home or office PCs.
BitLocker prevents a thief who boots another operating system or runs a software hacking tool from breaking Windows Vista file and system protections or performing offline viewing of the files stored on the protected drive.

The feature ideally uses a Trusted Platform Module (TPM 1.2) to protect user data and to ensure that a PC running Windows Vista has not been tampered with while the system was offline. BitLocker provides both mobile and office enterprise information workers with enhanced data protection should their systems be lost or stolen and secure data deletion when it comes time to decommission those assets.

BitLocker enhances data protection by bringing together two major sub-functions: drive encryption and the integrity checking of early boot components.

Drive encryption protects data by preventing unauthorized users from breaking Windows file and system protection on lost, stolen or inappropriately decommissioned computers. This protection is achieved by encrypting the entire Windows volume; with BitLocker all user and system files are encrypted including the swap and hibernation files.

Integrity checking the early boot components helps to ensure that data decryption is performed only if those components appear unmolested and that the encrypted drive is located in the original computer.

BitLocker is tightly integrated into Windows Vista and provides a seamless, secure, and easily manageable data protection solution for the enterprise.

Windows BitLocker is for both business and personal users who need to help protect sensitive data on their PC.

Bookmark

Windows BitLocker uses hardware-enabled full-volume data encryption technology that gives you greater peace of mind knowing that your corporate intellectual property is safer and will remain your strategic asset. Also, because the entire Windows volume is encrypted, Windows BitLocker reduces the cost associated with decommissioning old PCs.
Watch the video.

Bookmark

Windows Vista includes many security features and improvements to protect client computers from the latest generation of threats, including worms, viruses, and other malicious software (collectively known as malware).

User Account Control allows users to be productive and change common settings while running as a standard user, without requiring administrative privileges. This prevents users from making potentially dangerous changes to their computers, without limiting their ability to run applications

from phishing and spoofing attacks. New features include protected mode Internet Explorer, which helps protect user data and configuration settings from being deleted or changed by malicious Web sites or malware.

Windows Defender detects many types of potentially suspicious software and can prompt the user before allowing applications to make potentially malicious changes.

The new outbound filtering in the firewall provides administrative control over peer-to-peer sharing applications and other similar applications that businesses want to restrict.

Windows Service Hardening limits the damage attackers can do in the unlikely event that they are able to successfully compromise a service. As a result, the risk of attackers making permanent changes to the Windows Vista client or attacking other computers on the network is reduced.

Administrators can use Network Access Protection to prevent clients that do not meet the internal system health policy from connecting to the internal network and potentially spreading malware to other machines.

Enterprise users with computers with appropriate enabling hardware benefit from protection of data on lost or stolen computers with BitLocker? Drive Encryption. A computer with BitLocker enabled will have its entire Windows volume encrypted?protecting data, files, e-mail, and intellectual property from unauthorized users trying to break into a computer.

Finally, to ensure that IT departments have a wide variety of authentication mechanisms to choose from, Windows Vista includes new authentication architecture that is easier for third-party developers to extend. Ultimately, this will lead to a wider choice of smart cards, fingerprint scanners, and other forms of strong authentication. Together, these security improvements will make users more confident in using their PCs.

Bookmark

Benefits

Many potentially risky applications, such as peer-to-peer sharing client applications that might transmit personal information across the Internet are designed to bypass firewalls that block incoming connections. Windows Vista’s firewall enables enterprise administrators to have the ability to set Group Policy settings for applications that should be allowed or blocked, giving them control over which applications can communicate on the network.

Why It Matters

One of the most important ways IT departments mitigate security risks is by limiting the applications that can access the network. The personal firewall built into Windows Vista is an important part of this strategy. With the personal firewall, administrators can allow an application to run locally on computers but prevent it from communicating across the network. This gives administrators the granular control they need to mitigate security risks without negatively impacting user productivity.

Bookmark

Windows services represent a large percentage of the overall attack surface in Windows?from the perspective of the quantity of overall “always-on” code footprint in the system, and the privilege level of that code. Windows Vista limits the number of services that are running and operational by default. Today, many system and third-party services run in the LocalSystem account, where any breach could lead to unbounded damage to the local machine?including disk formatting, user data access, or driver installation.

Windows Service Hardening reduces the damage potential of a compromised service by introducing new concepts which are used by Windows services:

Introduction of a per-service security identifier (SID). It enables per-service identity which subsequently enables access control partitioning through the existing Windows access control model covering all objects and resource managers which use access control lists (ACLs). Services can now apply explicit ACLs to resources which are private to the service, which prevents other services as well as the user from accessing the resource.

Moving services from LocalSystem to a lesser privileged account such as LocalService or NetworkService. This reduces the overall privilege level of the service, which is similar to the benefits derived from User Account Control.

Removal of un-necessary Windows privileges on a per-service basis; for example, the ability to do debugging.

Applying a write-restricted access token to the service process. This access token can be used in cases where the set of objects written to by the service is bounded and can be configured. Write attempts to resources that do not explicitly grant the Service SID access will fail.

Services are assigned network firewall policy, which prevents network access outside the normal bounds of the service program. The firewall policy is linked directly to per-service SID.

Benefits

Windows Service Hardening provides an additional layer of protection for services based on the security principle of defense-in-depth. Windows Service Hardening cannot prevent a vulnerable service from being compromised; other Windows Vista components and defense-in-depth strategies, such as the Windows firewall and good patch management processes, help with that. Instead, Windows Service Hardening limits how much damage an attacker can do in the unlikely event the attacker is able to identify and exploit a vulnerable service.

Windows Service Hardening is also supported for consumption by third-party service authors, which allows application authors to get this same security benefit for their code.

Why It Matters

The cost of a security compromise can be huge. Confidential data can be compromised, users can lose data, and productivity can be sacrificed. An IT department might spend several weeks repairing the damage done by a severe compromise. Windows Service Hardening can greatly reduce the damage caused by a compromised service by preventing the service from changing important configuration settings or infecting other computers on the network. With Windows Service Hardening, what could have been a major security exploit can potentially be limited to a minor compromise.

Bookmark

Windows Vista will build upon the User Account Control initiative to limit Internet Explorer to just enough privileges to browse the Web, but not enough to modify user files or settings by default. This Windows Vista-only feature, known as Protected mode, will be in Windows Vista Beta 2. As a result, even if a malicious site attacks a potential vulnerability in Internet Explorer, the site’s code will not have enough privileges to install software, copy files to the user’s Startup folder, or hijack the settings for the browser’s homepage or search provider.

To help protect a user’s personal information, Internet Explorer:

Highlights the new security status bar when visiting a Secure Sockets Layer-protected site and lets the user easily check the validity of a site’s security certificate.

Has a phishing filter, which helps users browse more safely by advising them when Web sites may be attempting to steal their confidential information. The filter works by analyzing Web site content, looking for known characteristics of phishing techniques and using a global network of data sources to decide if the Web site should be trusted. Filter data is updated several times an hour, which is important given the speed with which phishing sites can appear and potentially collect a user’s data.

Clears all cached data with a single click.

Benefits

The new features in Internet Explorer help your users access resources on the Internet while minimizing security threats. Reducing the risk presented by malicious Web sites helps to reduce your potential security costs.

Why It Matters

Malicious Web sites can compromise your users’ computers, even if they only visit seemingly safe sites. The improvements to Internet Explorer in Windows Vista greatly reduce the risk of a browser’s being compromised, which reduces your security risks. With the combination of User Account Control and Internet Explorer’s new protected mode, you will not receive as many support calls from users complaining that their home page has changed or that they have unwanted Internet Explorer toolbars.

Bookmark

Theft or loss of corporate intellectual property is an increasing concern for organizations. Windows Vista has improved support for data protection at the document, file, directory, and machine level. The integrated Rights Management client allows organizations to enforce policies around document usage. The Encrypting File System, which provides user-based file and directory encryption, has been enhanced to allow storage of encryption keys on smart cards, providing better protection of encryption keys. In addition, the new BitLocker Drive Encryption enterprise feature adds machine-level data protection. On a computer with appropriate enabling hardware, BitLocker Drive Encryption provides full volume encryption of the system volume, including Windows system files and the hibernation file, which helps protect data from being compromised on a lost or stolen machine. In order to provide a solution that is easy to deploy and manage, a Trusted Platform Module (TPM) 1.2 chip is used to store the keys that encrypt and decrypt sectors on the Windows hard drive. It requires the TPM and an enterprise management infrastructure to ensure that the feature is easy to use for end users.

BitLocker full volume encryption seals the symmetric encryption key in a Trusted Platform Module (TPM) 1.2 chip. A TPM chip is a hardware component available in some newer computers that stores keys, passwords, and digital certificates.

BitLocker also stores measurements of core operating system files in a TPM chip. Every time the computer is started, Windows Vista verifies that the operating system files have not been modified in an offline attack. An offline attack is a scenario where an attacker boots an alternative operating system in order to gain control of the system. If the files have been modified, Windows Vista alerts the user and refuses to release the key required to access Windows. The system then goes into a recovery mode, prompting the user to provide a recovery key to allow access to the boot volume.

Recovery mode is also used if a disk drive is transferred to another system. Recovery mode requires a recovery key that is generated when BitLocker is enabled, and that key is specific to one machine. As a result, BitLocker is intended for enterprises with a management infrastructure in place to store the recovery keys, such as Active Directory. Otherwise, there is the potential for data loss if a computer fails and its drive is moved to another computer and the recovery key is unavailable.

Benefits

Windows XP and earlier versions of Windows are vulnerable to offline attacks that attempt to obtain a user’s data on lost or stolen computers. Unlike online attacks, which occur when the operating system is running (and therefore can be mitigated by firewalls and antivirus software), offline attacks occur when the operating system is turned off. The most common types of offline attacks are:

Starting an offline computer with a boot disk and resetting the administrator password so that the attacker can start the operating system and authenticate.

Accessing the computer’s hard disk directly with a different operating system to bypass file permissions.

BitLocker can be used to protect against both of these types of attacks. This protection is particularly valuable with mobile computers, which are vulnerable to theft.

Why It Matters

Lost or stolen computers often contain confidential corporate intellectual property or personally identifiable information about customers. The compromise of that data can result in an organization receiving unwanted publicity when news of the theft becomes public, which happens when an organization notifies customers that their personal information was lost. That can result in lost customer confidence and negative articles in the press.

With Windows Vista’s full volume encryption, you can dramatically reduce the risk of an attacker compromising confidential files by using offline attacks. Full volume encryption provides assurance that an attacker will not be able to access sensitive company or customer data on that machine if a laptop is lost or stolen

Bookmark