Practical Security

BitLocker

BitLocker is Microsoft’s full disk encryption (FDE) solution. It encrypts the entire file system transparently to the user and the applications. This is a defense against attackers with physical access, but since the file system is decrypted automatically once the system boots up, this doesn’t provide any defense against malware or attackers with access to the machine via stolen creds or that are exploiting vulnerable software running on the box.

Without an FDE solution in place, an attacker with physical access can just pull the hard drive out of the victim’s computer, copy it to an external drive, and take the external drive away for investigation. While an attacker has the hard drive removed from the computer, they can also attach ...