Vendors take giant leap with drive encryption

Now that the capacities of small form-factor drives have hit hundreds of gigabytes, just about any corporate database can easily fit on a laptop. That affordable capacity gives users the opportunity to work outside the office on projects with large data footprints. But it also can expose your company to liability if a storage device holding classified data falls into the wrong hands.

Encryption seems to be the obvious way to prevent data leaks, but because software encryption tools add some delay and some complexity, that option hasn’t gained much popularity with users.

Hitachi and Seagate recently started to offer 2.5-inch disk drives with native, hardware-based, full-disk encryption. These solutions offer companies another option for laptop data protection that promises to be reliable and easy to implement — without the performance slowdowns you get from software tools.

In March Seagate announced its line of Momentus 5400 FDE.2 drives, with capacities ranging from 80GB to 160GB. More recently, Hitachi GST (Global Storage Technologies) countered, offering the factory-activated Bulk Data Encryption option on all Travelstar drives with both 5400 RPM and 7200 RPM.

Despite their differences, these drives have in common a set-and-forget encryption capability: After you activate encryption, all content will be automatically encoded with a strong cipher.

It’s worth noting that activating encryption also adds a boot-level password that will keep prying eyes from reaching your data, even if the drive is transferred to a different machine. Should you change your mind and decide, for example, that the drive has to be redeployed to a different user, you can deactivate encryption at any time. There is an additional benefit to having full drive encryption: quick obliteration. Throw away the encryption key and all data becomes inaccessible.

For my evaluation, Seagate sent not just a bare drive but an ASI Computer Technologies laptop mounting a SATA 120GB Momentus FDE.2, a fingerprint reader, and a TPM (Trusted Platform Module). The laptop came preinstalled with Windows XP and the Embassy Security Center, a suite of applications from Wave Systems that simplifies managing the security features of the hard drive and of the whole system.

From Hitachi, I received just the drive: a 200GB, 7200 RPM Travelstar 7K200 also with SATA connection. Installing the drive in one of the laptops in my lab was fun, but end-users won’t have to go through that; they’ll get it preinstalled on a laptop. (At publishing time the vendor had not made any public announcements of this sort, but it’s reasonable to speculate that partnerships with laptop manufacturers and vendors of security management software will develop in the future.)

Both drives had encryption features disabled, so my first task was to choose a proper password, store it in a safe place, and proceed with the activation.

Activating the encryption on the Seagate drive was a breeze. From Windows I started Trusted Drive Manager, the friendly GUI from Wave Systems that makes activating encryption easy and intuitive.

After choosing my drive and clicking the Initialize button, I was able to maintain my Windows user name for controlling encryption. This is a boon for users because they won’t have to remember a different authentication pair for encryption. The GUI also simplifies controlling other features, such as crypto erasing the drive content and removing protection.

The Embassy suite also offers a feature for centralized, remote administration (though this was not activated on my system). This feature warrants consideration for organizations where many users need laptops with full-drive encryption.

After being spoiled by the broad set of features of the Embassy suite, I had only the streamlined BIOS screens to get the encryption going on the Hitachi drive. That works to switch the drive security on and off, but you can’t activate other options from the BIOS screen, such as quickly erasing the content by destroying the key — despite the fact that the drive firmware has that capability.

With encryption activated, my laptops stopped at boot time with a prompt to enter a password. Appropriately both drives limit the number of wrong password attempts. In fact, after more than three incorrect passwords, the Travelstar automatically turned off. The Momentus is a bit more lenient toward forgetful users; they will have to power cycle the machine after five failed attempts.

Obviously, your password should not be easy to guess. Appropriately, using the Embassy Security Center, you can set the system to enforce strong user passwords, flexibility that’s missing if you set the password via BIOS.

Moving the two drives to a different system also proved to be a dead end for a potential hacker. Windows did not even recognize the drives and couldn’t access the file system on them. Trying to get to the drives’ content from a Linux machine proved equally unsuccessful.

Although, I ran my tests on similar machines, the drives’ different capacities and rotation speeds make a direct performance comparison moot. Nobody should be surprised to learn that the Hitachi drive performed consistently faster.

Regardless, what’s more important is how much, if at all, encryption affects performance and what impact encryption-capable drives have when it comes to managing laptops. To that effect, the Wave Systems security is a terrific help in managing encryption on the Seagate Momentus FDE.2, adding not only simplified management but access to some of the drive’s otherwise inaccessible features, such as crypto-erasure and strong-password enforcement.

Managing encryption from the laptop BIOS is doable and grants data protection, but if you have more than just a few laptops to babysit, the management suite from Wave Systems can make life much easier.

Perhaps the most important outcome of my evaluation is that after activating encryption, I did not notice any slowdowns on either drive. Moreover, running the same benchmarks on both drives with and without encryption, I saw no significant differences in terms of performance. This confirmed my impression that neither drive had lost responsiveness; both drives passed the performance tests with reasonable marks. This is probably the most significant advantage that built-in hardware encryption has over software-based alternatives, and it should remove any excuse for not encrypting sensitive data on laptops.

According to ASI Computer Technologies, adding encryption increased the cost of the laptop by US$100, less than 6 percent. Hitachi is not talking price at the moment but I would be very surprised if the additional cost for an encrypted drive would be much different.

With that in mind, getting a laptop with full-drive encryption should be a no-brainer. A handful of dollars is a small premium for insurance against possibly disruptive damage. Easy management such as what the Embassy suite offers will add to that priceless peace of mind.