0

I am working in a company which they want to encrypt they entire hard disk if someone wants to pulls it out from server. I searched a lot about windows bit-locker or some alternative software's but they all don't have the functionality that I want.

I want exactly just encrypt data when it is not in our own server that no one with another computer or server can access it! for example that software take MAC Address of local server or something like that! So anyone here have any idea that how I can solve this problem?

(I hope python developers recommend me a python library for this)

1 Answer 1

0

The first thing that comes to mind is the easiest and laziest, and that is, I think to write a service that you have run on StartUp/Boot of the machine. This service retrieves the parameters (MAC and HardwareID of the hard drive, etc) and then compares that data to what it retrieves from the Machine and the Drive itself. If that test passes, everything is good and nothing happens. The service kills itself.

If, instead any of the data that you checked does not match, then you want to encrypt the hard drive, if I understand correctly. I don’t know if the BitLocker’s and the VeraCrypt’s types of software have a CLI to encrypt. I would suspect they do, but if they don’t, you can always encrypt with PGP. That does have a CLI. You will need to create private key beforehand and use that to encrypt the target drive/files (instead of a simple password, as you would with BitLocker and VeraCrypt).

What is your intent? To avoid someone taking the drive? Do you expect them to return it? If not, why not bleach and destroy it then? No encryption required. That feature is built-into the OS. That is way easier. I don’t have the whole picture. I hope that helped a bit.

To add on: Look at BitLocker and VeraCrypt. There are many others, I am sure just as good. I would not look at Symantec. Anyhow, make sure you select the "Full Disk Encryption" option. What this does, is that it encrypts the hard drive entirely, including the boot loader. This mean

This means that you will be prompted for a password. During the bootup phase, during the black screen. With this password, the boot sector is decrypted and the OS is allowed to start up. Notice that the data on the hard drive is always encrypted and data that is requested from the hard drive is decrypted on-the-fly. Only the data that is in RAM is in clear text if you will. Your hard drive is safe at all times. Whether the machine is on or not.

Last, if you want yet another layer of security, BitLocker has a nifty set up with YubiKey - a USB key that provides a TOTP password, which is impossible to guess and one must be physically present at the machine with this key in hand to start the machine.

This way the TaxMan can't look at the Post-It note and type in the password that's written in plain sight.

I wish you good luck with the project. It's really simple. It's all built -in, extremely well tested and most large corporations use it. I know at it was mandatory for the reason you mention (except we didn't fear the taxman).

Best of luck with your project, and you may not have to write a single line of code and go home early today. Not bad....

5
  • Actually I want to encrypt data from tax guys :D they would come and grab the hard disk! maybe! so we should protect our data to avoid company crash Jun 1, 2019 at 13:15
  • Look, I think the best and proper way to do this is to keep it super simple and not try to reinvent the wheel. The BitLocker’s (I use plurarl, because there are other HDD sofwtare that do this as their main purpose) have capabilities to encrypt and decrypt at the very early stages of the boot process. This is a process at low levels, that as a software engineer writing code on much higher levels you just don’t have access to.
    – rxon
    Jun 1, 2019 at 13:21
  • [I hit Enter - Sorry] So, I suggest you use these encryption software as they are meant to be and you’ll be better protected than you, I and 100 other dev’s here could do together. No need to reinvent the wheel. If Tax man takes the drive, let them have it. It isd useless with the decryption password, certificate or whatver other method you have in place to decrypt the drive on bootup.
    – rxon
    Jun 1, 2019 at 13:23
  • Edit: the drive is useless WITHOUT the decryption key.
    – rxon
    Jun 1, 2019 at 13:25
  • Thanks man <3 I'll do what you told me Jun 1, 2019 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.