Windows 7 BitLocker To Go tightens thumb drive security

Stephen Withers
Thursday, 25 June 2009 08:05

Business IT - Technology

Security controls on removable drives forms an integral part of Windows 7, squeezing third-party developers from yet another niche.

There have been many examples of functionality provided by independent developers being rolled into operating systems. For instance, early Windows versions didn't include disk defragmentation, and Mac OS X's Dashboard feature has a lot in common with Konfabulator.

A couple of years ago, the storage capacity and ubiquity of unobtrusive USB thumb drives and MP3 players (notably iPods) reached the point where some security analysts began warning that they could be used to take large quantities of corporate data outside the organisation.

Suggestions included blocking USB ports with epoxy glue, or installing special-purpose software to prevent the use of USB storage devices.

These draconian measures may be effective, but they may interfere with normal use of computers and peripherals. Microsoft may have come up with a more balanced approach in Windows 7.

Windows 7's BitLocker To Go feature extends the existing BitLocker drive encryption to removable storage. Encrypting data on such devices presents an obstacle to using a lost or stolen drive.

But what happens when the user is actively trying to steal data?

System administrators can set up Windows Server 2008 R2 group policies to enforce the use of BitLocker To Go, so that PCs will only be able to write to removable drives if they are encrypted.

Since a data thief could hand over the encryption passphrase along with the drive itself, there is also provision for requiring the use of smart cards or domain user credentials to gain access to the data on such drives.

That might not be foolproof, but at some stage you have to accept that trusting someone with access to a file means exactly what it says.

BitLocker To Go drives are directly usable with Vista, and an XP-compatible reader application is automatically installed on encrypted drives for the convenience of users with older computers (eg, at home).

Another interesting feature of BitLocker To Go policies is that it is possible to exempt specific devices (on the basis of their GUIDs) from an otherwise mandatory use of encryption. This is necessary where you want to allow the use of a device such as a digital camera that cannot handle encrypted media.