I was told that hard disc encryption prevents people who have physical
access to my laptop from reading my files, does that work against online
hackers who hacked into my network? Would a complete hard disc encryption make
Yes and no.
While encryption is a powerful tool in your security tool box, it’s not a
replacement for good network security, or any number of other important
security measures for that matter.
We need to look at exactly what is, and is not, protected when you have, and
when you use, encrypted data.
Become a Patron of Ask Leo! and go ad-free!
The rule is actually quite simple: encryption prevents access to the
encrypted data unless you have the key.
Let’s say you have an encrypted file on your hard disk. Assuming you’ve used
appropriately strong encryption, then if someone steals the computer they would
not be able to see the contents of that file.
The same applies if your network or machine were compromised … if all the
intruders gain access to is the encrypted file, then they still have
access to nothing since they can’t see what’s inside.
Encrypted data must be decrypted in order to be used. So what if you were
using the data at the time the network breach occurred? Or while you had some
kind of malware infection on your machine?
security breach … could also allow an attacker to have access.”
Then, to put it bluntly, all bets are off.
I’ll use a TrueCrypt volume as an
example. When not in use the volume is just a file full of encrypted data that
no one but you, using the corresponding passphrase, can access. In order to use
a TrueCrypt volume, you must supply the correct passphrase when you mount it.
Once mounted its contents are then visible to you as unencrypted
And therein lies the problem: if you can see it, then a successful attacker
could see it. If there were a network breach while you had your encrypted data
mounted and visible, that data could be accessible to a remote attacker.
And, in my opinion, it actually gets worse if you rely on whole-disk
encryption of your system drive.
With whole-disk encryption, the hard disk is completely encrypted including
not only your data, but all your programs and even Windows itself. Before you
can even boot your machine you must provide the proper passphrase to decrypt
That’s actually pretty cool protection if the machine is off. Someone can
walk away with your laptop and the entire hard disk is simply so much encrypted
noise to them.
The problem, as I see it, is that if you’re using your machine then
everything is being decrypted and is fully accessible. A malicious network
based attack could once again have access to everything.
That’s why, personally, I don’t use full-drive encryption. My
approach is actually to encrypt what should be encrypted, and thus only have
that data accessible while I need it. When not in use the encrypted volume is
not mounted, and hence inaccessible to not only myself, but any
possible intruder as well.
And that’s truly the bottom line: if you can access the unencrypted
data, then a security breach in the form of a network attack, spyware or other
malware, could also allow an attacker to have access.
The lesson is simple: encryption has an important role in security, but it’s
no substitute for the rest of the package: having a firewall, using
anti-malware scans, staying up to date, and being security conscious as you go
about your day.
4 comments on “Will hard disk encryption protect me from network attacks?”
Just wondering though, if I had a laptop with a full encrypted hard drive AND small TrueCrypt files to encrypt the REALLY important stuff I wouldn’t want anyone to see when the computer was unencrypted that would be better than just having the TrueCrypt files on their own right?
No, not really. If you use a strong enough password with Truecrypt (at *least* 10 characters, no dictionary words, mix of upper & lower case, a number or two thrown in), then using Windows Encrypted File System as well adds little to the security, but greatly increases the chance that you’ll be inadvertantly locked out of your laptop.
As long as all the files you want to secure are in Truecrypt volumes with good passwords, the only thing that full disk encryption protects against is the possibility of someone stealing your laptop, extracting the platters from the hard drive, and scanning through them for swap traces, on the offchance that the files in your truecrypt volumes will have been loaded into the Windows Pagefile (virtual memory) at some point when you last viewed them.
I suggest that that the chances of that happening to you are probably quite low (unless, of course, you’re habitually referred to as “Number Six”), and so one layer of encryption is probably enough.
I thought when you (we) mount a TrueCrypt volume, the files are only decrypted in RAM; the entire volume otherwise remains encrypted. Have I missed something in TrueCrypt’s instruction set? Ciao!
—–BEGIN PGP SIGNED MESSAGE—–
In a sense that’s true. A file isn’t decrypted until it’s
accessed. However the list of files – the directory – is
quite visible. The mounted volume just “looks like” any
other disk drive. Any malware that simple accesses files
will be able to access files from a mounted TrueCrypt
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.7 (MingW32)
—–END PGP SIGNATURE—–