How can I encrypt my laptop to protect my personal data?
Richard
has personal data on his laptop PC and would like to encrypt the hard
drive to protect it. Is this still the best approach?
Losing a laptop containing unencrypted personal data could cause you a real headache. Photograph: Getty
How do I encrypt the hard drive on my laptop so that if I lose it the personal data on it is protected?
Richard
This is one of those ideas that sounds good but may be more trouble than it's worth. If you work for a big company then drive encryption is straightforward. Staff will be using the Enterprise edition of Microsoft Windows, which includes the BitLocker drive encryption system. This automatically encrypts any files saved to the hard drive, and USB thumb drives and other external devices can be encrypted using BitLocker To Go. IT staff can set everything up using a management console and use your Active Directory service to store the recovery keys.
However, BitLocker is not included with consumer versions of Windows, only with Enterprise and (expensive) Ultimate versions, and I wouldn't recommend this approach to individual users. Nor would I recommend similar systems aimed at corporate users, such as McAfee Endpoint Encryption and Sophos SafeGuard Enterprise.
If you really want to take this route, the usual option is TrueCrypt, though it's far from user-friendly. This is free (donationware), open source "virtual drive" encryption software, and it's available for Windows, Mac OS X, and Linux. However, it has no supporting management infrastructure, and no key recovery system. If you forget your password, or something goes wrong with the TrueCrypt file, there is no way to get your data back. You must therefore keep separate backups.
The drawback with full disk encryption is that the hard drive is, in effect, unencrypted when you are using it. This is a good thing because you want everything to work normally. However, once you have entered the password, anyone who can access your PC can also access your data. If you are logged on and using your laptop in a coffee shop, for example, your data isn't protected.
To do this, set Windows so that the on/off button puts the PC into sleep mode and a password is required when it is woken up. This works well with Windows 8 since it should restart almost instantly (as Macs have done for years).
You could follow Gizmo's recommendation and use Sophos Free Encryption. This unrestricted freeware program works much like a zip compression program. It seems to have been removed from Sophos's list of Free Tools but, at the time of writing, you can download it directly from Sophos using this link. If you decide to try AxCrypt instead, decline all offers to install the other programs it tries to foist on you, especially Open Candy.
Sophos provides a free encryption program, which is a rebadged version of Utimaco's PrivateCrypto, which Sophos owns
Note: you may be using a version of Windows that already includes an Encrypting File System.
This wasn't part of the Windows XP Home version, but home users can do
the job by right-clicking on the folder they want to protect, selecting
Properties, clicking the tab for Sharing, and checking the box for "Make
this folder private". However, this only works if the hard drive is
using the NTFS file system, not the old FAT file allocation table from
MS-DOS.
You can store the bulk of your personal files in password-protected cloud services such as Dropbox and Microsoft SkyDrive, or store them on the PC or server you keep at home. You can get to them remotely using a VPN (virtual private network) or an easy-to-use web-based system such as LogMeIn.
You can also set up your browsers so that they delete everything when you close them down. This means clearing the cache where temporary internet files are stored, and deleting other browser data. WikiHow has an illustrated guide, How to Clear Your Browser's Cache, which covers all the main browsers.
An alternative is to use the browser's InPrivate browsing mode, Incognito or (in Firefox) open a Private Window for browsing. These don't save data or clear it automatically when you end the session.
Another idea is to run the browser in a separate sandbox using a program such as Sandboxie for Windows. This not only stops data leaking into Windows caches, it helps protect you from malware. This is why Google Chrome and Internet Explorer 10 already have their own built-in sandboxing.
Programs like CCleaner always carry some risk, but I've been using it since at least 2005 (the earliest mention I can find in Ask Jack) without any problems. However, download it from the Piriform site, and do not follow any scam links from adverts on Google. Also, when installing CCleaner, remember to untick the offers to "Install Google Chrome as my default browser" and "Also include Google Toolbar for Internet Explorer". Free software suppliers get paid for installing "foistware" but it should always be provided on an "opt in" basis. You should never have to opt out. That's evil.
Finally, you may want to consider installing tracking software on your laptop, to help you find it again if it is lost or stolen. Prey is probably the most popular free option, though it also offers Pro accounts at $5 to $399 per month. Prey password-protects your data and lets you wipe stored passwords remotely. With Prey, you want the thief to be able to access your PC, so remember to install a Guest account with limited functionality.
How can I encrypt my laptop to protect my personal data by Jack Schofield
Richard
This is one of those ideas that sounds good but may be more trouble than it's worth. If you work for a big company then drive encryption is straightforward. Staff will be using the Enterprise edition of Microsoft Windows, which includes the BitLocker drive encryption system. This automatically encrypts any files saved to the hard drive, and USB thumb drives and other external devices can be encrypted using BitLocker To Go. IT staff can set everything up using a management console and use your Active Directory service to store the recovery keys.
However, BitLocker is not included with consumer versions of Windows, only with Enterprise and (expensive) Ultimate versions, and I wouldn't recommend this approach to individual users. Nor would I recommend similar systems aimed at corporate users, such as McAfee Endpoint Encryption and Sophos SafeGuard Enterprise.
If you really want to take this route, the usual option is TrueCrypt, though it's far from user-friendly. This is free (donationware), open source "virtual drive" encryption software, and it's available for Windows, Mac OS X, and Linux. However, it has no supporting management infrastructure, and no key recovery system. If you forget your password, or something goes wrong with the TrueCrypt file, there is no way to get your data back. You must therefore keep separate backups.
The drawback with full disk encryption is that the hard drive is, in effect, unencrypted when you are using it. This is a good thing because you want everything to work normally. However, once you have entered the password, anyone who can access your PC can also access your data. If you are logged on and using your laptop in a coffee shop, for example, your data isn't protected.
Encrypting files and folders
There are other problems with full disk encryption — see Gizmo's Encryption is Not Enough — which suggest that other approaches may be better. If you need to carry personal data around, then I suggest you encrypt specific files and/or folders, or use an encrypted USB memory stick. Someone should then need at least two passwords — for your user account, and your encryption — even if they have physical access to your laptop while it's running.To do this, set Windows so that the on/off button puts the PC into sleep mode and a password is required when it is woken up. This works well with Windows 8 since it should restart almost instantly (as Macs have done for years).
You could follow Gizmo's recommendation and use Sophos Free Encryption. This unrestricted freeware program works much like a zip compression program. It seems to have been removed from Sophos's list of Free Tools but, at the time of writing, you can download it directly from Sophos using this link. If you decide to try AxCrypt instead, decline all offers to install the other programs it tries to foist on you, especially Open Candy.
Sophos provides a free encryption program, which is a rebadged version of Utimaco's PrivateCrypto, which Sophos owns
Note: you may be using a version of Windows that already includes an Encrypting File System.
This wasn't part of the Windows XP Home version, but home users can do
the job by right-clicking on the folder they want to protect, selecting
Properties, clicking the tab for Sharing, and checking the box for "Make
this folder private". However, this only works if the hard drive is
using the NTFS file system, not the old FAT file allocation table from
MS-DOS. Use the cloud
Bearing in mind the risk of theft and the hassles of travelling overseas — where some official may well demand that you provide access to your PC — it's better to carry laptops that contain little or no personal data. (If you need to work on a flight, keep the data on a USB stick, or on an SD card that you can extract from and then re-insert into your digital camera or similar device.)You can store the bulk of your personal files in password-protected cloud services such as Dropbox and Microsoft SkyDrive, or store them on the PC or server you keep at home. You can get to them remotely using a VPN (virtual private network) or an easy-to-use web-based system such as LogMeIn.
Browser hygiene
After that, you need to take great care with your web browsers. It's very important that you never use a browser to store passwords. If you do, someone who gets into your PC can easily access your cloud services and data.You can also set up your browsers so that they delete everything when you close them down. This means clearing the cache where temporary internet files are stored, and deleting other browser data. WikiHow has an illustrated guide, How to Clear Your Browser's Cache, which covers all the main browsers.
An alternative is to use the browser's InPrivate browsing mode, Incognito or (in Firefox) open a Private Window for browsing. These don't save data or clear it automatically when you end the session.
Another idea is to run the browser in a separate sandbox using a program such as Sandboxie for Windows. This not only stops data leaking into Windows caches, it helps protect you from malware. This is why Google Chrome and Internet Explorer 10 already have their own built-in sandboxing.
CClean and Prey
Finally, it's a good idea to keep a copy of Piriform's free CCleaner installed on Windows laptops. This removes temporary files, history files, cookies, logs, auto-complete entries and other detritus from browsers and many common programs. It also includes a Windows Registry cleaner. For best results, run it immediately after a re-boot, with no other programs running.Programs like CCleaner always carry some risk, but I've been using it since at least 2005 (the earliest mention I can find in Ask Jack) without any problems. However, download it from the Piriform site, and do not follow any scam links from adverts on Google. Also, when installing CCleaner, remember to untick the offers to "Install Google Chrome as my default browser" and "Also include Google Toolbar for Internet Explorer". Free software suppliers get paid for installing "foistware" but it should always be provided on an "opt in" basis. You should never have to opt out. That's evil.
Finally, you may want to consider installing tracking software on your laptop, to help you find it again if it is lost or stolen. Prey is probably the most popular free option, though it also offers Pro accounts at $5 to $399 per month. Prey password-protects your data and lets you wipe stored passwords remotely. With Prey, you want the thief to be able to access your PC, so remember to install a Guest account with limited functionality.
How can I encrypt my laptop to protect my personal data by Jack Schofield
No comments:
Post a Comment