As you investigate how to secure your data at rest (DAR), you may see the terms “hardware full disk encryption” (HWFDE) and “software full disk encryption” (SWFDE). “Disk encryption” refers to technology protecting the data stored on a hard drive (HDD) or SSD. Cryptographic techniques convert stored data into a form that is unreadable and not easily deciphered by unauthorized people.

For many years, secure data workflows used removable hard drives. When data needed to be secured, users removed drives from their computers and locked them into a safe. Removable drives are still widely used and disk encryption enhances their security. In many cases, full disk encryption is actually replacing the need for removable drives.

Full disk encryption (FDE), also known as whole disk encryption, encrypts everything on the drive. Widespread use of full disk encryption technology has been gaining significant market traction as the use of laptops has proliferated. Laptops, and even desktops or workstations, are subject to being lost or stolen, not to mention the increasing number, scope, and sophistication of cyberattacks. 

File-level encryption is often used with large-volume storage (think data center) since physical control of data center storage is less problematic. (Cyberattacks, however, pay no attention to physical barriers.) File-level encryption can prove necessary on systems that may be vulnerable when access to the entire disk is authorized, as is usually the case with FDE. 

Full Disk Encryption is Transparent

Full disk encryption can take place in software or in specialized hardware. Regardless, the encryption process is transparent to the end user. Data is automatically encrypted when written to the disk and decrypted when it’s read from the disk. Examples of applications for SWFDE include VeraCrypt, SecureDoc, the dm-crypt feature found in modern Linux kernels, and the well-known BitLocker. 

Though invisible to the user, the encryption process requires significant computation. SWFDE uses the computer itself to perform encryption before writing or reading data. As a result, users can see slower application performance. 

Software encryption also provides a larger attack surface for potential hackers. If using SWFDE, take care to use an application that won’t expose keys in RAM or in pre-boot situations. SWFDE may exclude the master boot record (MBR), or similar area of a bootable disk, with codes that initiates the operating system loading sequence. This leaves the disk vulnerable to attack.

For example, a trusted platform module (TPM) is designed to be a secure cryptoprocessor defined by the international standard ISO/IEC 11889. The TPM chip, located on the host computer, works in conjunction with software to enable data encryption. As I mentioned in my previous blog (see Is BitLocker Sufficient?), the ROCA vulnerability in an Infineon code library, widely used in TPMs, enabled private keys to be inferred from public keys.

Advantages of Hardware Full Disk Encryption

HWFDE uses a hardware encryption engine located on the drive itself. This means that HWFDE is always on, always working to protect your data. (Sometimes self-encrypting SSDs are called self-encrypting drives, or SEDs). In addition, the SED relieves the computer of overhead to perform the encryption. HWFDE provides a smaller attack surface to hackers. In addition, HWFDE is OS-independent. 

Key management is simplified and more secure since the encryption keys are embedded in SSD hardware. Remaining on the drive, the keys do not need to travel into RAM or any other vulnerable portion of the computer or its software.

If your DAR security requirements only need one flavor of encryption, HWFDE can be a more flexible, higher performance, more secure choice. However, many program policies require two layers of security. Adding SWFDE to HWFDE may meet your requirements. Or using a secure hardware-based pre-boot authentication method will provide that added data security.  Something to note: when choosing your SSDs, be careful. Many consumer-grade SEDs have empty master passwords and other potential security failures, including sub-standard encryption in some cases. Avoid these pitfalls by choosing SSDs that are TAA compliant, NIST-certified FIPS vali, and FIPS-certified. (If you are unsure as to what these terms mean, check out our whitepapers and blogs in the Additional Resources section below.) 

Additional Resources

Whitepaper: Building a Citadel of Trust in a Zero Trust World

Whitepaper: Is Your Data at Rest (DAR) Truly Secure?

Blog: Classified Information and Data at Rest (DAR)

Blog: An Overview of Encryption Standards and Technologies

Blog: Is BitLocker Sufficient?

Article on EEJournal.com: Secure Your Data at Rest, Stupid!