The lost laptop
A salesperson leaves a work laptop on a train. It holds the price list and 400 customer names.
If the disk is locked, the finder sees nothing useful. If not, the company has a data breach.
Data is at risk in two places: when it sits still, and when it moves.
Key words
| Word | What it means |
|---|---|
| Data at rest | Data that is stored, such as on a disk. |
| Data in transit | Data that is on its way from one place to another. |
| Full disk encryption | Locking everything on a whole drive. |
| HSM | Hardware security module: a tamper-proof box that keeps keys and uses them inside. |
| TPM | Trusted platform module: a chip on the computer that stores keys for that one computer. |
| TLS | Transport layer security: the way a browser and a site build a locked link. |
| SSL | Secure sockets layer: the older name and the older, now unsafe, version of TLS. |
| Certificate | A digital document that proves who owns a site and holds its public key. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can say where full disk encryption, an HSM, a TPM, SSL and TLS are used, and choose the right one for a risk.
Starter: last lesson
Have a go
Starter: last lesson
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Cycle 1: data at rest
Full disk encryption locks the whole drive. Windows has BitLocker and macOS has FileVault. The user signs in, and the drive unlocks.
If the laptop is lost, the disk is only scrambled data. Always use an industry tool like these, never a home-made one.
Where do the keys live?
A lock is only as good as where its key sits. Two devices keep keys safe.
A TPM is a chip fixed to the board of one computer. It stores the keys for that computer, so the disk only opens on that machine.
An HSM is a stronger box or card, used for a whole business. It keeps keys inside and does the locking there. The keys never leave. Banks use them.
Worked example: three tools for data at rest
| Tool | What it protects | Where you meet it |
|---|---|---|
| Full disk encryption | Every file on one drive | A staff laptop with BitLocker |
| TPM | The keys for one device | A chip on that laptop board |
| HSM | The keys of a whole business | A bank or a server room |
The cells students fill in are left blank in this preview.
Check: the first three tools
Have a go
Check: the first three tools
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.