1

We need to deploy a web based application at a client site where it will be within their local intranet.

Part of our requirement is to provide some basic security to protect our IP. I realise that nothings a 100% guaranteed fix but we are just looking to make it a bit harder for most people.

The server will be running server 2008 and I was considering using bitlocker as a cheap and nasty way to protect it.

From what I understand assuming the mobo supports it we can use the Transparent bitlocker mode and this means that moving the hdd to another pc will mean the hdd will be unreadable in that machine baring some sort of cold boot attack to steal the encryption keys.

Is this assumption correct and in the case that the motherboard or any other component fails in the pc and we need to replace it do we lose access to our data or is there a way to unencrypt it (obviously accessible to only our company)

EDIT: we do have legal documents that cover this and we will be locking the pc physically and the client will not have access to the pc (windows login) other than via the website we host on it

Daniel Powell
  • 76
  • 2
  • 14
  • What are you protecting your IP from? It doesn't seem like you have this part figured out yet. – Michael Hampton Nov 05 '12 at 03:50
  • In case any enterprising individiual at the location wants to crack open the case and look at whatever source code that is lying around on it – Daniel Powell Nov 05 '12 at 04:13
  • I meant the pc case and take the hdd out, we don't expect this to be an issue at all but I need to provide some assurance that there is some deterrent if someone wanted to do this – Daniel Powell Nov 05 '12 at 04:16

2 Answers2

3

You can recover the data with a recovery key if you have hardware die in the machine.

That said, Bitlocker doesn't really seem like a good choice if they're going to have physical access to the machine, since once it's running the data is decrypted. I, personally, would never deploy a server in my environment that was encrypted with a key that I didn't have.

Even if they aren't allowed to log in to the machine (which is another turn off), they could just use wget/curl to get all web content on the server and parse it on another machine. You're not really protecting anything.

I think what you want is to issue standard NDAs to your clients. You seem to have a policy/licensing problem, not a technical one.

MDMarra
  • 100,734
  • 32
  • 197
  • 329
  • We do have agreements with the clients re terms of use etc covering this kind of thing but just wanted some extra protection, in our case most of the IP is not just content but rather the processing we do so that wouldn't really be effected by a wget/curl – Daniel Powell Nov 05 '12 at 04:14
  • Then just compile whatever code you don't want them to be able to see. Problem solved. – MDMarra Nov 05 '12 at 13:12
1

BitLocker provides Full Disk Encryption with multiple ways to secure the encryption keys. One way is using a TPM chip, which is commonly part of the motherboard (though some computers use an LPC Bus to attach the chip). If your motherboard already has TPM then it can store the encryption key.

When initializing BitLocker you are prompted to save or print a recovery key. This is using in case TPM cannot provide the key (most commonly because someone messed with BIOS settings, Windows startup settings, or did a BIOS upgrade).

Without the Recovery Key moving the hard drive to another machine, or messing with the way the computer boots, will render the drive unreadable. Protect that Recovery Key or you're asking to be locked out of the system at some point.

As others have pointed out, once the system is running, Windows is somewhat oblivious to the encryption. If you configure the OS so that there are no access controls preventing someone from looking at files, then the files will not be protected. BitLocker prevents someone from taking the drives and having anything useful, it does not protect the drives from the OS as configured.

Chris S
  • 77,945
  • 11
  • 124
  • 216