The Administration of BitLocker
Robert Collazo
Rasmussen College

The Administration of BitLocker
Describe and detail the system requirements and the various modes of BitLocker. Well because BitLocker stores its own encryption and decryption key in a hardware device that is separate from your hard disk, you must have one of the following, a computer with Trusted Platform Module (TPM), which is a special microchip in some newer computers that supports advanced security features. If your computer was manufactured with TPM version 1.2 or higher, BitLocker will store its key in the TPM. Also a removable USB memory device, such as a USB flashes drive. If your computer doesn’t have TPM version 1.2 or higher, BitLocker will store its key on the flash drive. To turn on BitLocker Drive Encryption, your computer’s hard disk must have at least two partitions. One partition must include the drive Windows is installed on. This is the drive that BitLocker will encrypt. The other partition is the active partition, which must remain unencrypted so that the computer can be started. Once you've encrypted the drive Windows is installed on, you can also encrypt additional data drives on the same computer. Be formatted with the NTFS file system. Have a BIOS that is compatible with TPM and supports USB devices during computer startup. If this is not the case, you will need to update the BIOS before using BitLocker.
Define the three authentication mechanisms that can be used to implement BitLocker encryption. The first authentication mode for BitLocker is; Transparent operation mode: This mode utilizes the capabilities of Trusted Platform Module (TPM) 1.2 hardware to provide for a transparent user experience—the user powers up and logs onto Windows as normal. The key used for the disk encryption is sealed (encrypted) by the TPM chip and will only be released to the OS loader code if the early boot files appear to be unmodified. The pre-OS components of BitLocker achieve this by implementing a Static Root of Trust Measurement—a methodology specified by the Trusted Computing Group. This mode is vulnerable to a cold boot attack, as it allows a powered-down machine to be booted by an attacker. The next authentication mode is; User authentication mode: This mode requires that the user provide some authentication to the pre-boot environment in the form of a pre-boot PIN. This mode is vulnerable to a bootkit attack. Last but not least we have; USB Key Mode: The user must insert a USB device that contains a startup key into the computer to be able to boot the protected OS. Note that this mode requires that the BIOS on the protected machine supports the reading of USB devices in the pre-OS environment. This mode is also vulnerable to a bootkit attack.
How does BitLocker encrypt data and what is the purpose of configuring Data Recovery Agents for this application? Data recovery agents are accounts that are able to decrypt BitLocker-protected drives by using their smart card certificates and public keys. Recovery of a BitLocker-protected drive can be accomplished by a data recovery agent that has been configured with the proper certificate. Before a data recovery agent can be configured for a drive, you must add the data recovery agent to Public Key Policies\BitLocker Drive Encryption in either the Group Policy Management Console (GPMC) or the Local Group Policy Editor. You must also enable and configure the Provide the unique identifiers for your organization policy setting to associate a unique identifier to a new drive that is enabled with BitLocker. An identification field is a string that is used to uniquely identify a business unit or organization. Identification fields are required for management of data recovery agents on BitLocker-protected drives. BitLocker will only manage and update data recovery agents when an identification field is present on a drive and is identical to the value configured on the computer.
Explain the different group policy settings that can be configured for BitLocker and BitLocker to go? BitLocker Drive Encryption Group Policy settings can be set for specific BitLocker-protected drives in your organization (or on your local computer if your computer is not part of a domain). This gives system administrators the ability to define policies based on how the drives are used. These policy settings can be applied to; all drives, these policy settings apply to all BitLocker-protected drives. Operating system drives; this is the drive on the local computer on which the operating system is installed. Fixed data drives; these are drives that are permanently installed on the local computer and cannot be removed while the computer is running. Removable data drives; these are drives that are designed to be removed from one computer and used on another computer while the computer is in use.