Bonnee Peebles said:
HELLO.
I got my girlfriend a 512 MEG memory drive that you put in your one of
the sockets on the front of the computer. She said it has something
on it that would encrypt her stuff on the memory drive. It was a San
Disk by the way. I though this was pretty good because the stuff that
she kept on the thing would be protected if it got lost or stolen at
work.
Last week she told me she needed something bigger and since I really
do not know much about them, I let her pick one. We got a San Disk
Cruzer micro 2.0 GB. She says it has more room but it looks smaller
then the first one. Any way , this one did not have something to
encrypt the stuff on it. She said it just has a password. I was
wondering what was the difference between a password and encryption?
Also, I am very new to the world of computers. I am a college
educated professional so I am not stupid. However, as I said, I don't
know about computers.
If someone could help I would very much appreciate it.
Bonnee
At its weakest, all a password is controlling, is allowing a
device driver to access the device. All of the data could be
stored in plain-text inside the memory chip. Without more
details, we don't know what additional measures are implemented
or tied to the password.
Encryption implies the data in the memory chip is in encrypted
form. If you were to look at the bits under a microscope, they
would be jumbled and unreadable unless you know the encryption
algorithm and key. If the contents of the memory chip are encrypted,
then even if examined under a "magic microscope", the examiner
would not be able to read the files. The examiner would need to
know the encryption algorithm used and the key, to read the files.
Encryption can be done in hardware or in software. Both can
be effective if done right.
A question for your girlfriend would be whether her employer
knows she is hauling valuable data around in this way. The need
for a 2GB device implies she is hauling too much stuff around,
and should use the device purely for transport and not for
archiving. At my previous employer, I could probably haul all
of the companies intellectual property assets around in a
1GB stick. It would be especially embarrassing, for example,
if the only copy of her work related files were on the stick,
and the stick were to fail. So the stick should be limited to
usage as a transport device, and not as a sole copy of
whatever she is working on. The primary copy should be at work,
and the work computer hard drive backed up automatically by her
IT staff.
At the very least, she should be discussing the nature and
need to move data between work and home, with the IT staff
of her employer. The IT staff at my last job were
knowledgable and helped set up a secure VPN connection, so I
could access files electronically with at least a
modicum of security. You still need to delete any temporary
files from the home computer, if you want to be as hygienic
as possible, so you still have to exercise care and attention
to avoid endangering company assets.
There have been too many tales of important files being lost
or ending up in the wrong hands, due to working like this.
If your girlfriend wants to keep her job, she should at least
be consulting with someone about what she is doing.
There are hard drives that encrypt all data at the hardware
level. You could use one of these on your girlfriends home
computer, so any files transported to the home computer, cannot
be stolen if the computer is taken in a breakin. But storing
the files at home should still be done with the knowledge and
approval of her manager. And of course the home copy should
not be the only copy of any file, due to the danger of a
breakin. Using a drive with encryption is covering the
hygiene issue a bit better.
(full disk encryption FDE on Momentus drives)
http://www.seagate.com/products/notebook
With either encryption or with passwords, if the password
or key is lost or forgotten, the data is gone. Effectively,
it makes the storage media less reliable, which is
why the primary copy of the file should be stored some
place where they do regular backup copies.
Another thing to note about data protection methods, is they
should be proven to be effective. I had one fellow employee
come to me, and she said she had lost the password to a
password protected device. When I examined the device, I
discovered that the password was stored in plaintext, with
only the hex digits of each ascii character being reversed
(i.e. 30 hex became 03 hex). It was a cinch to break the
password and get her data back. The hard part, was telling
other people not to rely on that product any more
Paul
