Bitlocker – what is it & should I do it?

Bitlocker is Microsoft’s preferred hard disk encryption system. Which makes it as clear as mud…

Let’s start from the beginning. Your laptop (or PC or similar device) stores all your stuff on a “hard disk”. And your laptop gets lost/stolen. Apart from the annoyance & cost of replacing  your laptop, your personal data is now in the hands of some unknown third party

But you set a password to log in to Windows, so it’s all safe, right? No – very, very wrong! Because accessing all your stuff is trivially simple. All the bad guy has to do is physically remove the hard disk, drop it into his own PC and request access. His system will warn him that the files are password-protected – along with the helpful option to proceed anyway. And bingo – your personal data laid bare.

An encrypted hard drive (see the padlock?)

This is where hard disk encryption comes in. When you turn on this feature your laptop encodes all your data with a special key. When you want to read anything it decodes it with (a different) special key – which it remembers. So you go on using your laptop exactly as normal. If, however, the drive detects a significant change in the hardware (like being plugged into another computer) it will insist on you entering the decryption key. No key, no data. So your data is now pretty safe from prying eyes.

Is there a downside? Well, yes – as you’d expect. The technology has been around for ages. But in the past there’s been a considerable performance hit, what with all that encrypting and decrypting. Now, however, modern solid-state drives have the encryption capability baked-in: so the performance hit is minimal. Of more concern is storing your keys. If you make changes to your laptop (something breaks & is repaired) this may trigger the key request.

Bitlocker demanding a key

And, if you can’t find it, no data. If you are a Microsoft365 customer the system can backup your keys into your cloud account, where you can retrieve it by logging in from another computer. Or you can save it to, say, a USB stick (which you then store in a safe place – and we know how that goes!). So, in general, we’d recommend turning it on: just make sure you keep tabs on where the key is, so you can lay hands on if it all goes bad!

Updates. Why?

It sometimes seems these days that everything you touch needs to ‘update’ before it will do what you purchased it for. It is one of life’s endless irritations. So what is going on, why do we need them and are they important?

Modern software consists of thousands – maybe millions – of lines of computer code. The reputable suppliers take a huge amount of care to try to get this code as fault-free as possible. But to get the system 100% perfect would be (even assuming such a thing is possible) so time consuming that the product might never make it to the shelf. It’s generally accepted that there will be imperfections hidden in there somewhere.

We also have to accept that technology develops over time – and this might require changes to the software in you PC.

For these (And other) reasons software suppliers create & release ‘updates’ or ‘patches’.

We can therefore group the drivers for these updates as:

• Fixing faults in the software code.
• Desire to add features.
• Updates to meet more recent standards
• Remediate security flaws discovered by researchers (or scammers!)

How?

Responsible software companies will support their software for a specified time after release. During that time they will research problems & create solutions. These solutions will normally be in the form of ‘patches’ that are download from the Internet and applied in the relevant place. Hence you will hear the expression ‘fully patched’ to indicate that the software in question has been fully updated with these remedials.

Out of support.

Once the end of the specified support period is reached the company will cease these efforts. This is often called ‘end of life’. The expectation is that the user will UPGRADE to a new version of the software, which will have its own support period off into the future. The catch is, of course, that getting a new version often costs money. The risk of NOT doing so is that, should any flaws remain in the system at the end of the support period, you are vulnerable to whatever effects those flaws allow. Which, in the worst case, may be to allow miscreants to access and exploit your system.

Should I?

That depends on usage.

Businesses should not, as a rule, continue to run ‘end of life’ systems. Especially if your system holds sensitive data of any sort. It puts that data at preventable risk. It might well invalidate your ‘cyber insurance’. It will be looked on askance by regulatory bodies like The Law Society & The Financial Conduct Authority.

Private users are no less at risk, but are not driven by the same imperatives that business users are. Additionally they are less of a target. So running your system a couple of years beyond it’s end-of-life date is probably a risk they are willing to run.

Why tell us know?

The driver behind this article being written now is the imminent demise of Windows 10. Microsoft will end support in October 2025. From that point on they will only support Windows 11. They announced this is the summer giving users – particularly businesses – 18 months to migrate their fleets onto Windows 11.

As a professional support company we strongly recommend you look into this in a rigorous manner, the sooner the better. Please don’t leave it until the last minute when (a) it’ll be a terrible rush (b) your IT support staff will be on holiday (c) hardware will be in short supply as everybody rushes to replace their kit at the same time (d) prices will be inflated due to the scarcity (e) all your systems will be being replaced together, so productivity will plummet. You’ve got 12 months, migrate 10% of your systems every month & spread the pain!

No apologies for going back to the subject of mail compliance. And this time it’s an obvious and easy trap that you could fall into when configuring your SPF record.

The SPF record for Back Office It

By way of explanation, your SPF record is something you publish: it contains a list of the server(s) that you have authorised to send out your emails. When we send out an email from backofficeit.co.uk the recipient looks at the source server, checks it against our published SPF list, and gives it the go/no-go based on what it finds. In this way recipients are protected against ‘spoof’ emails (scammers pretending to be us). The trap comes when you use Microsoft365 (Office365) for your emails. Your SPF record is now spf.protection.outlook.com – which sounds fine. But every other Office365 user on the planet comes off the same server. So the SPF record check does NOT say “this is definitely from backofficeit.co.uk”. It simply says “this is from an Office365 user & Office365 is good for backofficeit.co.uk”. Which is not where you want to be at all!

The solution is to use an outbound mail relay. The one we have partnered with has many useful features. But, in this case, it has its own SPF identity. And, as part of their system, they monitor for exactly the scenario we are guarding against: therefore we use that instead of the Office365 one. And now the receiver can say with much higher confidence that this email is really from us.