Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analysis: Enterprise Key Management: Page 13 of 16

Bad Crypto: Uses whatever sounds good in the marketing materials--the more familiar the name, the better--regardless of applicability.

Going The All-microsoft Route

With many technology problems, if you implement only related applications from a single vendor, the number of headaches you're likely to run into drastically decreases. Although this isn't always feasible for political, technical or other reasons, going whole hog with Microsoft can meet your enterprise encryption needs.

The cornerstone behind Microsoft's encryption architecture is Active Directory--not surprising since AD is the foundation for nearly all Microsoft enterprise applications. Using Group Policy, all endpoints can have IPsec profiles remotely mandated, resulting in end-to-end encryption throughout all domain clients and servers, or only where needed, as specified.

To address the threat of lost laptops containing sensitive information, Microsoft developed BitLocker Drive Encryption--though it's misnamed as it's really for volume encryption. New for Vista (Enterprise and Ultimate) and Longhorn, BitLocker can operate with or without an extra boot password or hardware token, though it does require a hardware token if operating without a TPM (Trusted Platform Module) chip. Older TPM 1.1 chips will not work, and TPM 1.2 has been shipping in laptops for only about a year.

EFS (Encrypting File System) has been built into NTFS since Windows 2000, but it operates only above and in conjunction with the existing NTFS file system and cannot be used to encrypt entire drives, or otherwise protect system integrity during boot-up. BitLocker, on the other hand, was specifically developed with the idea of using encryption as an easy and efficient (in terms of user interaction) method of authenticating the system as it boots.