Such a threat requires that data protection be in place
to avoid the system being compromised, even if physical access is somehow obtained.
BitLocker, introduced in Windows Vista Enterprise and Ultimate editions, is a security
feature that can protect data from physical access. It protects operating system files
and any other volume you designate as being protected by BitLocker. It works in conjunction
with the Trusted Platform Model (TPM) chip on the system to make sure that all
components that load during the operating system??™s boot process are not compromised.
This protection remains in place even if the operating system is shut off. TPMs contain
special registers called Platform Configuration Registers (PCRs) that store the hash value
of the various startup components, including the BIOS, Master Boot Record (MBR), boot
sector, and boot manager code.
Requirements
A few requirements are necessary prior to your enabling the BitLocker Drive Encryption
feature. You can install this feature at any time, but to take advantage of its full functionality,
your system must meet the following requirements:
?–? A system with a version 1.2 TPM chip
?– A Trusted Computing Group (TCG) compatible BIOS
?– At least two partitions on your system: one system partition set to active and
another in which you will load your operating system (the boot partition)
?–? A BIOS that supports the USB mass storage device class for booting from a USB
flash drive
337 Chapter 10: Windows DNS, BitLocker Drive Encryption, and Itanium Support
BitLocker Architecture
BitLocker performs full-volume encryption, which makes it mostly transparent to the system,
except during startup when a few additional steps might be needed for authentication
before the volume can be unlocked.
Pages:
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378