• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

Building an encrypted system---TPM, BitLocker, etc

J

Jimmy the Greek

Gawd
Joined
Aug 20, 2002
Messages
657
I'm building a computer for a buddy who runs a small medical practice. He needs to encrypt his data to comply with HIPAA guidelines. I'm his go-to guy for anything computer-related, but feel like I'm in over my head.

He wants to store all of his data on an SSD. From what I've read, he shouldn't use TrueCrypt because of issues with wear-leveling SSDs. Should he be looking at BitLocker or would he run into the same problem?

Alternatively, we've been looking into SSDs with hardware encryption--specifically the Samsung 840. Would this be better (security and/or performance-wise) than software encryption? Would we want to use BitLocker in addition to the SSD's hardware encryption?

Thanks for any insight that you can provide! :)
 
Truecrypt and bitlocker work basically the same, not sure what you mean by wearleveling issues. You loose trim support. Trim support should not be required, you will loose some ssd performance if you start doing lots of writes at once, but not an issue in this case.

You could use an ssd that supported encryption, but the issue you will find, is locating something that supports using that encryption, normally only laptop bios's have the harddrive password option. If the bios on that machine has it, that would be the easy option.
 
Well, that is good for performance atleast, bad for protection, not that hipaa requires good protection.

Using trim lets people know exactly what parts of the disk to not worry about attacking, cause it contains blank data.
 
Jimmy the Greek said:
He needs to encrypt his data to comply with HIPAA guidelines.
Click to expand...

Before you get too involved in this make sure this statement is true.

My reading of HIPAA is that access to the data only needs to be controlled.

If data is being stored off site, encryption is a reasonable solution for the off site data.

But for data on site, it appears to be sufficient to control access to the computers.
 
Personally for stuff like this I rather have a true raid and spining drive. The drive that holds the info has to be encrypted not the actual system. Bitlocker can be a disaster waiting to happen.
I just usually automount Truecypt volume as a drive store files in there.
Advantage is that truecrypt volumes are portable not so much with Bitlocker.
You also don't need to deal with backing up certificates.

Better yet just get a NAS like QNAP create an encrypted volume and mount the volume via iscsi you got a nice central repository.
 
The issue with truecrypt, is none will validate that it is secure, everyone takes a step away from it, the developers will not respond to you, due to deniability.

The issue with HIPAA, is yes, encryption is not required, but if the data is lost, the computer stolen, then you must report the data lost to the public. If it's stored with an approved encryption system with proper controls, then you don't have to disclose the loss of the data.
 
GeorgeHR said:
My reading of HIPAA is that access to the data only needs to be controlled.
Click to expand...

HIPAA not only deals with controlling data but recommended levels of access according to the media you are using.
 
patrickdk said:
The issue with HIPAA, is yes, encryption is not required, but if the data is lost, the computer stolen, then you must report the data lost to the public. If it's stored with an approved encryption system with proper controls, then you don't have to disclose the loss of the data.
Click to expand...
Bingo!
 
Check out SSD's that play nice with BitLocker:

Most modern SSDs come with some form of hardware encryption. On these drives with hardware encryption, it’s usually permanently turned on - all data written to the NAND is typically stored in encrypted form. This stems from the fact that all writes to NAND had to be scrambled to begin with (writing long repeated strings of data to NAND can cause problems for data retention). The earliest implementations weren’t sophisticated enough to be considered real encryption, but these days it’s not uncommon to see hardware AES-128/256 support.

The bad news has been that relying on OS driven filesystem encryption always meant the use of software encryption on top of your drive’s native encryption. This was particularly a problem on SandForce based drives, where full disk encryption basically ruined any of the performance advantages of the controller’s native compression/de-dupe (you can’t further reduce encrypted data). Other drives suffered (just not as much) due to the added overhead from having to leverage the host CPU to encrypt all data before writing it to disk. There’s also the fact that if you encrypt your entire drive (free space included), the drive ends up looking like a completely full drive - which has performance implications of its own. This was the world that existed with BitLocker under Windows 7 and FileVault under OS X.

With Windows 8, the story is a bit different.



I hadn’t heard of Microsoft’s eDrive standard for Windows 8 until I started working on the Crucial M500 review. It turns out that if you have a storage device (e.g. SSD, eMMC, etc...) that meets the right encryption standards, Windows 8’s BitLocker will leverage the device’s hardware encryption engine, bypassing the software based encryption altogether. The result should be better performance and lower power consumption.
Click to expand...
 
Jimmy the Greek said:
I'm building a computer for a buddy who runs a small medical practice. He needs to encrypt his data to comply with HIPAA guidelines. I'm his go-to guy for anything computer-related, but feel like I'm in over my head.

Thanks for any insight that you can provide! :)
Click to expand...

I mean no offense to you, but your friend needs to hire a professional or consultant knowledgeable in this field and get it done by the books. I work in a large retail drug company and deal with HIPA and PHI, and it's a lot of red tape that you typically don't want to do alone. Beyond the actual hardware, you need to do training, make SOP's, ensure that everyone is following the rules, etc... It costs a lot of money but I suggest your friend looks for a turnkey product that encompasses all aspects, not just the hardware data is stored on.
 
patrickdk said:
The issue with HIPAA, is yes, encryption is not required, but if the data is lost, the computer stolen, then you must report the data lost to the public. If it's stored with an approved encryption system with proper controls, then you don't have to disclose the loss of the data.
Click to expand...
So simply making the decision that if "data is lost to the public" a discloure will be made is sufficient.

I am not saying that encryption is unnecessary but ...

Data protection for a small practice is different from data protection for a large hosptial complex that allows internet access.
 
HIPAA makes no distiction between small practice and large hospital, and it shouldn't.

Now, this is only for data at rest, not data in motion, and defently doesn't cover hacking/virus/....

But encrypting a disk, is only about data at rest. The other issues, while relative, where outside the scope of the question asked.
 
You must log in or register to reply here.
Back
Top