Primer on using security software

[phillipk]

I haven't enabled the hard disk encryption or the fingerprint reader... in fact, I uninstalled CSS too.

But, I'm interested in making my T60 a tad more secure. The problem is that I have very little understanding of the various software pieces that are involved. I feel like I don't even know what questions to ask.

Is there a primer somewhere or does someone care to put the whole landscape into perspective for me? I'd like to have my hard disk encrypted but I want to feel like I have control over it. Also, I'm not sure what the fingerprint reader thing does--do you just log in once and then all passwords are waived during that session?

I'd appreciate any links to concise explanations of these tools.

[Wiz]

What kind of harddisk encryption are you looking for? Also what kind of OS do you use (XP or Vista i assume)? You have some products/solutions that encrypt only part of the harddisk where you can store documents and things you want to secure. There are also products that can encrypt the whole harddisk including the OS and boot files. A full disk encryption require some sort of authentication before the OS is starting and when authenticated the OS start and everything run in the background and you won't notice the encryption/decryption process.
I always preferred the full disk encryption since i don't want additional logins and want to secure everything and don't have to think about where i store things, temp files and other data that should be secured. If you want a full disk encryption software i would recommend Utimaco Safeguard Easy. I also used drivecrypt pluspack in the past that i also found to work without any issues.

The fingerprint software give you the option to use fingerprint instead of username and password. For example use fingerprint for windows login and pre-boot if you enabled the BIOS and harddisk password. The fingerprint software also have the option to use single sign-on. So if you have the BIOS/Harddisk password enabled you have to authenticate using fingerprint before the OS boot and could be logged on to windows automatically since you already authenticated with your fingerprint before OS boot.

Utimaco SafeGuard Easy also have a plugin for the fingerprint reader that works with the T60 so you could use fingerprint for the safeguard easy pre-boot authentication. That way you could have your whole disk encrypted and only authenticate once with your fingerprint before windows boot to start your windows session. In that case you won't have any additional logins and everything is encrypted without any user intervention needed.

I use SafeGuard Easy from Utimaco for encryption and also use the fingerprint software for authentication and never had any problems with either. I do not use CSS since i didn't find it any useful. That doesn't mean it's not useful for anyone, but i didn't need it. SafeGuard Easy is not a free product though.

Unfortunately i don't have a link to explain disk encryption options and the fingerprint software in details, but maybe someone else might be able to provide you with such a link.

[phillipk]

Thanks Wiz, that gives me some more things to look into.

Some clarifications:

--I'm on XP

--I was mainly looking for using the software that was included in the system. But I'm confused with the myriad of options (setting up the security on the system the first time, css, fingerprint reader--even bios login).

--Regarding the fingerprint software... can you override it with a text password? I guess I'm concerned the fingerprint reader could break.

--what kind of performance and battery usage hit can you expect by encrypting everything?

Thanks!

[Wiz]

Maybe there is some built-in encryption in CSS that you can use....not sure since i don't use it, but i'm pretty sure it's not full disk encryption. If you upgrade to Vista anywhere in the close future maybe you could use bitlocker. I don't have any experience with bitlocker though. If you only need a place to store encrypted documents and stuff like that maybe CSS could do this.

Yes you can override with username and password so you are not stuck if the fingerprinter sensor die. You have the option to only allow administrators to override with username and password, but the default is that anyone can do this.

Since i use full disk encryption software all read/write file operations have to be decrypted/encrypted. So i assume it require a bit more CPU, but the performance compared to a not encrypted disk is so small it's not like i notice any difference. Regarding battery life i never tried to measure how long the battery last before the encryption so cannot really tell. All i know is that i didn't notice any difference, but in theory the battery should last a bit longer without encryption i guess.