BitLocker: How to secure sensitive business data

The very idea of a notebook containing sensitive business data, such as valuable customer data from a CRM system, being stolen is a source of fear and terror for many users. Windows 8 offers BitLocker encryption for hard disks so that you can take your notebook on the road without worrying about sensitive data. This encrypts the data on the hard disk and protects it from prying eyes in the event of theft.

What BitLocker can do

Of course, anyone who manages sensitive customer data should first purchase professional and secure CMS software (here you can find an overview of the best CRM providers). But it is just as important to protect your hardware and all your business data. This is exactly what BitLocker does.

BitLocker drive encryption has been available since Windows Vista. In Windows 8, it is available in the Enterprise and Pro editions. Encryption is carried out using the AES standard with a key length of 128 or 256 bits. BitLocker always checks at system startup whether the PC hardware is unchanged and thus also protects against the hard disk simply being installed in another computer and read out.

Using the recovery function, you can still recover the data with the correct password if the PC fails and the hard disk has to be removed. For comprehensive protection, you can also force the entry of a PIN or the use of a USB stick to boot from the BitLocker hard disk (or partition).

How to activate and configure BitLocker

Sensitive business data that is managed using CRM software, for example, is protected in just a few steps:

First, go to the Control Panel and navigate to "System and Security/BitLocker Drive Encryption". Now click on "Activate BitLocker" for the desired drive. The wizard will then guide you through the setup step by step. Depending on whether the device has a TPM chip or not, setting up BitLocker will be different.

If a TPM component (Trusted Platform Module) is found, it must first be activated according to the manufacturer's instructions after a restart. It is very important to ensure that all external media is disconnected from the PC. BitLocker encryption can then be set up. Encrypting the drive may then take some time. However, the PC can be used as usual in the meantime.

If no TPM chip is available, the drive can be encrypted directly in the first step using a password. Alternatively, a SmartCard with PIN code can also be used. During setup, you will also be asked to save the recovery key. You can either do this conveniently online via your Microsoft account or save the key as a file. As a third alternative, you can also print out the key.

Once BitLocker encryption has been activated, it can always be adjusted via the Control Panel under "System and Security/BitLocker Drive Encryption". BitLocker can also be deactivated here.

Article photo: MJP-Photographs 2007