Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Have You Implemented EFS?

At a series of Microsoft security summits for IT pros, I asked the question, "How many of you have implemented EFS?" Very few hands were raised. I told them they were liars because EFS is implemented by default. Any user can encrypt files without the benefit of administrative implementation, instruction, or management.

Therein lies a very large problem: Without training, ordinary users can live with a false sense of security, and IT pros can find themselves with data recovery problems and privacy issues.

If users do not realize access to their password allows transparent access to their encrypted files, they may use weak passwords, write their passwords down in plain view, or share passwords with coworkers and friends.

If users don't understand the necessity of backing up their private key, they may lose access to encrypted files if their profile becomes corrupt or if their system is rebuilt.

If IT pros ignore EFS while their users adopt it, IT pros may be left with critical but unrecoverable company data, find that unauthorized administrators have accidental access to sensitive data, and end up spending troubleshooting, training, maintenance, and implementation time needed for other projects fighting EFS issues.

Without doubt, important data has been lost and needless hours spent all for the want of a sound EFS policy. I cannot emphasize strongly enough that your policy toward EFS should be to disable it until you can implement a sound, practical, and recoverable EFS strategy. This chapter will provide you with the basics; Chapter 12, "PKI Basics," and Chapter 13, "Implementing a Secure PKI," provide information that can be used to develop such practices.