topic Re: Bitlocker on USB drives for GDPR in Privacy

Bitlocker on USB drives for GDPR

AVermeer — Mon, 09 Oct 2023 08:46:30 GMT

Did anybody look into Microsoft BitLocker on a USB drive and if the encryption level of BitLocker would be sufficiently secure for GDPR?

In our stores we deal with Personal data and ship this between the stores and the office, an encrypted USB drive would be ideal for this purpose.

Arthur Vermeer.

Re: Bitlocker on USB drives for GDPR

Badfilemagic — Tue, 22 May 2018 14:33:58 GMT

Bitlocker is backed by multiple FIPS (CMVP and CAVP) validations. Windows 10 was Common Criteria validated as well, using the CAVP validations to back up its AES, XTS, RSA, and SHS implementations.

I'm not a fancy, big-city GDPR expert, but having been a CC/FIPS evaluator, it seems to me that if the cryptographic implementations are good enough for use by the US and allied national governments then they are probably good enough for GDPR.

Re: Bitlocker on USB drives for GDPR

oms — Tue, 22 May 2018 17:07:45 GMT

Dear Arthur,

since there is no whitelist of products, there are two things that could very likely be cheked during a customer or government audit or if you need to present your crypto management during contract negotiation:

Algorithms
Key Management (ideally managed by policy)

In terms of algorithms, there's nothing wrong with Bitlocker.

Key Management is completely up to you but might screw up the best encryption if not carried out properly.

Kind regards

Oliver