There’s a brand-new, more safe and secure method to secure files in Windows 11, but it’s only an alternative for building safe applications, not a replacement for BitLocker.
Image: Ascannio/Adobe Stock Windows 10 already has 2 flavours of file encryption– BitLocker and Windows Device Encryption — and as of the 22H2 release, Windows 11 Business and Education includes Personal Data File encryption.
BitLocker and Device Encryption are effectively the exact same complete disk file encryption innovation, but there are management tools for BitLocker (which is only offered in Windows Pro, Enterprise and Education) that let admins control whether several drives on a system are secured, as well as backing up and recuperating the secrets. Gadget Encryption is included in Windows House and secures all the drives on the PC, without any choice to leave out secondary drives. The name is different since calling it BitLocker would make individuals believe they were getting the same management tools and alternatives.
Personal Data File encryption doesn’t replace either of them due to the fact that it doesn’t encrypt an entire drive; rather, it secures specific files and folders using 256-bit AES-CBC encryption keys that are secured by Windows Hi for Business, but only through applications that are built to utilize it.
Jump to:
File file encryption in Windows
You could already secure a selection of files in Windows by:
- Selecting them in File Explorer.
- Right-clicking and selecting Properties.
- Clicking the Advanced button in the Elements section of the General tab.
- Checking the ‘Encrypt contents to secure information’ checkbox.
That uses the Securing File System constructed into Windows, however it has a number of disadvantages.
Problems from securing by means of EFS
EFS dates back to Windows 2000, long before TPMs were common in PCs, so it doesn’t use hardware security to secure the encryption secrets. They’re saved in Windows, and an assailant could possibly extract them– or they could simply attempt to hack into your Windows account.
Files secured with EFS can likewise be accessed just by the user account that secured them. That’s smooth: As quickly as you visit with that user account you can access encrypted files without doing anything additional, however if you log in with a various account, you can’t open them at all.
Must-read security coverage
PDE uses Windows Hi for more safe and secure keys
BitLocker opens the encrypted drive as quickly as you boot Windows: PDE only unlocks encrypted files when the user logs in– and logs in utilizing Windows Hello.
By utilizing Windows Hello for Business, Personal Data File encryption puts the file encryption keys into safe hardware where they’re just launched when you verify either biometrically or with a PIN, which is likewise secured by hardware security and unlike a password, doesn’t stroll to other devices you utilize that account with.
That’s more secure, but also more transparent for users– although you do need to get utilized to not seeing Personal Data Encryption-protected files if you choose to check in to your account utilizing your password instead.
Turning on Personal Data File Encryption
There are some constraints for using Personal Data Encryption. The PC has to be joined to Azure AD and not be a hybrid gadget (i.e., one that’s signed up with to your company’s Active Directory site however likewise signed up with Azure AD). Remote Desktop connections aren’t supported, you can’t see Personal Data Encryption-protected files through a network share, and you can’t use a FIDO key instead of Windows Hey there for Business or automatic reboot sign-on to Windows.
To make certain the Personal Data File encryption keys aren’t inadvertently exposed, you will want to disable hibernation, crash dumps and Windows Mistake Reporting: You can do that through the exact same MDM service you utilize to allow Personal Data Encryption (whether that’s Intune or through Group Policy with a CSP).
You can likewise choose whether you want encrypted files to be readily available when Windows is locked or not. If you select level two security, encrypted files will be accessible for one minute after the Windows lock screen appears however then the decryption secrets will be disposed of. You do not have to use OneDrive for it, but you will want to make certain that you have backups in case the Personal Data File encryption keys are lost.
Unlike EFS, when you have actually allowed Personal Data File encryption, you do not encrypt files through File Explorer: In fact, there’s no interface for Personal Data Encryption at all. That’s due to the fact that it’s controlled through APIs that developers utilize in applications; the first to enable PDA is the built-in Mail app, which can encrypt both e-mail messages and accessories.
PDE is a partner to BitLocker
Again, Personal Data File encryption does not replace BitLocker: It’s developed to be used along with it for files that companies choose need the additional security.
If you have an industry application that deals with particularly sensitive details, you can utilize the PDE APIs to make certain the files can only be accessed by workers who are supposed to have access and only on managed gadgets that are Azure advertisement joined. You want that to be set by your compliance policies, rather than to offer private workers a tool for encrypting files– which could be used by harmful insiders to hide data they should not have on their gadgets and may be trying to take outdoors the company.
Unlike files that are secured by tools like Azure Information Protection or Purview Details Protection where level of sensitivity labels and encryption are implemented on files permanently, users can decrypt files secured with Personal Data File encryption by hand in File Explorer. Here’s how:
- Right-click on the file.
- Pick Residence.
- Click the Advanced button on the General tab– the exact same place you apply EFS file encryption.
- Uncheck the alternative Encrypt contents to secure information.
Keep in mind, you can’t secure the file once again the exact same method; that can only be done by an application.
If you have a lot of encrypted files, you can use the CIPHER command to decrypt one or more files in a folder. You can just do that when you have actually visited with Windows Hello for Organization and already have access. This is not a security flaw, due to the fact that if you had access, you might just copy and paste the contents of the file elsewhere anyhow.
The Personal Data Encryption name is rather confusing: It’s individual since it’s tied to the method an individual logs in with Windows Hello for Service, but it’s not something a person can pick to use and it’s not for protecting individual files. Instead, it’s another building block for making Windows a more secure method to deal with info– however only as soon as there are more applications that use it.
