BitLocker 'alone is not a complete security solution' Microsoft

Microsoft dismissed recently-disclosed threats to its BitLocker disk-encryption technology as "relatively low risk," noting that attackers must not only have physical access to a targeted PC, but must manipulate the machine two separate times. "This sort of targeted attack poses a relatively low risk to folks who use BitLocker in the real world," said Paul […]

Microsoft dismissed recently-disclosed threats to its BitLocker disk-encryption technology as "relatively low risk," noting that attackers must not only have physical access to a targeted PC, but must manipulate the machine two separate times. "This sort of targeted attack poses a relatively low risk to folks who use BitLocker in the real world," said Paul Cooke, a senior director at Microsoft who looks after the operating system's security features. “We’ve published best practice guidance The Data Encryption Toolkit for Mobile PCs, discussing balance of security, usability and detail most secure method to use BitLocker in hibernate mode and a TPM+PIN configuration. Using this method, a machine that’s powered off or hibernated will protect users from ability to extract a physical memory image of computer.” “Even with great enhancements made in Windows 7 such as BitLocker To Go, it still remains that BitLocker alone isn’t a complete security solution. IT professionals and users must be diligent when protecting IT resources and best protection against these sorts of targeted attacks requires more than just technology: it requires end user education and physical security also play important roles.”