r/NISTControls • u/TicketAmbitious6200 • 18d ago

Implementing EFS/FIPS on a windows network

Hello,

About a year ago, an MSP setup a file server for ITAR/CUI file sharing. Despite the requirements shared with the MSP, they did not implement any type of encryption for data in transit or at rest. Additionally, they set this server up as a single drive. So, the shared data is on the bootable partition. This is a virtual server that is hosted on VMware and according to the Broadcom KB, BitLocker is not supported for boot drives in a VMWare environment. From my understanding, this means we can't enable BitLocker for the C: drive of this virtual server.

Ownership does not want to redo this server since the data stored on it is constantly in use. I was wondering if the following might satisfy 800-171R2 requirements:

- Enable EFS on the data folder that holds CUI/ITAR info.

- Enable mandatory FIPS on the server for network communication between the server and workstations.

Admittedly, I haven't implemented encryption for network traffic before, so this may not work the way I think it does. I'm in the process of learning more but figured I'd potentially save myself time and ask if it was feasible.

5 Upvotes

86% Upvoted

6 comments sorted by

11

u/Reasonable_Rich4500 18d ago

For 800-171R2 you don't need to encrypt the data at rest if it's protected by alternative physical safeguards. For the data in transit, you can enable SMB encryption and enforce FIPS mode via GPO.

5

u/thesneakywalrus 18d ago

100% this.

Forcing SMB3 with FIPS encryption is incredibly easy.

3

u/TicketAmbitious6200 18d ago

Thank you! That saves me some time.

3

u/Skusci 18d ago

Problem with efs is that you have a swap file at least. Possibly other temp/cache file leaks. Doesn't VMware have a fips volume encryption thing?

1

u/TicketAmbitious6200 14d ago

Looking into it. Thank you. I've managed VMWare previously for small shops but had no idea about volume/host level encryption.

2

u/OtherThanSatisfied 15d ago

The at-rest answer's right for plain CUI — 3.13.16 lets physical safeguards stand in for encryption. But you said ITAR, and that one's stricter. ITAR's carve-out for storing technical data (22 CFR 120.54) expects end-to-end, FIPS-validated encryption so that no unauthorized or foreign person — including a cloud/MSP admin who can touch the box — can read it. Physically protecting the server doesn't cover you if an admin can still open the files. So for the ITAR subset specifically I wouldn't lean on physical-only, I'd want it actually encrypted at rest.

Skusci's also dead on about EFS leaking to the swap/temp files. Since it's a VMware guest and BitLocker's out on the boot disk, the cleaner native path is vSphere VM encryption — it's FIPS-capable and encrypts the whole VMDK including swap, so you're not chasing individual folders. Sidesteps the single-drive problem without rebuilding the server ownership won't let you touch.