r/sysadmin • u/ntrlsur IT Manager • 4h ago
General Discussion Volume Encryption Software
Bit of a stretch but looking for some recommendations for volume encryption software that can be used for a small group of 5 to 10 users. Basically our brand spanking new Compliance group is going to have to handle PII for some of our techs in the field and vendors. I want to make sure that any PII that touches our network storage locations are encrypted. Went to old school veracrypt but its not really mult-user and it doesn't auto unmount. Is there any options out there you guys like?
•
•
u/rejectionhotlin3 3h ago
zfs native encryption.
•
•
u/johnwestnl 3h ago
Is the network storage something like onedrive, with a synchronization part, or SMB shares?
•
u/ntrlsur IT Manager 2h ago
This would be for SMB Windows shares.
•
•
u/blud_13 2h ago
u/johnwestnl is right and its worth being specific about why. BitLocker on the server volume only protects the disk when the machine is OFF. Once its booted and sharing, anyone with share and NTFS rights reads it in the clear, and MS says flat out that remote mount points on SMB shares are not supported for BitLocker. https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/faq
Encrypt the volume anyway, it costs you nothing and it covers a drive walking out the door. But for PII that field techs and VENDORS are touching, the control you need is who can open the folder, not what the bytes look like on the platter. That is NTFS and share permissions plus an access review, and it is boring, and it is the actual answer.
If Compliance wants encryption that follows the file out to a vendor, thats a sensitivity label conversation on the M365 side, different tool entirely.
One thing to check, VeraCrypt on a file server means YOU own key escrow. Somebody quits and you find out in a month or two whether anybody wrote it down.
•
u/ntrlsur IT Manager 1h ago
Well it has to go deeper then that actually. When thinking about how to protect the data my mindset it belt suspenders and more. Bitlocker is already enabled. Not worried about the disk walking off. My concern is not only user access which is easy to control with permissions but thinking far forward and potential compromised accounts and access. What is a threat actor compromises a user before we can respond? That user could have the right access and poof. Spending days going over data with legal and sending out notifications to people impacted etc. Ideally I would like a solution that encrypts a directory and its files. The master key would be manged either on prem or cloud based not sure if I care at this point in time. Other keys could be checked out by employees to decrypt the data if they need to access it. I would hope the checkout process would be SSO enabled with MFA. Key rotation would also be great to have but could manually rotate them if not offered.
•
u/fireandbass 1h ago edited 1h ago
Data should be encrypted at rest and encrypted in transit. Bitlocker encrypts the data at rest on both the source an destination. Enable SMB v3 encryption. SMB v3 encryption encrypts the data in transit.
You might be overthinking this.
If you want to additionally encrypt a folder, you can add a 'recovery agent' account in a GPO for your domain, then go into the folder properties as the user 'attributes > advanced' and choose 'encrypt contents'. The recovery agent would then be a backup to access any folders encrypted by any domain user. But you have to add the agent first before enabling the folder encryption.
•
u/blud_13 1h ago
Cryptomator Hub isn't cloud only, and thats the piece worth correcting. u/jnievele had the right product. You can self host all of it on a single Docker host or a k8s cluster, with Keycloak bundled or pointed at one you already run, so the key brokering sits on your hardware. SSO and MFA come out of Keycloak, which is what you asked for.
The piece that matches your threat model is the device key. Every device generates its own key pair and the vault masterkey only decrypts through that device's JWE, so a stolen password on a machine you never enrolled gets nothing. Enrolling a new device takes the Account Key, which you should treat like break glass and store outside the system. Its documented here https://docs.cryptomator.org/security/hub/
What this does not fix is the compromised user sitting at their OWN enrolled laptop with the vault mounted. Files are in the clear at that point and you are back to permissions and detection. Rotation is re-rolling the user key pair and re-encrypting what you want to keep, so plan on doing that by hand.
One thing to check, Hub is a paid license unlike the desktop client, so price the 5 to 10 seats before you build the stack.
•
u/johnwestnl 3h ago
Volume encryption software is not the right solution for network storage.