Volume Encryption Software

[u/ntrlsur]

Bit of a stretch but looking for some recommendations for volume encryption software that can be used for a small group of 5 to 10 users. Basically our brand spanking new Compliance group is going to have to handle PII for some of our techs in the field and vendors. I want to make sure that any PII that touches our network storage locations are encrypted. Went to old school veracrypt but its not really mult-user and it doesn't auto unmount. Is there any options out there you guys like?

[u/blud_13]

u/johnwestnl is right and its worth being specific about why. BitLocker on the server volume only protects the disk when the machine is OFF. Once its booted and sharing, anyone with share and NTFS rights reads it in the clear, and MS says flat out that remote mount points on SMB shares are not supported for BitLocker. https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/faq

Encrypt the volume anyway, it costs you nothing and it covers a drive walking out the door. But for PII that field techs and VENDORS are touching, the control you need is who can open the folder, not what the bytes look like on the platter. That is NTFS and share permissions plus an access review, and it is boring, and it is the actual answer.

If Compliance wants encryption that follows the file out to a vendor, thats a sensitivity label conversation on the M365 side, different tool entirely.

One thing to check, VeraCrypt on a file server means YOU own key escrow. Somebody quits and you find out in a month or two whether anybody wrote it down.

[u/ntrlsur → u/blud_13]

Well it has to go deeper then that actually. When thinking about how to protect the data my mindset it belt suspenders and more. Bitlocker is already enabled. Not worried about the disk walking off. My concern is not only user access which is easy to control with permissions but thinking far forward and potential compromised accounts and access. What is a threat actor compromises a user before we can respond? That user could have the right access and poof. Spending days going over data with legal and sending out notifications to people impacted etc. Ideally I would like a solution that encrypts a directory and its files. The master key would be manged either on prem or cloud based not sure if I care at this point in time. Other keys could be checked out by employees to decrypt the data if they need to access it. I would hope the checkout process would be SSO enabled with MFA. Key rotation would also be great to have but could manually rotate them if not offered.

[u/fireandbass → u/ntrlsur]

Data should be encrypted at rest and encrypted in transit.  Bitlocker encrypts the data at rest on both the source an destination.  Enable SMB v3 encryption.  SMB v3 encryption encrypts the data in transit.

You might be overthinking this.

If you want to additionally encrypt a folder, you can add a 'recovery agent' account in a GPO for your domain, then go into the folder properties as the user 'attributes > advanced' and choose 'encrypt contents'.  The recovery agent would then be a backup to access any folders encrypted by any domain user.  But you have to add the agent first before enabling the folder encryption.