Win 4

Reply needed 1

Encrypting File System (EFS) allows a user or administrator to secure files or folders stored on a local NTFS partition by using an encryption mechanism. It is the strongest protection that Windows provides to help users keep their information secure at rest. Like any other encryption technology, EFS protects data from being accessed by unauthorized users, whether they are inside or outside of the organization. For example, if a cybercriminal exfiltrated the unencrypted data stored on hard disk then that person could easily read that data. However, if the information is encrypted with EFS, the stolen data would be rendered useless. It’s important to keep in mind, that EFS does not protect data when it is sent across a network. A VPN or some other application based security methods such as SSL, TLS or SSH must be used to secure the communication channel between a client and a server.

When a user encrypts a file, a File Encryption Key (FEK) is generated. This is a symmetric key and is used for both encryption and decryption. It’s stored along with the file and is also encrypted with a public/private key algorithm (RSA).  The reason why two different algorithms are used is the speed of encryption. Asymmetric algorithms, also known as public-key encryption, typically involve exponential operations and are not lightweight in terms of performance. Symmetric algorithms are much faster which makes them suitable for encrypting of large amounts of data.

EFS file sharing can be enabled in an encrypted file’s advanced properties with one caveat that the other person’s EFS certificate is added to the file before they are allowed to access it.  To add the EFS certificate to the shared file:

1. Right-click the chosen file and click Properties.

2. On the General tab click Advanced.

3. In the Advanced Attributes dialog box, click Details.

4. In the dialog box that appears, click Add.

5. Click the certificate, and then click OK in each of the four open dialog boxes.

References

NTFS: EFS — Encrypting File System. (n.d.). Retrieved July 04, 2016, from http://ntfs.com/internals-encrypted-files.htm

How to Share Files Using Encrypting File System. (2001, November 01). Retrieved July 04, 2016, from https://technet.microsoft.com/en-us/library/bb457007.aspx

Thurrott, Paul & Rivera, Rafael. (2012). Windows 8 secrets: do what you never thought possible with windows 8 and rt. [Books24x7 version] Available from http://common.books24x7.com.ezproxy.umuc.edu/toc.aspx?bookid=49805.

Reply needed 2

EFS or Encrypted File System uses public key encryption along with an encrypted symmetric key. The symmetric key is the FEK or file encryption key, which is used to encrypt the file. After the file is encrypted, the FEK is then encrypted using public key encryption which uses an asymmetric key from the user's certificate (Microsoft, 2016). Basically the file is encrypted and the FEK is then encrypted and stored with the file. The user's private key is used to decrypt the FEK, which is in turn used to decrypt the file.

The main benefit of EFS is to encrypt data for users that share the same computer (Microsoft, 2005). Users that login with a different user account on the same computer will not be able to see other users encrypted data since the keys are associated with that user account. Even if the attacker takes the hard drive or gets administrative access to the computer, they will need the decryption key to get the data.

One downside to EFS is that the local Administrator or Domain Administrator is assigned the default recovery agent account. This means that if someone gains access to the Administrator account, then they may be able to decrypt the data (Microsoft, 2016). Multiple users can be granted access to an EFS-encrypted file by going to the properties of the file and adding each additional user: Properties > Advanced > Defaults > Add. The encrypted file contains a copy of each user's FEK (Muller, 2008).

Microsoft. (2016). How EFS Works. Retrieved February 26, 2016, from https://technet.microsoft.com/en-us/library/cc962103.aspx

Microsoft. (2005, November 03). Using Encrypting File System. Retrieved February 26, 2016, from https://technet.microsoft.com/en-us/library/bb457116.aspx

Muller, R. (2008). How IT Works: Encrypting File System. Retrieved February 26, 2016, from https://technet.microsoft.com/en-us/magazine/2006.05.howitworks.aspx

Reply needed 3

EFS or Encrypted File System uses public key encryption along with an encrypted symmetric key. The symmetric key is the FEK or file encryption key, which is used to encrypt the file. After the file is encrypted, the FEK is then encrypted using public key encryption which uses an asymmetric key from the user's certificate (Microsoft, 2016). Basically the file is encrypted and the FEK is then encrypted and stored with the file. The user's private key is used to decrypt the FEK, which is in turn used to decrypt the file.

The main benefit of EFS is to encrypt data for users that share the same computer (Microsoft, 2005). Users that login with a different user account on the same computer will not be able to see other users encrypted data since the keys are associated with that user account. Even if the attacker takes the hard drive or gets administrative access to the computer, they will need the decryption key to get the data.

One downside to EFS is that the local Administrator or Domain Administrator is assigned the default recovery agent account. This means that if someone gains access to the Administrator account, then they may be able to decrypt the data (Microsoft, 2016). Multiple users can be granted access to an EFS-encrypted file by going to the properties of the file and adding each additional user: Properties > Advanced > Defaults > Add. The encrypted file contains a copy of each user's FEK (Muller, 2008).

Microsoft. (2016). How EFS Works. Retrieved February 26, 2016, from https://technet.microsoft.com/en-us/library/cc962103.aspx

Microsoft. (2005, November 03). Using Encrypting File System. Retrieved February 26, 2016, from https://technet.microsoft.com/en-us/library/bb457116.aspx

Muller, R. (2008). How IT Works: Encrypting File System. Retrieved February 26, 2016, from https://technet.microsoft.com/en-us/magazine/2006.05.howitworks.aspx