{"id":43816,"date":"2020-01-20T15:00:00","date_gmt":"2020-01-20T22:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=43816"},"modified":"2020-01-20T09:47:50","modified_gmt":"2020-01-20T16:47:50","slug":"policies-bitlocker-filevault","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/policies-bitlocker-filevault","title":{"rendered":"Understanding Policies: BitLocker and FileVault 2"},"content":{"rendered":"\n

By implementing Policies<\/a>, JumpCloud\u00ae<\/sup> admins automate much of their system security management across their Windows\u00ae<\/sup>, Mac\u00ae<\/sup>, and Linux\u00ae<\/sup> fleets. Two specific Policies, BitLocker and FileVault 2, are key for enforcing full disk encryption (FDE) at scale across an organization\u2019s Windows and Mac systems.<\/p>\n\n\n\n

What are the BitLocker and FileVault 2 Policies?<\/h2>\n\n\n\n

The BitLocker (Windows) and FileVault 2 (Mac) Policies enable full disk encryption for their respective operating systems. More on full disk encryption in just a bit.<\/p>\n\n\n\n

Both policies leverage native settings accessed via the JumpCloud system agent<\/a> to enable FDE on a system. Once enabled, the BitLocker and FileVault 2 Policies also collect the associated recovery key (a necessary backup for FDE) and store it in escrow<\/a> for safe keeping.<\/p>\n\n\n\n

Why Use These Policies?<\/h2>\n\n\n\n

FDE is a practice that encrypts a system\u2019s hard drive while at rest. That way, in the unfortunate event that a system is stolen or otherwise physically compromised, the data stored on its hard drive is rendered inaccessible to anyone who doesn\u2019t have the unique recovery key or the user\u2019s password. In this manner, FDE is one of the most powerful ways to defend a system\u2019s data if the hard drive is compromised.<\/p>\n\n\n\n

Unfortunately, there are many examples of physical theft of a laptop or other workstation that have led to a data breach, especially among healthcare organizations<\/a>. As such, many compliance regulations<\/a> require some sort of disk encryption for certification.<\/p>\n\n\n\n

Many IT organizations, however, have found it difficult to enforce FDE across both Windows and Mac<\/a> system fleets automatically at scale without leveraging several solutions to do so. Beyond that, very few FDE solutions on the market<\/a> feature recovery key escrow, which is crucial to retrieving data on an encrypted drive should the end user forget their password or get locked out.<\/p>\n\n\n\n

By leveraging the BitLocker and FileVault 2 Policies from JumpCloud, organizations can apply FDE en masse with just a couple clicks. JumpCloud also stores individual recovery keys so IT organizations can still unlock encrypted drives if a hard drive is removed or an end user forgets their password and can\u2019t unlock their computer.<\/p>\n\n\n\n

How to Use the FDE Policies<\/h2>\n\n\n\n
\n