In this lesson,
we will learn about host-based encryption.
Host-based encryption is encryption of data managed
and controlled by the local operating system.
Both Windows and Linux-based operating systems
employ a type of host-based encryption.
In Windows, file and volume level host-based encryption
is offered by BitLocker.
In Linux, the Linux Unified Key Setup, or LUKS,
is used to encrypt disk partitions and files.
Let's learn more about host-based encryption.
Host-based encryption is used for securing data at rest,
which means protecting the contents of a storage device
when the operating system is not running.
This approach is essential
for preventing unauthorized access to sensitive data,
especially if someone gains physical access to the device.
In Windows, one of the most commonly used tools
for local drive encryption is BitLocker.
BitLocker is built into Microsoft Windows
and uses the Advanced Encryption Standard, or AES,
to encrypt the entire disk at one time.
BitLocker often relies on a Trusted Platform odule, or TPM,
which is a secure hardware component
that helps manage encryption keys securely
within the device.
This combination makes BitLocker a good solution
for protecting data on Windows systems,
ensuring that even if a computer is stolen
or accessed without permission,
the data remains inaccessible
without the correct credentials.
In Linux, the equivalent tool for full disk encryption
is Cryptsetup,
which is commonly used with the Linux Unified Key Setup,
or LUKS.
Cryptsetup provides a similar level of protection
as BitLocker by using AES encryption
to secure the entire drive.
The implementation involves setting up LUKS,
which acts as a layer that manages encryption keys
and ensures data is encrypted
before being written to the disk and decrypted when read.
Like BitLocker, Cryptsetup helps protect data at rest
making it unreadable without the correct passphrase or key.
This is particularly useful in environments
where Linux is used for servers, desktops,
or portable devices,
providing a flexible, yet powerful way to secure data.
For Mac users, FileVault is the equivalent tool,
offering full disk encryption directly integrated
into the Mac operating system.
FileVault uses the same AES encryption standard
to secure data on Apple devices,
ensuring that sensitive information is protected
when the computer is shutdown or left unattended.
Now let's do a quick demonstration.
In this demonstration,
we will be detailing how to conduct full disk encryption
on a Linux machine with Cryptsetup and LUKS.
For this demonstration,
Cryptsetup and LUKS are already installed and configured
on this Kali Linux virtual machine.
Additionally, a disk called /dev/sdb
has been created for encryption.
First, let's confirm the disk we want to encrypt
by using the lsblk command
to list all connected storage devices.
We can see that the disk SDB exists.
That's the disk we will encrypt.
Second, before encrypting,
we need to make sure that the SDB disk is unmounted.
Let's do this with the following command,
sudo umount /dev/sdb.
All right, there we go.
It is not mounted.
Third, just to be safe,
let's wipe the disk with random data.
We'll do this with the following command,
sudo dd input file equals /dev/urandom
then output file /dev/sdb bs for block size,
and we'll choose one megabit of data at a time.
And finally, we'll use the status progress
to let us view the progress of this command
as it's occurring.
There we go.
We can see the status happening right now.
This could take some time
depending upon the size of the disk or drive.
It's done.
Fourth, let's initialize LUKS on the SDB drive
to set up encryption headers.
We'll do this with the following command,
sudo cryptsetup luksFormat and then /dev/sdb.
Since we'll be overriding this data irrecoverably,
then we'll choose to type YES in capital letters
to go ahead and complete this command.
Next, we'll have to enter a secure passphrase
that will be used to lock and unlock the disk.
I'm just going to use password.
This might take a second.
And there we go.
Fifth, we'll need to open the encrypted disk
and create a mapped device called encrypted disk.
We'll do this with the following command,
sudo cryptsetup open /dev/sdb and encrypted_disk.
As we mentioned, we're going to need that passphrase again
to unlock this disk.
And it's done.
Sixth, now that the disk is mapped,
we can create a file system.
Here, we'll use an EXT4 file system
with the following command,
sudo mkfs.ext4 /dev/mapper and encrypted_disk.
All right, that has been completed.
Seventh, we'll mount the encrypted disk
to a directory called /mnt, or mount,
using the following command,
sudo mount /dev/mapper/encrypted_disk and /mnt.
Okay, that's done.
Eighth, let's confirm the setup
by listing the mounted file systems
to check if the encrypted disk is in fact mounted.
We'll do this with the following command,
df -h /mnt.
And there it is.
Our file system the encrypted disk is mapped
and available and ready for use.
Ninth, for extra protection,
we could even unmount and close the encrypted disk,
taking it out of service,
but keeping it encrypted and protected.
We would do this with the following two commands,
sudo umount for unmount and /mnt.
Then we will close the encrypted disk
with sudo cryptsetup close encrypted_disk.
There we go.
We have now successfully set up full disk encryption
on the SDB disk using Cryptsetup and LUKS.
To access the encrypted partition in the future,
we would use the cryptsetup open command
with our passphrase to unlock it.
So right now, our data is secure and protected
even if this drive is lost or stolen.
So remember, host-based encryption
is a method used to protect data at rest.
In this case, data at rest is data stored on a device
when the operating system is not running.
This type of encryption is managed and controlled
by the local operating system
to prevent unauthorized access to sensitive information,
especially if the device is physically compromised.
In Windows, BitLocker provides full disk encryption
utilizing the advanced encryption standard
and often relying on a trusted platform module, or TPM,
to securely manage encryption keys.
In Linux, Cryptsetup with Linux Unified Key Setup, or LUKS,
offers similar protection,
encrypting entire disk partitions with AES
to keep data secure.
For macOS, FileVault is the go-to tool,
offering built-in full disk encryption
to safeguard data on Apple devices
when they are powered off or unattended.