Full Disk Encryption

🔑 Key Takeaway: Full-disk encryption must be enabled on endpoints that store work data so lost or stolen devices do not expose plaintext at rest.

Modern operating systems ship FDE capabilities, sometimes on by default. Teams still need to confirm status, algorithms, and recovery key custody.

Full disk encryption protects all data stored on a device in the event that it's stolen or lost. Today, all major Operating Systems for workstations, servers and mobile phones have full disk encryption capabilities built in, and sometimes enabled by default. Check which full disk encryption is built into your operating system, and enable it if not enabled by default.

Best practices

1. Ensure that full disk encryption uses strong industry-standard algorithms.
2. Enable full disk encryption by default on all devices, including laptops, desktops, and mobile devices.
3. Implement secure boot to ensure that only trusted software can be loaded during the boot process.

Further Reading

• Encryption overview: framework map and shared concepts
• NIST SP 800-175B: guideline for using cryptographic standards in the federal government (useful baseline references)
• OWASP Cryptographic Storage Cheat Sheet