In search of a laptop that plays it safe

I travel rather often, but I am not a BlackBerry person. When on the road, I need the same tools and computing power that I use at the office, and only a laptop can provide that. Those handhelds just won’t cut it for me.

[ MarioApicella’s column is now a blog! Get the latest storage news from the Storage Adviser blog. ]

Do I have encryption on my laptop? I do not, but I should — and you should too. Call me paranoid, but in my view, no laptop should travel unless there is some reliable data encryption mechanism in place.

Why is it then that my laptop and many others, of which we read in the news when they are lost or stolen, still carry data in clear? I can’t answer for other people, but for me, it’s because until now I haven’t found an encryption system that works to my satisfaction.

My idea of a safe laptop is one that easily enforces full disk encryption and offers a safe two-stage authentication system with a key-ring gizmo to insert, plus a code to type. Or perhaps a fingerprint reader, which is a head-turner and doesn’t add anything to my key ring.

My ideal encryption system would also allow centralized management of encryption keys, a must-have for corporate deployment.

Am I asking for the moon? Not quite. According to what I learned last week during a briefing with ASI Computer Technology, Seagate, and Wave Systems, the ASI C8015 laptop should make my encryption dream come true and will become available as soon as April. I didn’t get any firm pricing information during that briefing (too many variables), but from what I’m told, a secure laptop such as this one should not cost an arm and a leg. Good to know.

The C8015 will mount the Momentus 5400 FDE.2, a Full Disk Encryption hard drive that Seagate has been trumpeting since 2005. As a quick recap, the Momentus FDE mounts a chip that does automatic AES (Advanced Encryption Standard) encryption of its data content, and its firmware stops the laptop at boot time until the user provides proper authentication credentials. Distinct access levels allow different capabilities; typically, users are able to unlock the drive only, while administrators can reassign the drive to a different person or add more users. The Momentus FDE will be available in 80GB, 120GB, and 160GB capacities, all with a SATA interface.

Obviously, encryption makes the disk content reasonably safe from disclosure, but another perhaps less-intuitive benefit is that erasing all the data content becomes as easy and quick as destroying the encryption key. It’s a snap compared to alternatives, such as the long and tedious overwriting of each track on the drive, often repeated several times to be on the safe side.

The third ingredient is Wave Systems’ Embassy Trust Suite, a package of applications that brings the security hardware mounted on the laptop under a common management umbrella. Embassy Trust Suite has more features than I have space to list, including the ability to manage multiple users and the use of administrative passwords to access the drive.

However, what captures more of my attention and is also one of the latest additions to the suite is Trusted Drive Manager, an application that enables local and remote management of the FDE drive and simplifies routine administrative tasks such as recovering a forgotten password.

“From a [central] server, an IT administrator can do all the setup administration and control of the drive remotely without ever having to physically touch the laptop,” explains Lark Allen, executive vice president of corporate development for Wave Systems.

As for the laptop shell that will surround all this, here’s one of the models that ASI plans to sell. Think of it as a Centrino Duo notebook with a 15.4-inch screen, a fingerprint reader, and TPM (Trusted Platform Module).

I like the rounded approach to a more secure computing platform, but many people will probably ask if simply deploying Windows Vista BitLocker on a TPM machine is an easier alternative. From what I have seen so far, BitLocker’s approach to disk encryption is far from simple, which could scare people away.

I wouldn’t lock any door if that meant having to carry around a 20-pound key. The deciding factor in the next battle on laptop encryption — or more general data encryption — will be easy management.

Join me on The Storage Network with questions or comments.