Our new Compliance group will be handling personally identifiable information for field technicians and vendors. We use Windows file servers with SMB shares, and BitLocker is already enabled on the storage volumes. I'm looking for additional protection beyond normal share and NTFS permissions, especially in case an otherwise authorized user account is compromised before access can be revoked.
Ideally, I'd like to protect an entire directory and its files with encryption managed by an on-premises or cloud-based key system. Users would authenticate with SSO and MFA, check out keys when they need access, and ideally support key rotation. VeraCrypt was considered, but it doesn't work well for multiple users and doesn't automatically unmount. What products or approaches are appropriate for this kind of setup?
3 Answers
A volume-encryption product probably isn’t the right layer for this. BitLocker is still worthwhile because it protects the disks while the server is powered off or storage is removed, but once the server is running and the SMB share is available, authorized users can read the files normally. The main controls there are share permissions, NTFS permissions, least privilege, access reviews, auditing, and quickly disabling compromised accounts.
Native storage encryption, such as encrypted filesystems or server-volume encryption, generally protects data at rest on the server. It does not provide end-to-end protection for files being opened over SMB, nor does it stop a user or attacker who has valid read permissions. Also be careful with VeraCrypt on a file server: you would be responsible for key escrow, recovery, availability, and dealing with an encrypted volume that has to be mounted for shared access.
That’s the distinction I was missing. Server-side encryption would still be useful as a backup layer, but it won’t solve the compromised-account scenario by itself.
If the requirement is encryption that follows individual files to vendors or other systems, look at information-rights management or sensitivity-label tools rather than filesystem encryption. Those can enforce identity-based access, MFA, expiration, revocation, and restrictions after a file leaves the server. The exact features depend on the identity and productivity platform you already use.
That covers the basic access problem, but I’m also concerned about a compromised account that already has legitimate permissions. I’m looking for protection that remains useful even after an attacker gets those credentials.