Protecting data stored on devices and document management platforms has become a priority for organisations of all sizes. Disk encryption tools, such as Microsoft’s BitLocker and Apple’s FileVault, play a fundamental role in data protection. They ensure that stored information remains inaccessible to unauthorised users, even if devices are lost or stolen. This article explains how BitLocker and FileVault work, their features and best practice for using them.
What are BitLocker and FileVault?
BitLocker
BitLocker is a full disk encryption feature available in the Pro, Enterprise and Education editions of Windows and in Windows Server. The Home edition offers a simplified version, device encryption, on compatible hardware. Developed by Microsoft, BitLocker protects data by encrypting entire disk volumes with advanced encryption algorithms, such as AES (Advanced Encryption Standard) with 128 or 256-bit keys. The tool can be configured to require additional authentication during start-up, such as a PIN or a startup key on a USB drive. As a result, only authorised users can access the stored data.
FileVault
FileVault is Apple’s full disk encryption solution for macOS computers. Introduced in Mac OS X 10.3 Panther and extended to full disk encryption in OS X 10.7 Lion (FileVault 2), FileVault uses XTS-AES-128 encryption with a 256-bit key to protect data stored on the startup disk. With FileVault enabled, the system automatically encrypts and decrypts all information as the user accesses it, with no noticeable impact on system performance. In addition, FileVault integrates with iCloud to manage recovery keys. This integration makes it easier to regain access to the system if the password is lost.
Importance of encryption on document management platforms
Protecting sensitive data
Stored data often includes sensitive and confidential information and, in many cases, personal data. With encryption tools such as BitLocker and FileVault, the data on a lost or stolen device remains protected and inaccessible without the correct encryption key. This protection is crucial to avoid data breaches that could cause financial, legal and reputational damage to the organisation.
Regulatory compliance
Compliance with data protection regulations, such as the General Data Protection Regulation (GDPR) in the European Union, is a central concern for organisations. These regulations require companies to adopt strict security measures to protect the personal data of customers and employees. Disk encryption with tools such as BitLocker and FileVault is often cited as one of the best practices to support compliance. It also mitigates the risk of data exposure in the event of a breach.
Protection if devices are lost
With increasing mobility and use of portable devices, the loss or theft of laptops and other devices has become a significant risk. Enabling BitLocker or FileVault on these devices adds an extra layer of protection, ensuring that stored data remains inaccessible to anyone who finds or steals the device, wherever it is.
How BitLocker and FileVault work and are configured
Configuring BitLocker
To enable BitLocker, users go to the Windows Control Panel or security settings. During activation, they can choose to encrypt the entire disk or only the used space, and select their preferred authentication method (for example, PIN, password or USB startup key). BitLocker also automatically encrypts new files and integrates with Active Directory, allowing centralised management of recovery keys in business environments.
Configuring FileVault
Users enable FileVault in System Settings, under Privacy & Security (in older versions of macOS, in System Preferences). During setup, the system asks users whether they want to use iCloud to store the recovery key. Alternatively, they can create a custom recovery key. Like BitLocker, FileVault automatically encrypts new data as it is written to the disk, with no further user action required.
Integrating BitLocker and FileVault with document management platforms
BitLocker and FileVault compatibility and integration
Both BitLocker and FileVault are compatible with most document management platforms running on Windows or macOS. Full disk encryption does not interfere with how document management systems work, so document storage, indexing and retrieval run smoothly.
Encryption key management
To ensure continued access to data, organisations should implement robust encryption key management policies. With BitLocker, recovery keys can be stored in Active Directory, while FileVault allows keys to be stored securely in iCloud. Centralised management of encryption keys is crucial so that organisations can regain access to encrypted data when needed.
Automation and access control
Integrating encryption tools with document management systems makes it possible to automate security processes and strengthen access control. Document management platforms can be configured to require encryption of all stored or transmitted documents. This configuration ensures compliance with the organisation’s security policies.
Challenges and considerations
Impact of BitLocker and FileVault on performance
BitLocker and FileVault aim to minimise the impact on system performance. However, full disk encryption can, in some cases, slightly reduce data read and write speeds. Even so, this impact is generally marginal and far outweighed by the security gain.
Data recovery
If the organisation loses or forgets the encryption key, data recovery can be complex and, in some cases, impossible. Organisations must therefore implement effective key management and backup strategies to avoid losing access to critical data.
Training users in BitLocker and FileVault
Using tools such as BitLocker and FileVault effectively requires users to be properly trained on the importance of encryption and on recommended practices for keeping data secure. Ongoing training is crucial to ensure that everyone in the organisation understands the risks and best practices associated with encryption.
What disk encryption does and does not protect
Disk encryption protects data at rest, that is, when the device is switched off or hibernating, or when the disk is removed from the computer. It is therefore very effective if laptops are lost or stolen. However, it does not protect data while the user is logged in: at that point, files are accessible to any program running with their permissions, including ransomware or other malicious software. In addition, it does not protect documents sent by email or documents stored on a cloud platform, which depend on the provider’s encryption and controls.
Disk encryption also affects GDPR compliance. If an encrypted laptop is lost and the key has not been compromised, the data breach may pose no risk to data subjects. The organisation must therefore record the incident, but may not have to notify the CNPD, the Portuguese data protection authority.
Centralised management in companies
In a business environment, recovery keys should not remain only with the user. On Windows, they can be stored in Active Directory or Microsoft Entra ID and managed through Intune. On macOS, a device management solution can store the institutional recovery key. That way, the IT team can regain access when an employee leaves or forgets their password.
Practical example: Stolen laptop
Suppose a safety technician leaves their laptop in the car and it is stolen. The disk had BitLocker with a startup PIN and the key was stored in Entra ID. After the theft, the IT team locks the user’s account and revokes their sessions on the document management platform. As a result, the laptop’s data remains inaccessible and the company records the incident, with no exposure of personal data.
Encryption checklist
- Encryption enabled on all laptops and mobile devices.
- Recovery keys stored centrally.
- PIN or password at startup on higher-risk devices.
- Automatic screen lock enabled.
- Encryption status checked regularly.
Frequently asked questions
Does disk encryption replace backups?
No. Encryption protects against unauthorised access, but not against hardware faults, accidental deletion or ransomware. Backups therefore remain indispensable.
Conclusion on BitLocker and FileVault
BitLocker and FileVault are essential tools for protecting data on devices that access document management platforms, providing a robust layer of protection against unauthorised access. By implementing these solutions, organisations can protect their critical documents from unauthorised access, support compliance with data protection regulations and minimise the risks of lost or stolen devices. However, the effectiveness of these tools depends on correct configuration, key management and ongoing user training. With a careful, informed approach, BitLocker and FileVault can provide the foundation for a robust and effective data security strategy in any organisation.
Read also: Business continuity and disaster recovery and Responding efficiently to security incidents.
For guidance on protecting devices and data, consult the National Cybersecurity Centre (CNCS).