Endpoint encryption: BitLocker, FileVault and best practices

Introduction

Laptops are lost or stolen every day. Without encryption, their data can be accessed in minutes. Encryption is an essential safeguard.

BitLocker on Windows

Built into Windows Pro and Enterprise. XTS-AES 128-bit encryption by default, 256-bit configurable by policy. Centrally managed through Active Directory or Intune. Recovery with a key or a Microsoft account.

FileVault on macOS

Built into macOS. XTS-AES 128-bit encryption. Managed through MDM (Jamf, Intune). The recovery key must be stored securely.

Rolling out encryption

Enable it through GPO or MDM. Store recovery keys centrally. Check that encryption is actually active. Train the support team.

Managing recovery keys

Never store them in plain text. Use Active Directory, Microsoft Entra ID or a dedicated solution. Enforce a strict process for using them.

Checking compliance

Intune or Microsoft Configuration Manager (formerly SCCM) reports show the encryption status. Raise alerts on unencrypted devices. Include it in your security KPIs.

Conclusion

Encryption is a must-have. Rolling it out is fairly simple with today’s tools. Don’t leave a single unencrypted device in your estate.