Browse Definitions :
Definition

full-disk encryption (FDE)

What is full-disk encryption (FDE)?

Full-disk encryption (FDE) is a security method for protecting sensitive data at the hardware level by encrypting all data on a disk drive. FDE automatically encrypts data and operating systems (OSes) to prevent unauthorized access.

Disk-level encryption safeguards data from getting into the wrong hands and is important for organizations that are following data security compliance regulations such as the Health Insurance Portability and Accountability Act or the General Data Protection Regulation.

A visualization of what FDE encrypts
FDE encrypts all the data on a disk, with the exception of sometimes the master boot record.

FDE is especially useful for desktops, laptops and mobile devices that can be physically lost or stolen. Even if the device is stolen, the encrypted data will be inaccessible to the thief. Because one key is used to encrypt the entire hard drive, FDE requires network administrators to enforce a strong password policy and provide an encryption key backup process in case employees forget their password or leave the company unexpectedly.

FDE works by automatically converting data on a hard drive into a format that can't be understood by anyone who doesn't have the key to undo the conversion. Specifically, the hard drive is converted from a readable plaintext to a ciphertext that isn't readable unless it's converted back to plaintext with a key. Without the proper authentication key, even if the hard drive is removed and placed in another machine, the data remains inaccessible. The encryption process is performed using encryption software or hardware that's installed on the drive. Some systems don't encrypt the master boot record -- the code that starts the OS loading sequence -- meaning that not everything on those devices is encrypted.

FDE is often installed on computing devices at the time of manufacturing. For example, FDE is enabled through features like BitLocker, which is included in certain Microsoft Windows versions, or FileVault, which is built into the macOS. BitLocker and FileVault enable users to recover lost passwords. BitLocker stores recovery information on Active Directory, and FileVault backs up encryption keys to Apple iCloud. Microsoft also offers Device Encryption on all Windows devices that protects data by encrypting the drive.

Benefits of full-disk encryption

Full-disk encryption offers the following advantages:

  • It requires no special attention from end users after they initially unlock their computer. When data is written, it's automatically encrypted, and when it's read, it's automatically decrypted.
  • Data can't be extracted without a device password and encryption key.
  • It helps protect data at rest against cyber attacks and data leaks.
  • Temporary files are also encrypted.
  • Users are authorized before the device boots.
  • FDE is faster than manual encryption methods, which are more time-consuming and less efficient.

Drawbacks of full-disk encryption

Some disadvantages of FDE, however, include the following:

  • The encryption and decryption process can slow down data access times, particularly when virtual memory is being heavily accessed.
  • If users forget their password and lose their recovery key, the device will be inaccessible to them, and they will be locked out just like an intruder.
  • Data in transit isn't protected, so data shared between devices and through email is still vulnerable to hacking.
  • The costs involved with FDE include the encryption hardware or software, as well as the time it takes to operate a computer with FDE.

Learn more about centralized encryption methods in IT environments and how they're critical to preventing data theft.

This was last updated in October 2022

Continue Reading About full-disk encryption (FDE)

SearchNetworking
  • routing table

    A routing table is a set of rules, often viewed in table format, that's used to determine where data packets traveling over an ...

  • CIDR (Classless Inter-Domain Routing or supernetting)

    CIDR (Classless Inter-Domain Routing or supernetting) is a method of assigning IP addresses that improves the efficiency of ...

  • throughput

    Throughput is a measure of how many units of information a system can process in a given amount of time.

SearchSecurity
  • quantum key distribution (QKD)

    Quantum key distribution (QKD) is a secure communication method for exchanging encryption keys only known between shared parties.

  • Common Body of Knowledge (CBK)

    In security, the Common Body of Knowledge (CBK) is a comprehensive framework of all the relevant subjects a security professional...

  • buffer underflow

    A buffer underflow, also known as a buffer underrun or a buffer underwrite, is when the buffer -- the temporary holding space ...

SearchCIO
  • benchmark

    A benchmark is a standard or point of reference people can use to measure something else.

  • spatial computing

    Spatial computing broadly characterizes the processes and tools used to capture, process and interact with 3D data.

  • organizational goals

    Organizational goals are strategic objectives that a company's management establishes to outline expected outcomes and guide ...

SearchHRSoftware
  • talent acquisition

    Talent acquisition is the strategic process employers use to analyze their long-term talent needs in the context of business ...

  • employee retention

    Employee retention is the organizational goal of keeping productive and talented workers and reducing turnover by fostering a ...

  • hybrid work model

    A hybrid work model is a workforce structure that includes employees who work remotely and those who work on site, in a company's...

SearchCustomerExperience
  • database marketing

    Database marketing is a systematic approach to the gathering, consolidation and processing of consumer data.

  • cost per engagement (CPE)

    Cost per engagement (CPE) is an advertising pricing model in which digital marketing teams and advertisers only pay for ads when ...

  • B2C (Business2Consumer or Business-to-Consumer)

    B2C -- short for business-to-consumer -- is a retail model where products move directly from a business to the end user who has ...

Close