Meeting the InCommon Assurance profile criteria using Active Directory

["Rank, Mark" <>]

"And, if the latter is true, wouldn’t the tenant benefit from the disk encryption provided by the host?"

wouldn't this allow unencrypted tenant DC to be copied from a running host?

mark

--------------------------------------------------

Mark Rank
Project Manager - Identity & Access Mgt

UCSF Information Technology Services (ITS)
email:

phn:414-331-1476

--------------------------------------------------

---

From: [] on behalf of Michael W. Brogan []
Sent: Friday, June 07, 2013 2:40 PM
To:
Subject: [AD-Assurance] RE: BitLocker operational issues

This link has a doc from MS that describes how to install Bitlocker on a Windows 2008 Hyper-V host.

http://www.microsoft.com/en-us/download/details.aspx?id=6416

 

The link you cited below says

 

“BitLocker does not support the encryption of VHDs, but does permit storage of VHDs on a BitLocker-protected drive.”

 

and

 

“BitLocker is not supported for use within a virtual machine. Do not run BitLocker Drive Encryption within a virtual machine. You can use BitLocker in the virtual machine management operating system to protect volumes that contain configuration files, virtual hard disks, and snapshots.”

 

So, just to understand better, is it the case that you can’t install Bitlocker in the tenant OS but it can be installed on the Hyper-V host? And, if the latter is true, wouldn’t the tenant benefit from the disk encryption provided by the host?

 

--Michael

 

 

From: [mailto:] On Behalf Of Ron Thielen
Sent: Friday, June 07, 2013 11:59 AM
To:
Subject: [AD-Assurance] BitLocker operational issues

 

I raised the question about BitLocker operational issues, because something was  nagging at the back of my mind.  I asked the Windows admins and they pointed me in the right direction.

 

It turns out that there is a significant issue that may affect some institutions.  BitLocker is not supported in virtual environments by either Microsoft or VMware.  We run some of our domain controllers on VMware VMs, so this is certainly an issue for us.

http://technet.microsoft.com/en-us/library/hh831507.aspx#BKMK_VHD

and

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2036142

 

I guess we have to decide whether to move our VMs to physical hardware and lose the advantages that virtualization provides or submit an alternative means statement for RC4.

 

Ron