Penetration testing blog

If you work with sensitive information,  you need a safe place to store it. Even if the information is temporary stored in your computer and needs to be removed sometime, you need a safe way of deleting/wiping it off your drive.

These are the three most popular options at the moment:

• TrueCrypt (http://www.truecrypt.org)
• BestCrypt (http://www.jetico.com)
• PGP Disk (http://www.pgp.com/) 

My recommendation goes for TrueCrypt - which is the only one open source from above and provides a wide set of tested algorithm implementations. I did try using BestCrypt before, but it isn’t free and I experienced twice a very uncomfortable situation where the encrypted containers got corrupted and the encryption keys were no good.

The encryption algorithms provided by TrueCrypt are:

• AES
• Serpent
• Twofish

In addition, you may ‘cascade’ two or more algorithms.

TrueCrypt and BestCrypt are multiplatform - BestCrypt provides a Linux binary which I successfully tested in the past - it is packaged in the form of several utility binaries which I believe were suid and for which some security vulnerabilities were published in the past.

I currently have my e-mail profile stored in one encrypted container and any sensitive information stored in a different container -that way I don’t have the container with all the sensitive information mounted at all times.

I would avoid using the auto-mounting features - it makes little sense to have everything stored in a secured container and having it accessible at all times.

Try them out and let me know!