Tham khảo tài liệu 'windows server 2008 inside out- p11', công nghệ thông tin, quản trị mạng phục vụ nhu cầu học tập, nghiên cứu và làm việc hiệu quả | Working with Trusted Platforms. Managing TPM. Introducing BitLocker Drive Encryption 467 469 477 Deploying BitLocker Drive Encryption Setting Up and Managing BitLocker Drive Encryption. 478 481 Many of the security features built into the Windows operating system are designed to protect a computer from attacks by individuals accessing the computer over the network or from the Internet. But what about when individuals have direct physical access to a computer When someone has direct physical access to a computer many of Windows security safeguards don t apply. For example if someone can boot a computer even if it is to another operating system they ve installed he or she could gain access to any data stored on the computer perhaps even your organization s most sensitive data. To protect a computer from individuals who have direct access to a computer Windows Vista and Windows Server 2008 include the Trusted Platform Module Services architecture and BitLocker Drive Encryption. Together these features help protect a computer from many types of attacks by individuals who have direct access to a computer. Working with Trusted Platforms Windows Vista and Windows Server 2008 include the Encrypting File System EFS for encrypting files and folders. Using EFS users can protect sensitive data so that it can only be accessed using their public key certificate. Encryption certificates are stored as part of the data in a user s profile. As long as users have access to their profiles and the encryption keys they contain they can access their encrypted files. Although EFS offers excellent protection for your data it doesn t safeguard the computer from attack by someone who has direct physical access. In a situation where a user loses a computer a computer has been stolen or the attacker is logging on to a computer EFS might not protect the data because the attacker might be able to gain access to the computer before it boots. He could then access the computer from another .
