Data security (EFS, RMS, DPAPI, PKI) and other security rants
Customer asked me recently:
"Are there any considerations to deploy both RMS/IRM and EFS? As far as I understand, RMS/IRM and EFS can work together."
My response was this:
No problems of which I'm aware - I've been running the two interdependently for months now, without any known or visible issues.
My approach has been:
- encrypt the %USERPROFILE%\Local Settings\Application Data\Microsoft\DRM folder (i.e. the location for the RAC, CLC and all ULs), so that only the person with the user's credentials (password or smart card) would be able to unlock the files that grant any access to the content.
- Don't worry whether the RM-protected files are EFS encrypted or not. Since the RM-enabled applications only see the file once EFS has decrypted it, there's no possibility of EFS and RMS "colliding" in memory, and since RMS doesn't operate at the filesystem level, they can't collide on disk.
Personally, all my documents are encrypted, whether they're RM-protected or not, so there's no *harm* in applying both to the documents. The benefit is in leveraging DPAPI (to protect each file from anyone who doesn't know the user's logon credentials) and the RM protections (to control the authorized use of the data once it's been unlocked by the user's logon credentials via DPAPI & EFS).
I could go into more of the technical detail, and I intend to discuss things like "what if I only wanted to choose one of the two?" and "when is it better to use one or the other?". For now though, I just wanted to make sure that people have some idea that these two technologies won't *conflict* - at least at a technical level, and that in their current form they can complement each other.
[Plus I didn't want to bog this down so early in the life of a nascent blog...]
[EDIT: spelling error and expanded the path to the DRM folder]
Anonymous comments are disabled