DataTerminology.comNEW
Also known as: FDE
A security control that encrypts all data on a storage device to protect information at rest.
DESCRIPTION
Full Disk Encryption (FDE) transparently encrypts an entire storage device, securing operating system files, applications, and user data. Access requires authentication or hardware-based keys (e.g., TPM), protecting data if the device is lost or stolen. FDE reduces administrative burden versus file-level encryption but cannot protect data once mounted and accessed by a running system. Solutions include BitLocker, FileVault, and Linux dm-crypt/LUKS. Proper key management, recovery procedures, and boot security are essential to avoid lockouts and ensure compliance.
ALTERNATIVE DEFINITIONS
NIST SP 800-111
Full disk encryption encrypts all data on the disk, including the operating system and user files, to protect information at rest.
Formal guidance from a government standards body on scope and purpose.
Microsoft Learn
BitLocker Drive Encryption is a data protection feature that integrates with the operating system to address the threats of data theft or exposure.
Vendor implementation demonstrating FDE benefits in Windows.
Apple Support
FileVault encrypts the information on your Mac and helps prevent unauthorized access to your information.
Apple’s FDE implementation for macOS devices.
RELATED TERMS
Disk Encryption BitLocker FileVault Key Management Trusted Platform Module Data at Rest AES Encryption Access Control
COMPETING TERMS
File-Level Encryption Volume Encryption
RELATIONS
- Broader: Encryption
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Infrastructure
TARGET AUDIENCE
Chief Information Security Officer Security Architect Cybersecurity Engineer IT Manager Application Administrator
EXTERNAL SOURCES
- Wikipedia - Disk encryption
- NIST - Guide on storage encryption technologies
- Microsoft Learn - BitLocker overview and deployment
- Arch Wiki - Linux dm-crypt/LUKS setup guide
TOP QUESTIONS
When should Full Disk Encryption be used?
Use FDE for laptops, desktops, and servers holding sensitive data to mitigate loss or theft risks.
Category: Requirements
What is the main risk of Full Disk Encryption?
Key loss can render data unrecoverable; inadequate recovery procedures can cause downtime.
Category: Risks
How does Full Disk Encryption differ from File-Level Encryption?
FDE encrypts entire volumes transparently, while file-level targets specific files with granular control.
Category: Alternatives
What hardware features support Full Disk Encryption?
Trusted Platform Module (TPM), secure boot, and self-encrypting drives aid secure key storage and boot integrity.
Category: Example
What are common mistakes with Full Disk Encryption deployments?
Skipping recovery key escrow, mixing incompatible boot loaders, or ignoring BIOS/UEFI security can cause lockouts.
Category: Mistakes
How is Full Disk Encryption managed in enterprises?
Centralized policies, key management, device compliance checks, and periodic recovery tests ensure reliability.
Category: Management
Does Full Disk Encryption protect data in use?
No. FDE secures data at rest; once mounted, access controls must protect data in use.
Category: Misunderstanding
What is currently a hot topic around Full Disk Encryption?
Adopting FDE with remote attestation and integrating with zero-trust endpoint security.
Category: Topic
Where should I start learning about Full Disk Encryption?
Read NIST SP 800-111 and vendor docs for BitLocker, FileVault, and dm-crypt/LUKS.
Category: Example