Home › Resources › BitLocker

Executive Summary

BitLocker is the full-disk encryption feature built into supported editions of Microsoft Windows. It protects the data on a drive so that a lost or stolen device does not expose its contents. On most modern PCs it works with a Trusted Platform Module to bind encryption to the device and unlock the disk only when the system boots in a trusted state.

What It Is

BitLocker is Windows disk encryption that scrambles the contents of a drive and only makes them readable when the correct key is supplied. It typically uses the Trusted Platform Module, a secure chip that stores the encryption key and releases it only when the boot process is unchanged, so the disk unlocks automatically for the legitimate user but stays locked if the drive is removed or the boot chain is tampered with. Organizations can require an additional startup PIN or a USB startup key for higher assurance, and a recovery key exists as a backup way to unlock the drive. BitLocker To Go extends the same protection to removable drives.

Why It Matters

Laptops and portable drives are lost and stolen constantly, and without encryption anyone who has the physical device can read its files by moving the drive to another machine. Full-disk encryption turns a lost laptop from a reportable data breach into a lost piece of hardware. Many regulations and contractual obligations expect encryption of data at rest on mobile devices, so BitLocker is often a compliance requirement as well as a practical safeguard. For professionals, deploying and managing disk encryption is a routine endpoint security task.

How It Works

BitLocker encrypts the drive with a key that is itself protected by one or more unlock methods. In the common configuration the Trusted Platform Module measures the boot components and releases the key only if they match a trusted state, so the disk decrypts transparently when Windows starts normally. If the drive is moved to another computer, the boot state changes, or someone tampers with the startup process, the TPM withholds the key and the system falls back to requiring the recovery key. Administrators can strengthen this by adding a startup PIN so the user must supply something they know. The recovery key is a long numeric backup credential that should be stored, or escrowed, in a central directory or management service so it is available when a device needs it and is not left on the device itself.

Architecture Diagram

Visual Workflow

Common Attacks

• Theft of a laptop or drive to read data offline when encryption is absent
• Removing a drive and reading it in another machine without encryption
• Attempts to capture keys from memory on a running or sleeping device
• Social engineering to obtain a recovery key from a help desk
• Exploiting weak or default configurations that skip a startup secret

Common Mistakes

• Not escrowing recovery keys, leaving devices unrecoverable when needed
• Assuming encryption is on without verifying status across the fleet
• Leaving devices in sleep rather than requiring re-authentication, widening exposure
• Relying on TPM only where policy warrants an added startup PIN
• Storing recovery keys insecurely or on the device itself

Best Practices

• Require full-disk encryption on all portable Windows devices by policy
• Escrow every recovery key to a secure central location automatically
• Consider a startup PIN in addition to the TPM for higher-risk devices
• Verify encryption and recovery-key status through management reporting
• Encrypt removable drives with BitLocker To Go where they carry data
• Protect help-desk recovery-key release with identity verification
• Combine encryption with strong sign-in and screen-lock policies

Quick Checklist

• All portable Windows devices encrypted with BitLocker
• Recovery keys escrowed centrally and verified
• Startup PIN required where policy calls for it
• Encryption status monitored through management reporting
• Removable drives encrypted with BitLocker To Go where needed
• Help-desk recovery process gated by identity checks
• Strong sign-in and screen-lock policies in place alongside encryption

Recommended Tools

Industry Standards

Career Relevance

BitLocker deployment and key management are routine for endpoint security engineers, IT security administrators, and desktop engineering teams, and they appear in SOC and incident work when devices are lost. Security engineers and GRC auditors verify encryption of data at rest against policy and regulation, part of the audience AI-Governance-Jobs.com serves.

Interview Questions

• How does BitLocker use the TPM, and what happens if the drive is moved to another machine?
• Why is escrowing recovery keys essential, and where would you store them?
• When would you add a startup PIN on top of the TPM?
• How would you verify that an entire Windows fleet is actually encrypted?
• What does full-disk encryption protect against, and what does it not protect against?

Related Certifications

Further Reading

• Microsoft BitLocker Documentation
• NIST SP 800-111: Storage Encryption
• CIS Microsoft Windows Benchmarks

FAQ