Since my last post was about Apple's Disk Utility, I thought I'd share another one. How to secure your client's data on your laptop.
I'm currently working with a client where I have access to some sensitive school records. Recently, someone asked me, "So what happens if you lose your laptop?" I have that covered... All my client's data is stored on encrypted disk images, and each client has their own.
Have you ever downloaded a 'disk image' to your mac, double-clicked on it, and it mounts just like you stuck a CD in your computer? Well, what if you could make those disk images yourself, and what if you could keep them encrypted, so only you could open them? Sounds like a good idea, but I bet you're thinking it will be painful. Not so! Apple's Disk Utility to the rescue. Lets make an encrypted disk image of our own right now, in less time than it takes you to read this post.
In your applications/utilities directory, double-click on the Disk Utility application. Notice the buttons across the top - one of them says "New Image". Click it.
You'll get a window that looks like this:
Notice the selections in that window... I'm saving it in a 'clients' directory, I'm making a new disk the same size as a DVD-R, I'm formatting it as a Mac OS Extended (Journaled) volume, I have 128-bit encryption on, partitioned as a normal dvd, and setting it up as a sparse disk image. I'll explain those choices below... just follow along for now.
Set your window up with the same settings and click 'create'. It will ask you for a password. This is the password for the disk you are creating - you will probably want to un-check the 'remember this password in my keychain' option; if you leave that checked, then someone stealing your laptop won't have to type the password to access the volume.
In less than a minute, you'll have a new disk sitting on your desktop, ready for new files to be copied onto it. Copy your client's files into that disk. You can eject the disk when you're done, and get it back at any time by double-clicking on the actual disk image you created. You'll have to type the password to open the drive up, but once its open, you won't have to type it until you put it away.
Pretty cool, right? If you are on a Mac, there is no reason*not to protect your client's data. For those envious windows users reading along, there are several open source and commercial tools that can do basically the same thing.
So lets look at the settings we chose to set this up:
'Save As:' and 'Where:' are your typical options when saving files. This is the name and location of the disk image you are creating.
'Name:' is the name of the new disk that will appear on the desktop when you open the disk image.
'Size:' is going to be the *maximum* size of this drive. You can change this later (with some effort), but choose wisely to start. You can type your own value here, but I like creating images the same size as standard media - If a client ever requests it, I can burn a copy of my working environment right to a CD or DVD and hand it off to them.
'Format:' is the same options from my last post. You can't go wrong choosing 'Mac OS Exended (Journaled)' when working on a mac. People who have certain apps or strong opinions might want one of the other options.
'Encryption:' - choose either 128 or 256-bit. 128 bit should be fine unless you work for the NSA.
'Partitions:' - I typically leave this on the setting that is auto-selected when I choose the default 'size:' above.
'Image Format:' should be set to 'sparse disk image'. This means that, while you have set the maximum disk size above, the actual file will be smaller than that, taking up only the amount of space as the files on it. If you leave it on the default 'read/write disk image' thats ok too, but realize that your file will be the same size as the maximum size you set above, even when it is completely empty.
I have about a dozen client volumes in my clients directory. Each one is secure, my client's work is partitioned from each other, I keep my home and documents directories neat and clean, and it doesn't add any real encryption hassle to working with my client's data. The next time your client asks you, "What do you do to protect the data I give you?", Disk Utility FTW!
Of course, there is more to a complete security policy, but this is a better start than most people are using...
Comments