Security Beat: Safeguard Your Sensitive Documents

I get this one a lot.  Security.  More and more of us have portable computers now.  What if my computer gets stolen?  How can I protect myself.  What is this FileVault thing that Apple offers?  Should I use it?

These are complex questions without simple answers.  The fact is that it depends on what you’re doing, what sort of data you have on your computer, etc.  I’m not a big fan of FileVault, because I’ve seen it fail as often as I’ve seen it work.  I’ve conferred with other consultants in my field, who feel comfortable recommending FileVault to their clients.  Well, I don’t.  (For those who do not know what FileVault is or what it can do for you – or to you, Click HERE to find out about it.  Scroll down to the end of this article for some recommendations should you decide to use it.)

First off, you most definitely need to have automatic login disabled.  Most laptop thieves are more interested in getting a nice new laptop for themselves, or selling yours after they’ve relieved you of it than they are in stealing your data.  If they turn on your computer, and can’t login because you’ve protected yourself with a decent password, they will often simply erase your hard drive, reinstall the operating system (thusly destroying your data) and sell or use your computer.   Any of you who have come to me after forgetting your login password (!! You know who you are…) know that breaking into a password protected Mac is not impossible for those of us with software tools.  Usually, however, thieves are lazy.

There is the danger, however, that your laptop thief is enterprising, and hopes to profit from valuable data on your computer.  There is stuff on there you do not want falling into the wrong hands.  Like, for example, that Word document you have with all of your internet passwords on it, including the logins to your bank accounts.  Or the file containing your credit card numbers.  Yeah, that’s what I’m talking about.

I’m going to show you how to create an encrypted Disk Image, inside of which you can store sensitive documents, images, etc.
I have one of these myself in my Documents Folder.  It’s called “Safe” and it contains scans of my passport, driver’s license, Social Security card, tax documents, etc.  If someone steals my computer, OR my backup drive, they might get to my other data but they can not get inside of this encrypted Disk Image.   Period.

Ready?  Here’s what to do.

Open up Disk Utility, which lives in Applications>Utlilities.

• Click New Image up on Disk Utility’s toolbar.

• Now we have to name the Disk Image File.  I’m going to call this one “LockBox.”

• Next we select a location to save it.  I’ve selected Desktop.

• Now we have to name the Volume, which resides inside the Disk Image (scroll down for an explanation of this).  I’m going to name the Volume “Personal.”

• Next we decide how large to make this Volume.  I’m going to stay with 100MB on this one, because I only intend to put documents into it.  You can make these Disk Images as large as you like, depending on what sorts of files you might want to put inside of them.  I’ve made 20GB Disk Images before.  The larger you want it, the longer it will take to create.

• Format: Mac OS Extended (Journaled) is fine here.

• Encryption: I use 128-bit AES encryption.  This is almost impossible to crack, and would require the computing power of the NSA to do.  If you’re extra worried, you can select 256-bit, but it’s WAY overkill.

• Leave the Partition option alone, Single Partition is good.

• Image Format: read/write.

Here’s a screenshot of how your Save As window should look:

Click Create.

Okay, Disk Utility is now creating your Disk Image, you can see it show up on the Desktop, but we’re not done.  A window will pop up, and this is where you select your password for your Disk Image.

NOTE:
1.  Do not use the same password as your login password.  Make this password unique.

2.  Do not forget or lose this password.  If you forget this password, even you will be unable to recover your data later.

3.  Notice that the “Remember password in my keychain” box is selected by default.  Be sure to deselect this option.  If you fail to do this, your password will be remembered by your Mac’s keychain, and all a thief will need do is double-click on your LockBox file, and it will open without the need for the password.  Not very secure.  Un-check that box.

Now click “OK.”

Your Disk Image is created, and the Volume named “Personal” will mount on your Desktop.  The Volume named “Personal” acts like a CD or an external hard drive, except that instead of existing in the world as a physical object, it lives inside of the Disk Image (.dmg) file, waiting for you to invoke it.

Now that the Volume named “Personal” is mounted on the Desktop, you can drag documents, photos, mp3s, whatever you like into it.  These files will be copied into the Volume, and once this happens, you can delete the files from their various homes on your computer.

Drag the Disk Image (in this example, called LockBox.dmg) to wherever you want to store it.  Mine is stored in my Documents folder.

Once you’ve moved all of your files into the Volume, you can drag it toward the trash.  Notice that as soon as you grab hold of the Volume, the trash icon transforms into an EJECT icon.  Yes, you’re actually “Ejecting” the Volume, just as you would a CD, DVD, or external Hard Drive.

Do this now.

Okay, now let’s go to wherever you have stored your new Disk Image file, locate it, double-click on it.  You will be prompted to enter your password (you haven’t forgotten it already, have you…).  Put your password in correctly, and your Volume will mount.

If you’re using Time Machine, your encrypted Disk Image will be backed up with the rest of your data, which is good.

That’s it.  Think about the different uses for an encrypted Disk Image.  As I mentioned earlier, I have one with all of my vital statistics documents in it, I have another with all of my web purchase receipts stored in it.  I think I might eventually get really motivated and scan every document in my file cabinet, and store them in an encrypted Disk Image.  That time hasn’t come yet, but it’s been pressing on my mind.

Hope this helps!  If you’ve got any further questions, feel free to leave a COMMENT below, and I’ll respond publicly so that others can benefit from the dialog.  If you have a private concern, email me: chris@foleypod.com.

———————————

Some notes on FileVault.

I normally do not recommend FileVault.  FileVault is great for people who
1.  Spend more time on tour than at home
2.  Can ensure that their backups run regularly without fail
3.  Can run regular maintenance tools while traveling.  This involves traveling with gear: Backup drive, Drive Genius software, OSX restore disks, etc.
4.  Understands that technology is fallible!
5.  Performs a full-backup of everything before leaving home, and leaves that backup drive at home.

Learn about FileVault HERE.
Read FileVault horror stories HERE.

Email, call or email with further questions.