For example, there is more than just one encryption method you can use. With -EncryptionMethod, you can specify one of 4 methods to encrypt your drive, AES128, AES258, XtsAes128, or XtsAes256.

Enable-BitLocker -MountPoint "c:" -EncryptionMethod Aes256 -RecoveryKeyPath "E:\Recovery\" -RecoveryKeyProtector

You can also enable BitLocker with a specified AD user account so that when a user accesses the encrypted drive, they will get prompted for credentials for that account.

Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes128 -AdAccountOrGroup "Western\SarahJones" -AdAccountOrGroupProtector

Have you ever wondered what is wrong with my BitLocker drive that has a warning sign?

Get-BitLockerVolume tells you everything.

Aha…it’s because the Protection is off. Let’s Resume-BitLocker it.

What’s my encrypted system drive’s recovery password?

(Get-bitlockervolume -MountPoint "C:").KeyProtector

Can I save it to Active Directory so I don’t have to keep the file? Sure thing.

Backup-BitLockerKeyProtector -MountPoint "C" -KeyProtectorId (Get-bitlockervolume -MountPoint "C:").KeyProtector[1].KeyProtectorId

But whoops, it says “Group Policy does not permit the storage of recovery information to Active Directory”. What to do?

There are two policies you will need to change here. Open the policy assigned to the GPO, and go to the following location.

Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption

And enable the policy called Store BitLocker Recovery information in Active Directory Domain Services

Then go to one of the following sub-locations of BitLocker Drive Encryption, whichever one you would be using.

• Fixed Data Drives
• Operating System Drives
• Removable Data Drives

And enable the policy called Choose how BitLocker-protected operating system drives can be recovered.

If it still doesn’t work, you may have to install the BitLocker management tools on the AD server.

Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools

With GPO configured to save the BitLocker keys to AD, we can enable BitLocker and save the keys directly to AD in PowerShell.

Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector | Out-Null
Enable-BitLocker -MountPoint C: -TpmProtector -EncryptionMethod Aes256 -SkipHardwareTest

Life is about to get a whole lot harder for websites without HTTPS – Troy Hunt

It’s taken us a while, but finally we’re getting to a “secure by default” web!

What Every Developer Must Know about HTTPS – Troy Hunt

So that’s what I’ve created and I’m enormously happy to now see it up live on Pluralsight. If you’ve not tried them before, you can get into it for less than $1 a day and gain immediate access to thousands of courses, including some very good content on HTTPS

I wanna go fast: HTTPS’ massive speed advantage – Troy Hunt

This is all simply a test of “what’s the fastest we can go over HTTP versus what’s the fastest we can go over HTTPS”. I don’t want fair, I want fast. If you wanna go fast, serve content over HTTPS using HTTP/2.

A Journey to Get an EV – Troy Hunt

It’s a 14-page long journey Troy took to get a green EV for Have I been Pwned. Does it worth the effort?

This whole EV cert thing is hard to measure in terms of value; I have no idea how many more people will put their email address into HIBP or how much more media or good will or donations it will get. No idea at all.

But what I do know is that it adds transparency and legitimacy to a realm that as I mentioned earlier, tends to be inhabited by a lot of shady characters and that’s gotta count for something.

On the Value of EV Certs, Commercial CAs, Phishing and Let’s Encrypt – Troy Hunt

The bottom line is that as of today, the effectiveness of EV certs is entirely dependent on people recognising what they mean and actually adapting their behaviour accordingly. It’s hard to argue with that.

Are EV certificates worth the paper they’re written on? – Scott Helme

I’m not opposed to the idea or the value of EV certificates but right now they just seem like a nice revenue stream for CAs. The technical and user issues outlined above need to be addressed before EV can have real value. The amount of information and mis-information surrounding them really doesn’t help and there’s also some pretty wild claims from CAs about what EV can do.

Debunking the fallacy that paid certificates are better than free ones – Scott Helme

When you look at a certificate the only thing we really care about is whether or not the browser is going to accept it, we care if the certificate is valid. To be valid there are various technical criteria outlined above regarding it’s format, the fields it contains and the data inside them that must be met. There’s also criteria around how it was issued that the CA must adhere to and all of this plays a part in the ultimate determination made by the browser about the certificate itself. Whether or not anyone handed over some hard-earned cash to purchase the certificate simply does not matter one bit. The browser doesn’t even have knowledge of whether that happened and there’d be no way and no need for it to do so. There’s absolutely no difference between a free certificate and one that you had to shell out some cash for.

Do SSL warranties protect you? – Scott Helme

All in all, the idea of a warranty on a certificate just seems like some marketing fluff for the CA to add to their sales page. The chances of this being useful are close to non-existent and there doesn’t appear to be a viable way for a consumer to prove the certificate was the cause anyway.

Certificate Transparency, an introduction – Scott Helme

Certificate Transparency is an open framework for monitoring and auditing the certificates issued by Certificate Authorities in near real-time. By requiring a CA to log all certificates they generate, site owners can quickly identify mis-issued certificates and it becomes much easier to detect a rogue CA.

HSTS – The missing link in Transport Layer Security – Scott Helme

HSTS allows for a more effective implementation of TLS by ensuring all communication takes place over a secure transport layer on the client side. Most notably HSTS mitigates variants of man in the middle (MiTM) attacks where TLS can be stripped out of communications with a server, leaving a user vulnerable to further risk.

Understanding HTTP Strict Transport Security and preloading it into the browser – Troy Hunt

As HTTPS becomes more ubiquitous across the web, this feature should really start to gain traction and hopefully initiatives like Let’s Encrypt will help expedite that (note also that this is now being reported as “Arriving September 2015”). It’s good times for those wanting to further protect their web assets and not so good for those wanting to intercept other people’s traffic.

The 6-Step “Happy Path” to HTTPS – Troy Hunt

1. Get a free cert
2. Add a 301 “Permanent Redirect”
3. Add HSTS
4. Change Insecure Scheme References
5. Add the upgrade-insecure-recquests CSP
6. Monitor CSP reports

5 ways to implement HTTPS in an insufficient manner – Troy Hunt

it doesn’t matter how many pages you’re loading securely or how many padlock icons or vendor certifications you drop on the site, once you start sending auth cookies around insecurely, you’re toast. It’s completely pointless to secure those personal details in transit but then let the auth cookie which can load them back up float around in the clear. That is a very insufficient use of HTTPS indeed.

5 ways to tackle an insufficient HTTPS implementation – Troy Hunt

The simpe way of doing this is for HTTPS everywhere

SSL is not about encryption – Troy Hunt

It’s about assurance. It’s about establishing a degree of trust in a site’s legitimacy that’s sufficient for you to confidently transmit and receive data with the knowledge that it’s reaching its intended destination without being intercepted or manipulated in the process.

Cheat Sheets – Scott Helme

• CSP Cheat Sheet
• HSTS Cheat Sheet
• HPKP Cheat Sheet
• HTTPS Cheat Sheet
• Performance Cheat Sheet

Here is why your static website needs HTTPS – Troy Hunt

So that’s precisely what I’ve done – intercepted my own traffic passed over an insecure connection and put together a string of demos in a 24-minute video explaining why HTTPS is necessary on a static website. Here’s the video and there’s references and code samples for all the demos used immediately after that:

Some other useful resources

Does My Site Need HTTPS

Is TLS Fast Yet

HTTP vs HTTPS Test

Have you been pwned – Troy Hunt

Report Uri – Scott Helme

Security Headers – Scott Helme – check your headers for things like HSTS and HPKP

The infamous SSL Labs – to check your config

Concerning about the performance impact that might be? Check out the VM Encryption Performance Whitepaper by VMware to find out.

In short, according to the Executive Summary in the whitepaper, We show that while VM encryption can lead to bottlenecks in I/O throughput and latency for ultra-high-performance devices (like a high-end NVMedrive) that can support hundreds of thousands of IOPS, for most regular types of storage, like enterprise class SSD or VMware vSAN, the impact on I/O performance is very minimal.