»FileVault
FileVault is Apple's implementation for encrypting your data on macOS and Mac hardware. It will encrypt all data on your startup disk and, once enabled, encrypt it on the fly, working seamlessly in the background. It forces all users to re-enter their password when waking from sleep or a screensaver, and non-administrator accounts require an administrator to log them in on first login to enable encryption.
Verifying FileVault encryption (MacOS)
Under System Preferences, launch Security and Privacy. Click on the FileVault tab. Status should be “FileVault is turned on”. (see example below).
How do I install FileVault?
Submit a Service Desk Request to have a support technician enable File Vault on your computer.
Pre-requisites:
- The computer must have a local Recovery Partition present on the internal hard disk (HDD) or Solid State Drive (SSD).
- The user accounts on the computer must have a "secure token," meaning they must be created by the Operating System rather than via an automated script. Chapman-deployed Macintosh computers that were imaged prior to macOS 10.13 High Sierra do not meet this criterion and will require an IS&T technician to wipe (erase) the internal drive and reinstall the Operating System from scratch. Encryption works in the background
You can continue working on your computer during the encryption phase. The time it takes FileVault to fully encrypt your files depends on the size and type of your drive and the amount of data being encrypted.
How does it work?
FileVault full-disk encryption (FileVault 2) uses XTS-AES-128 encryption with a 256-bit "key" to help prevent unauthorized access to the information on your startup disk.
When FileVault is enabled, this secure "key" is generated from information about the physical computer components, the hard drive, and other data. Once FileVault is enabled, a recovery key is generated. The recovery key is used to access the computer if you forget your password. Only authorized IS&T staff have access to this key, which is stored in a secure location.
Requirements
To enable FileVault, your computer must satisfy certain requirements:
- The computer must have a local Recovery Partition present on the internal hard disk (HDD) or Solid-State Drive (SSD).
- The user accounts on the computer must have a "secure token," meaning they must be created by the Operating System rather than via an automated script. Chapman-deployed Macintosh computers that were imaged prior to macOS 10.13 High Sierra do not meet this criterion and will require an IS&T technician to wipe (erase) the internal drive and reinstall the Operating System from scratch.
Will encryption affect my computer performance?
FileVault encryption and/or encrypted hard drive data can, in general, affect overall computer performance. Because FileVault is built into the macOS Operating System, Apple claims that any performance hit is negligible and should be unnoticeable for most users.
If my hard drive fails, can I retrieve my data?
It is always advisable to back up your data. It is recommended that you save your data to a cloud service such as Dropbox or Google Drive (not to the Desktop or Documents folder on your computer). Free Dropbox and Google Drive accounts are available by logging in to these services with your Chapman network credentials.
In addition, Chapman offers an online backup program called Code42 CrashPlan that can back up your entire computer whenever it is connected to the internet. If it is not already installed, you can install this program via the Self-Service application or by contacting the Service Desk to have Code42 CrashPlan installed.
Should your hard drive fail, recovering your data can be very costly. A backup is your best option for recovery.