Question 63

Full Disk Encryption (FDE) should be used to ensure an attacker is unable to read the contents of a mobile device’s drive if the device is lost.

Full Disk Encryption (FDE) is a security measure that encrypts all the data on a mobile device’s drive, making it inaccessible without the proper authentication. This ensures that even if the device is lost or stolen, unauthorized users cannot access the sensitive information stored on it.

A) TPM

Trusted Platform Module (TPM) is a hardware-based security feature that provides secure storage for cryptographic keys and helps with device authentication. However, while TPM can enhance security, it does not encrypt the entire drive by itself. Therefore, it is not sufficient to prevent access to data if the device is lost.

B) ECC

Elliptic Curve Cryptography (ECC) is an encryption method used to secure communications and data. While it is effective for securing data in transit, it does not directly relate to encrypting the contents of a mobile device’s drive. Thus, it does not fulfill the requirement of ensuring that data remains unreadable if the device is lost.

C) FDE

Full Disk Encryption (FDE) encrypts all data on the device’s storage, ensuring that without the correct password or key, the data remains secure and unreadable. This is the primary method for protecting data on a mobile device in case of loss, making it the correct answer for this question.

D) HSM

A Hardware Security Module (HSM) is used to manage digital keys and perform cryptographic operations securely. While it enhances security for key management and cryptographic processes, it does not encrypt the data on a mobile device’s drive. Thus, it does not meet the requirement of preventing unauthorized access to the device’s contents if lost.

Conclusion

Full Disk Encryption (FDE) is the most effective method for ensuring that the contents of a mobile device's drive remain secure and unreadable in the event of loss or theft. Other options, such as TPM, ECC, and HSM, provide various security benefits but do not directly address the need for comprehensive data encryption on the device itself. Therefore, FDE is the definitive choice for this scenario.