Security Disk

[Rhett Espinoza]

Endpointsecurity Disk encryption profiles focus on only the settings that are relevant for a devices built-in encryption method, like FileVault or BitLocker. This focus makes it easy for security admins to manage disk encryption settings without having to navigate a host of unrelated settings.

While you can configure the same device settings by using Endpoint Protection profiles for device configuration, the device configuration profiles include other categories of settings. These other settings are unrelated to disk encryption and can complicate the task of configuring only disk encryption.

BitLocker - BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers.

Beginning on June 19, 2023, the BitLocker profile for Windows 10 and later was updated to use the settings format as found in the Settings Catalog. The new profile format includes the same settings as the older profile. With this change you can no longer create new versions of the old profiles. Your existing instances of the old profile remain available to use and edit.

With the new profile format, we no longer publish a dedicated list of settings as found in the profile. Instead, use the Learn more link in the UI while viewing information for a setting, to open BitLocker CSP in the Windows documentation, where the setting is detailed in full.

MAC OS 13 Ventura has an issue with the full disk access settings even after updating the Privacy settings in system preferences, ESET continually pops us with a warning to update the settings and disrupts other applications running, anyone else having the same issue?

So no matter how many time you update the settings on MAC system, the annoying pop up (7 times trying to compile this update), there was a small update this morning on ESET, but this issue is annoyingly persistent.

A link to contact tech. support is found at the bottom of You just need to go 2-3 steps through the wizard (typically by selecting the last option along the line Other issue or question) until you reach the support form.

I am facing the exact same issue the last couple of days, I have tried a couple of times to enable and disable the slider as you said, I have rebooted multiple times, even uninstall and install the Cybersecurity Pro that I currently have. My issue is exactly the same as the two users above, in both my personal MacBook Pro M1 and my professional Mac M1 one. The mentioned KB is not really useful for the particular case, since giving access to the full disk, doesn't seem to be the issue.

I have exactly the same problems on my MacBook Air M1 2020. Tried solution offered here with no result at all. Does anybody know latest recommendations of Apple to resolve the problem? Or they are informed only?

Please try following the above instructions again while clicking slower, allegedly it can have an effect on certain systems. Should the problem persist, open a support ticket please. The issue has already been reported to Apple.

I've been trying to get Cyber Security working on an Intel Macbook Pro for the last three days! I've followed the instructions to the letter and am still getting the VERY annoying popup every minute or so. Every time I trying re-installing it I get different options in the Full Disk Access list but I never get all three as shown in the so called "solution". It's now 12th November and this still hasn't been fixed.

The issue was reported to Apple. As far as I know, the solution described in the KB worked for our users. If there's an issue, I'd suggest contacting customer care who would check it step-by-step with you.

ESET has worked great since I chose this application in March 2022. I have had the same issue with the Ventura OS with no resolution for about a month now. Because it no longer works, I am cancelling my auto renewal and foregoing the rest of my paid subscription and moving on to another solution.

The solution as described does not work! I have tried to follow it exactly on multiple occasions and it NEVER works As I have originally stated the options to allow full disc access never seem to appear in the list so how can I disable and re-enable them?? I'll try contacting support as you mention and unless this is sorted soon I feel I'll have to cancel my three licenses and move to a different option.

I had a huge problem today with eset. I actually had the popup to grant full acess to disk but when i did that the computer start to slow down until not working at All. I was not able to do a thing on the computer even when i rebooted 10 times. So i decided to start in safe mode and remove eset.

I tried to reinstall the antivirus today and i have the exact same problem. When I have the popup to put my password to grant acess to eset everything just freeze and the computer does not respond anymore.

Custom changes to disk security metadata should not be applied to theDiskSecurity.xml file itself. The disk security metadata can becontained in multiple files. All disk security metadata do not have tobe contained only in the DiskSecurity.xml file. You can create anynumber of additional disk security metadata files. To customize disksecurity, you should create an additional file with the xmlextension in the %plesk_dir%etc\DiskSecurity directory and specifyadditional security rules in the file. This will enable you to trackchanges and manipulate sets of security metadata easily.

Disk security rule entries have the same format as hosting security rule entries.To learn about the entry attributes in more detail,refer to General Security Metadata Structure.We also recommend that you see the example provided below.

As above mentioned by other people there are BIOS extensions or EEPROM mods which can be applied to regular PCs to enable unlocking at startup for motherboards which do not support booting ATA protected devices by themselves. These are however to my knowledge not applicable to Mac and EFI.

ATA Security is different from SED. SED (self encryption drive) means the drive will scramble the data on write commands using encryption. A SED drive always encrypt the data, regardless of the ATA security settings (and/or capability). Note that a SED drive cannot store data unencrypted. Encryption benefit is that you cannot get the original data by reading the drive plates in lab. ATA Security is not an encryption function, only a lock/unlock function. The user (the BIOS) sets a password which must be sent again at each drive power on. Without the password the drive controller forbids read/write commands. The data on the disk are not affected. If the drive is SED, they are already encrypted, if not a SED they are not. ATA Security should be bypassable by reading the plate in lab with another controller.

Regarding how to activate ATA Security feature (HDD passwords) on your motherboard: I don't know the answer and I'm also looking for it (my case is an Asus board). That said, let me explain this position I got after a thorough research.

Laptop boards supports usually ATA Security as part of the power on process, asking for the HDD password (not to be confused with the power on / "BIOS" password) and passing it to the HDD which then unlock itself. Note the HDD will lock itself after usually 5 attempts with a wrong pwd. After that you need to power off the HDD (by switching off the computer...) to get 5 new chances. This is to make brute force attacks difficult.

Desktop boards do not support ATA Security, at least I've not found recent ones supporting this simple feature. This leaves me puzzled, and wondering how much BIOS manufacturers like AMI or Phoenix really care about their users, it seems they have tried to be the less innovative possible during these last 20 years. As for Apple I can't answer.

To be clear: ATA Security feature is something that comes free with last years HDD, and is totally managed by the HDD. The only effort needed by the motherboard is to request the password to the user on behalf of the HDD, pass it to the HDD, and then forget about it. This is something very secure, though very simple, and for the usual owner of a computer this is the only feature he/she needs to effectively protect his/her private life and little secrets like mail passwords in case of theft. But BIOS are still not providing the interface to this feature.

There is a hack to modify the BIOS EEPROM so that it calls an additional routine which will request the HDD pwd and pass it to the HDD. This is the link I provided above. This modification will probably not work for "EFI" versions of BIOS, but it can help towards the solution. It may not work with a specific BIOS either, and trying this solution would require that you have support for BIOS backup / restore in case things go wrong, which is likely to occur. Note that "E" in EFI means "extensible", and that writing extensions to support features is expected to be easy. This may lead to people writing open source ATA Security drivers in the future... (instead of BIOS manufacturers, which will add some modernism to this obscure matter).

It seems that it is possible to "insert" code between the power on process and the OS loading. This would be done by setting the proper MBR code. This code first asks for the HDD pwd, then if the HDD is unlocked calls the OS loader than would have been ran directly without the modification.

That said, I'm stuck there, exactly like you. Me too, I need HDD password support. but I see that desktop mobo don't support it. What a shame! this may explain why people are moving to encryption which is like use a sledge-hammer to crack a nut, encryption is to prevent to remove the platters of the drive and read them with sophisticated lab material, not using a normal HDD controller chip, said otherwise this is to prevent hitech industrial espionage. I don't see street thieves going to do that to get a couple of vacation pictures, porn videos, and hello-there mails they don't care anyway.

3a8082e126