Enforce encrypted drives

[macvfx]

Summary

block un-encrypted drives and remount as read only or force encryption

Description

I have a corp security requirement that I’m looking to solve. External drives need to be encrypted.

Feature request: Detect external drive mount and evaluate if encrypted, optionally ask to encrypt immediately or if not mount as read only. Should work for all ejectable or removable media (aka usb thunderbolt drives, etc)

Current Santa features work to prevent ex-filtration in general by forcing usb drives to be read only.

I have a security requirement for users to only use encrypted drives which reflects the reality of back and forth home/office as well my media clients with footage transport. Of course, no external drives should be lost, but a lost encrypted drive is better than one that is not encrypted.

[pmarkowsky]

This is a solid FR and definitely interesting, though I think it'll take a lot of design and scoping.

If you're just interested in FileVault encrypted volumes that's easier to get through DiskArbitration.

Other hardware encrypted devices (think IronKey hardware) or third-party schemes (e.g. LUKS, BitLocker, Veracrypt) would be significantly more complicated. In the case of hardware this would require us to understand how to interact with the device via IOkit and know if any configuration is correct.

For other software schemes like LUKS we'd need to read the raw disk headers as it'd show up as unformatted. Specifically we'd need to scan for signatures like LUKS' LUKS\xba\xbe. So we'd need to either expose a way to make this configurable or have a predefined set of supported schemes.

[pmarkowsky]

@macvfx do you have a list of required encryption schemes?

[macvfx]

Only interested in FileVault encrypted volumes.