Disk Encryption

The Disk Encryption device posture attribute ensures that disks are encrypted on a device.

To enable the Disk Encryption check:

1. On the Zero Trust Dashboard, navigate to My Team > Devices > Device posture.
2. Click +Add.
3. Select Disk Encryption.
4. Enter a descriptive name for the check.
5. Select your operating system.
6. Toggle on the Enable Disk Encryption switch.
7. Click Save.

Your device posture attribute is now visible on the Device posture page.

​​ How the Zero Trust client determines encryption

Operating systems determine disk encryption in various ways. The following information will allow you to understand how the client determines disk encryption status on various systems.

​​ On macOS

1. Open a terminal window.
2. Run the /usr/sbin/system_profiler SPStorageDataType command to return a list of drivers on the system and note the value of Mount Point.
3. Run the diskutil info command for a specific Mount Point and look for the value returned for FileVault. It must show Yes for the disk to be considered encrypted.

   % diskutil info /System/Volumes/Data | grep FileVault
      FileVault:                 Yes

All disks on the system must be encrypted for the posture check to pass.

​​ On Windows

1. Open a Powershell window.
2. Run the Get-BitLockerVolume command to list all volumes detected on the system.
3. Protection Status must be set to On.

   Get-BitLockerVolume

   All disks on the system must be encrypted for the posture check to pass.