Protecting Data When You Can't Restrict Physical Access to Machines

I work for a midsized bank that's expanding into store-front branches at grocery stores. I've always been able to limit physical access to our telecommunications room to the bank manager and our IT department. However, storefront branches will share a telecommunications room with other businesses, and I'm concerned about the vulnerability of financial and customer information traversing our network. What are our Windows encryption options?

You can use an IP Security Policy to help secure your company's confidential data. On the servers at the datacenter that your branch computers communicate with, you can create an IP Security Policy that requires Encapsulating Security Payload (ESP) mode IPsec connections from computers within the subnets of your store-front branches. Then you need to enable the Client (Respond Only) IP Security Policy on all computers at the new store-front branches. You can automate the process of enabling the policy and ensure that new computers deployed at the branches receive the policy by assigning the Client (Respond Only) policy in a Group Policy Object (GPO) linked to the site corresponding to that branch. With this approach, even employees who use laptops and visit the branch site will pick up the policy.

If you want to avoid using site-linked GPOs—or if you don't have Active Directory (AD) site objects defined for each branch—you can enable Client (Respond Only) on all computers in the domain. That policy doesn't initiate IPsec communications; it simply allows computers to comply when a server requires IPsec.

Enabling Client (Respond Only) on all computers also eliminates the possibility that a user from the bank's headquarters might take a hibernating laptop to a branch site. If such a laptop came back up on the branch's subnet, it would receive a new IP address, but it wouldn't reapply Group Policy until the next scheduled refresh. The laptop wouldn't pick up the site-linked GPO that enables IPsec, and therefore wouldn't be able to access the datacenter servers that require IPsec until it refreshes.

Be aware that the bank might have legal requirements for the types of encryption (e.g., algorithm, key size) that it must use, so be sure to comply with those requirements.