Protecting data from lost or stolen devices

Unfortunately, physical devices such as laptops can be prone to being lost or stolen. Certain protections need to be in place to help protect the data on the system from being exfiltrated, assuming the device will not be recovered. Fortunately, for devices under corporate management, MDM remote actions can be triggered to wipe a device the next time it comes online. Additionally, BitLocker encryption will prevent data loss from the hard drive, but what kinds of protections are available for data such as credentials or encryption keys stored in memory? Recently, both Intel and AMD have made significant hardware security advances to cover these types of scenarios and protect data stored in memory with encryption.

Secure Memory Encryption (AMD)

Secure Memory Encryption (SME) is a feature specific to AMD-based systems. Pages in the memory are encrypted through page tables using a 128-bit ephemeral Advanced Encryption Standard (AES) key...