If a notebook falls into the wrong hands, your company's proprietary data could be compromised. Encrypting the notebook's hard drive will help, but can you depend on employees to change their passwords regularly, pick passwords that can be easily guessed, or even remember what their passwords are?

PC Guardian's Encryption Plus Hard Disk gives system administrators the power to enforce proper password handling on Windows machines. The program is remarkably easy to set up -- both for IT and users -- and stays out of your way while working.

This month, PC Guardian released a new version of Encryption Plus for Hard Disks, 6.1. Aside from Windows 2000 support, not much has been added.

The Setup

As the administrator, you install the main program onto your own computer, then run a wizard to set up your company-wide defaults. These defaults include multiple system-wide passwords, plus rules that users must adhere to when creating their own passwords.

You can, for instance, set a minimum length for user passwords, require that they include special characters like @ or #, and expire in a set number of days. You can also let your users set up a password-protected screen saver and control how many wrong guesses a forgetful user is allowed.

In the end, the wizard creates a new program specific to the specs you gave it. Once users have installed this program onto their machines, they can encrypt their drives.

Encryption Plus scrambles those hard drives via Blowfish, which sounds like a James Bond villain but is actually one of the best encryption algorithms around. According to Gartner Group analyst Victor Wheatman, "For all practical purposes, Blowfish cannot be broken and will not be broken in the near term."

Background Descrambling

Boot an Encryption Plus-encrypted system from a floppy and your hard drive will contain nothing but gobbledygook. But boot from the hard drive itself, and the first thing you'll get -- before your OS -- will be a password prompt.

The Encryption Plus background program -- the one that encrypts and decrypts on the fly -- loads from the master boot record, before Windows. As far as the user can tell -- in fact, as far as Windows can tell -- everything is normal. Windows simply reads and writes files, oblivious to the encrypting and decrypting going on in the background.

Any program that works this close to the bone will have compatibility problems. Encryption Plus Hard Disk is bound to conflict with any other program that messes with the master boot record (I had major problems with Drive Image).

And if a computer has more than one physical hard drive, the program won't convert either of them into encrypted form. Once a drive is encrypted, however, an added second drive won't interfere with the on-the-fly encrypting and decrypting.

And how does all this background encrypting and decrypting affect performance? All logic will tell you that a low-level program processing every read and write will slow down the system; PC Guardian admits that a one to five percent hit should be expected.

Yet in my own benchmarks, Encryption Plus for Hard Disks actually improved performance slightly -- about eight percent. PC Guardian had no explanation, but was happy to hear the news.

But don't depend on Encryption Plus for any sort of Internet security. It has no way of knowing if a file request is coming from a user at the keyboard, a co-worker on the LAN, or a hacker on the Internet. This program is for companies where there's concern about espionage at the office itself, or where computers are in danger of getting stolen. It's no surprise that, according to PC Guardian, the program's biggest market is with notebooks.

Quick Recovery

But protection always has its price. Users sometimes forget passwords or get hit by buses. Either way, the company can be locked out of an encrypted hard drive with important data.

Encryption Plus offers two solutions -- company back doors that will allow an administrator to make the drive accessible again. You can access any encrypted computer with either of two company-wide passwords. Or you can use a One-Time Password program (something you can create with the administrator's version of Encryption Plus). Armed with this program, you can give a forgetful user access to his or her computer over the phone with a verbal exchange of numeric codes.

Not every company needs this level of security -- and almost no company needs it on every system. But if you have sensitive information that isn't always in a sensitive location, Encryption Plus for Hard Disks is a remarkably easy way to secure it. Pricing starts at $99.95 per seat.