In early 2015 Microsoft started rolling out per file encryption for SharePoint Online and OneDrive for Business in Office 365. Prior to that, the file encryption capability in Office 365 was simple BitLocker storage encryption. The newer approach, often referred to as Fort Knox, involved breaking files into fragments and encrypting each file fragment with a unique encryption key. Microsoft sometimes refers to this fragmenting of files as “shredded storage.” The fragment encryption keys (FEK) are encrypted with a Master Encryption Key (MEK) and then stored in the SharePoint content database. The MEK is stored elsewhere. This feature is “baked” into the storage architecture for files in SharePoint Online and OneDrive for Business, and it is not something an Office 365 tenant can administer or control in any way.
We were curious what the fragment size is but there was no readily available answer in the public domain. Our guess is that the fragment size is somewhere between 2MB and 8MB meaning files smaller than 2MB will not get fragmented – not sure if that matters.
This was lot of work for Microsoft with very little value add to the customers in terms of improving security. Low level encryption such as BitLocker protects against physical loss or theft of storage media. Microsoft, no doubt, has excellent physical security of their data centers along with proper controls for handling and disposing of storage media. Applying the encryption at a higher level improves the protection against physical loss or theft of storage media and could also address issues with rogue system and storage administrator access to tenant data. Fort Knox, however, still doesn’t address the concerns that force many people to use encryption; namely, compelled disclosures and unauthorized insider access to information in SharePoint Online and OneDrive for Business. Even Microsoft admits that, “Assuming Microsoft were to comply with [an NSA style] request, they could ultimately still provide them access to your master key and decrypt the information.”