Which of the following security mechanisms provides the BEST protection of data when a computer is stolen?

When a computer is stolen, the primary threat is unauthorized access to the data stored on it. Secret key (symmetric) encryption, particularly full-disk encryption (FDE), provides the best protection by rendering all data on the storage drive unreadable without the correct key. Even if the drive is removed and connected to another computer, the data remains confidential. This directly mitigates the risk of a data breach from the physical theft of the device, protecting the data at rest.

A. Password-based access control: This protects the operating system login but can be bypassed by removing the hard drive and accessing it from another system.
B. Digital signature: This ensures data integrity and non-repudiation (proving who created the data), but it does not provide confidentiality or prevent unauthorized viewing of the data.
D. Cryptographic hash function: This is used to verify data integrity by creating a unique fingerprint of the data. It is a one-way function and cannot be used to encrypt and then decrypt data.

1. National Institute of Standards and Technology (NIST). (2007). Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices. Section 2.1, "Threats to Data on End User Devices," p. 2-1. The document explicitly states that full disk encryption is a primary countermeasure against data compromise from lost or stolen hardware.

2. Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. (MIT OCW 6.033 Course Text). Chapter 5, "Security," discusses the principle of protecting data at rest, for which encryption is the fundamental mechanism.