Cloud-based removable drive encryption policy enforcement and recovery key management

1. A method, comprising:

receiving, by a management component executed by a client device, a removable drive encryption policy from a cloud-based management service;

identifying, by the management component, that a removable drive is recognized by an operating system of the client device;

transmitting, by the management component, at least one drive encryption command for the operating system, wherein the at least one drive encryption command causes the operating system to: request user password creation, and encrypt the removable drive;

reading, by the management component, password recovery data comprising a recovery key, the password recovery data is identified based at least in part on at least one write-output of the operating system;

transmitting, by the management component, the recovery key to the cloud-based management service for storage in a cloud-based removable drive recovery key escrow;

identifying, by the management component, that a password to decrypt the removable drive is forgotten;

identifying, by the management component, a recovery key identifier that is specific to the removable drive; and

transmitting, by the management component to the cloud-based management service, a recovery key request comprising the recovery key identifier, wherein the recovery key is identified from the cloud-based removable drive recovery key escrow.

2. The method according to claim 1 , wherein the at least one drive encryption command comprises at least one parameter that directs the operating system to perform the at least one write-output.

3. The method according to claim 1 , wherein the removable drive is a universal serial bus (USB) drive.

4. The method according to claim 1 , further comprising:

transmitting, by the management component, a drive inventory request to the operating system to identify that the removable drive is recognized; and

receiving, by the management component, a current drive inventory based at least in part on the drive inventory request, wherein the removable drive is identified as a new removable drive based on the current drive inventory and a previous drive inventory.

5. The method according to claim 1 , further comprising:

receiving, by the management component, the recovery key identified from the cloud-based removable drive recovery key escrow.

6. The method according to claim 5 , further comprising:

enabling, by the management component, access to the removable drive by providing the recovery key.

7. The method according to claim 5 , wherein the password recovery data comprises the recovery key and the recovery key identifier.

8. A non-transitory computer-readable medium embodying instructions executable by at least one computing device, the instructions, when executed, causing the at least one computing device to at least:

receive, by a management component executed by a client device, a removable drive encryption policy from a cloud-based management service;

identify, by the management component, that a removable drive is recognized by an operating system of the client device;

transmit, by the management component, at least one drive encryption command for the operating system, wherein the at least one drive encryption command causes the operating system to: request user password creation, and encrypt the removable drive;

read, by the management component, password recovery data comprising a recovery key, the password recovery data is identified based at least in part on at least one write-output of the operating system;

transmit, by the management component, the recovery key to the cloud-based management service for storage in a cloud-based removable drive recovery key escrow;

identify, by the management component, that a password to decrypt the removable drive is forgotten;

identify, by the management component, a recovery key identifier that is specific to the removable drive; and

transmit, by the management component to the cloud-based management service, a recovery key request comprising the recovery key identifier, wherein the recovery key is identified from the cloud-based removable drive recovery key escrow.

9. The non-transitory computer-readable medium according to claim 8 , wherein the at least one drive encryption command comprises at least one parameter that directs the operating system to perform the at least one write-output.

10. The non-transitory computer-readable medium according to claim 8 , wherein the removable drive is a universal serial bus (USB) drive.

11. The non-transitory computer-readable medium according to claim 8 , the instructions, when executed, further causing the at least one computing device to at least:

transmit, by the management component, a drive inventory request to the operating system to identify that the removable drive is recognized; and

receive, by the management component, a current drive inventory based at least in part on the drive inventory request, wherein the removable drive is identified as a new removable drive based on the current drive inventory and a previous drive inventory.

12. The non-transitory computer-readable medium according to claim 8 , the instructions, when executed, further causing the at least one computing device to at least:

receive, by the management component, the recovery key identified from the cloud-based removable drive recovery key escrow.

13. The non-transitory computer-readable medium according to claim 12 , the instructions, when executed, further causing the at least one computing device to at least:

enable, by the management component, access to the removable drive by providing the recovery key.

14. The non-transitory computer-readable medium according to claim 12 , wherein the password recovery data comprises the recovery key and the recovery key identifier.

15. A system, comprising:

at least one computing device; and

instructions accessible by the at least one computing device, wherein the instructions are executed causing the at least one computing device to at least:

receive, by a management component executed by a client device, a removable drive encryption policy from a cloud-based management service;

identify, by the management component, that a removable drive is recognized by an operating system of the client device;

transmit, by the management component, at least one drive encryption command for the operating system, wherein the at least one drive encryption command causes the operating system to: request user password creation, and encrypt the removable drive;

read, by the management component, password recovery data comprising a recovery key, the password recovery data is identified based at least in part on at least one write-output of the operating system;

transmit, by the management component, the recovery key to the cloud-based management service for storage in a cloud-based removable drive recovery key escrow;

identify, by the management component, that a password to decrypt the removable drive is forgotten;

identify, by the management component, a recovery key identifier that is specific to the removable drive; and

transmit, by the management component to the cloud-based management service, a recovery key request comprising the recovery key identifier, wherein the recovery key is identified from the cloud-based removable drive recovery key escrow.

16. The system according to claim 15 , wherein the at least one drive encryption command comprises at least one parameter that directs the operating system to perform the at least one write-output.

17. The system according to claim 15 , wherein the removable drive is a universal serial bus (USB) drive.

18. The system according to claim 15 , wherein the instructions are executed causing the at least one computing device to at least:

transmit, by the management component, a drive inventory request to the operating system to identify that the removable drive is recognized; and

receive, by the management component, a current drive inventory based at least in part on the drive inventory request, wherein the removable drive is identified as a new removable drive based on the current drive inventory and a previous drive inventory.

19. The system according to claim 15 , wherein the instructions are executed causing the at least one computing device to at least:

receive, by the management component, the recovery key identified from the cloud-based removable drive recovery key escrow.

20. The system according to claim 19 , wherein the instructions are executed causing the at least one computing device to at least:

enable, by the management component, access to the removable drive by providing the recovery key.