As mentioned by Nate Lawson and illustrated by fellow Security Catalyst Didier Stevens, the cold boot attack against FDE applications is not limited to just FDE, but any program that stores keys in memory.

This is a much bigger problem than just an FDE problem, but it is still far outside the vision and concern of regular users, at least today and likely this year. Didier’s approach to grabbing information out of memory while logged in should be of more concern than a cold boot attack.

So before your auditors require you to put the question, “How do you manage keys in memory?” to your FDE vendor questionaires, make them apply it against every application your organization makes use of or creates.