Re: data encryption

[Ahsan Shahzad Mir <asmir () USFCA EDU>]

We use Utimaco WDE, now under Sophos. We have found supporting Utimaco WDE
to be rather painless experience. It does offer most features offered by PGP
other than workgroup collaboration. The vendor has suggested that they will
have a solution for MACs pretty soon and perhaps a unified management
console for WDE and sophos AV, NAC. For encrypting files and folders  we are
implementing another solution from a Swedish company called Cryptzone.
Cryptzone has the capabilities to encrypt any USB drive, file or folder. It
has integration with Active Directory so it can pull user account and
security group data, one can also create users and groups on demand. It also
has excellent auditing and logging capabilities with helpdesk console for
password recovery - overall we are very happy with their product offering
and product support.





Ahsan Shahzad Mir

Security Analyst

University of San Francisco

415-422-2096







From: The EDUCAUSE Security Constituent Group Listserv
[mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of jeff murphy
Sent: Monday, July 27, 2009 5:57 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] data encryption





On Jul 27, 2009, at 4:28 PM, Mark Reboli wrote:





Please let me know the following that you use for data encrpytion.  We have
users with laptops that we want to secure sensitive data on.



1.       Do you use whole disk encryption or partial

2.       What program(s) do you recommend that you have use or are using

3.       Anything else you think would be purdent for us to consider.





We selected PGP WDE as well. I included some of what we thought about when
considering products.






Requirements


The requirements for a successful product to meet UB's need to secure
regulated data are:

1.      User transparency:

a.      The end user should have minimal interaction with the software. It
should be as automatic as possible. It should "just work".

2.      Ease of support:

a.      The product must be remotely installable (unattended, via scripts,
etc) without user interaction.
b.      The product must support multiple keys for administrative access to
the end-user equipment without the need for the end-user's password.
c.      The product must support background, re-startable encryption during
installation. For example, if the product is installed and is interrupted by
a reboot, power outage, etc, the initial encryption should not fail. It
should resume upon restart of the system.
d.      The product must support passphrase access to the pre-boot screen.
e.      The product must provide a mechanism for remote patching, rebooting
and bypass of the pre-boot authentication screen.
f.      The product must support remote key-recovery for situations where
the end-user has forgotten their passphrase but is unable to be physically
attended to.

3.      Audit, Logging and Policy:

a.      The product must support logging to a system other than the end-user
system so that, upon loss or compromise of the end-user system, the question
"was the disk encrypted at the time of the loss" can be answered positively
and in such a manner that the supporting data will stand up to scrutiny.
b.      The product must offer policy features allowing for the
administrative disabling of the whole disk decryption functionality so that
the end-user is unable to decrypt their disk without administrative
approval/knowledge.

4.      Workgroup Collaboration:

a.      The product must support the encryption of shared folders/files
stored on fileservers and accessible to groups of people.
b.      The product must support the concept of an 'administrator' that is
permitted to add/remove keys to/from the shared files/folders. The product
must support the concept of 'users' that can access the files, but not
manipulate the list of keys (users) that have access to the files.


Outcome


Wrt to the above requirements, Green = OK, Red = Not Ok, Yellow = Caveats



 Summary of Requirements Table







Thank you in advance.



m



Mark Reboli

Network/Telcom/IT Security Manager

Misericordia University

mreboli () misericordia edu

(570)674-6753