May 2016 If you have questions regarding a particular customer situation, please reach out to DL-SYMC- Encryption-Ask-PM for guidance.

Size: px

Start display at page:

Download "May 2016 If you have questions regarding a particular customer situation, please reach out to DL-SYMC- Encryption-Ask-PM for guidance."

Mariah Gray
5 years ago
Views:

1 May 2016 If you have questions regarding a particular customer situation, please reach out to DL-SYMC- Encryption-Ask-PM for guidance. Vulcan Release - May 6, 2016 On May 6, 2016, Symantec announced the release of Symantec Endpoint Encryption The product integrates the best of PGP and GuardianEdge solutions into a single, robust platform. Some of the important new enhancements include seamless migration from legacy endpoint encryption solutions, native operating system encryption management (BitLocker and FileVault), and support for Opal compliant selfencrypting drives. The table below includes a full list of additional feature enhancements and their corresponding descriptions. Feature Component Description In-place Upgrade from Symantec Endpoint Encryption In-place Upgrade from Symantec Encryption Desktop Enables migration from SEE to SEE without requiring to decrypt drives. Enables migration from SED to SEE without requiring to decrypt drives. BitLocker Management Leverages native OS encryption on Windows-based machines. Management of Opal Compliant Self-Encrypting Drives Provides customers the option to perform hardware encryption on Opal compliant self-encrypting drives. Role-Based Access Control for Client Administrators End-to-end Windows Password Recovery for Locked Out Users Limits action of client administrators with privilege-based, granular access, based on job duties. Allows client administrators to register and unregister users, decrypt drives, or extend lockout dates. Upon distributing the Windows Password Reset Utility to the client computers with the Self-Recovery feature enabled, users can authenticate by answering their security questions and gain access to Windows without Help Desk assistance. In the absence of self-recovery, users can retrieve recovery key via Help Desk and gain access to Windows via the utility. 1

2 Non-Windows Password for Pre-Boot Authentication Support for Password Synchronization When UPN Differs from Domain Password Aging and Password History for Removable Media Encryption Distributing Updated IIS Credentials without Deploying an MSI file Simple Authentication at Pre-Boot Single Server Installer Removable Media Encryption Symantec Endpoint Encryption Management Server Symantec Endpoint Encryption Management Server Allows users to create a non-windows user account and register it to the encrypted disk. Users authenticate to preboot using these credentials. Provides password synchronization (upon Windows password change) even if the UPN differs from the domain. Applies password aging and password history to the Removable Media Encryption default password and session password. Updates the Internet Information Services (IIS) client-toserver communications without creating and deploying a modified Management Agent package. Allows end users to log into their pre-boot environment by entering only their password, without the need to enter username and domain. Allows the server to be deployed with a single installer, which significantly reduces the server set up time. 1. Why were these features released? By offering management of native operating system encryption (BitLocker for Windows and FileVault for Mac OS X) and support for Opal-compliant self-encrypting drives, Symantec is better positioned to compete with other encryption vendors (such as Sophos and McAfee) who already offer these features. This is an important step toward better aligning our offering with the endpoint encryption market because it provides customers with the freedom to choose whichever encryption platform best meets their needs. 2. What versions of Windows operating systems are supported? Symantec Endpoint Encryption clients are supported on the following Windows operating systems: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, and Windows Server 2012 R2. 3. What versions of Mac OS X are supported? Symantec Endpoint Encryption supports management of FileVault (Mac OSX native encryption solution) on the following operation systems: Mac OS X 10.9, Mac OS X 10.10, and Mac OS X

3 Synopsis of Darwin Release October 2014 In October 2014, Symantec combined its two-endpoint encryption platforms into a single platform that now includes disk encryption, removable media encryption and management. The solution was named Symantec Endpoint Encryption and a number of licenses were rolled into a single SKU. Since the Symantec Endpoint Encryption release offers a seamless migration path from Symantec Encryption Desktop (formerly PGP) and Symantec Endpoint Encryption (formerly GuardianEdge), we strongly encourage all our endpoint encryption customers to migrate to the new product. From a product development standpoint, all new features/functionality will be added to the SEE 11.x product. In the interim Symantec will continue to distribute maintenance packs Symantec Encryption Desktop However, Symantec will discontinue shipping maintenance packs for SEE and those customers will be required to upgrade to SEE The following licenses will automatically migrate on a 1:1 ratio into the new Endpoint Encryption license. Endpoint Encryption customers will be entitled to the full list of products below. Symantec Symantec with Encryption Management Server Limited Symantec with Encryption Management Server Symantec FlexChoice with Encryption Server Limited Symantec FlexChoice with Encryption Server Symantec Drive and Removable Storage Encryption FlexChoice with Encryption Server Limited Symantec Endpoint Encryption Removable Storage Edition Symantec CAPS Activation Package for Whole Disk Encryption Symantec PGP Universal Server and Whole Disk Encryption for Servers Product Strategy 1. What is the rationale behind these changes? Before making these changes, Symantec s endpoint encryption solution ran on two platforms. Customers and industry analysts urged us to combine these platforms into a single best-of-breed endpoint solution to better position Symantec s Encryption offering in the market and improve customer satisfaction. In addition, converging the two endpoint encryption solutions will eventually lead to a single code base that will enable the product development to execute faster and better serve our customers. 3

4 Product Features 2. Which technologies are leveraged in Symantec s newest Endpoint Encryption offering? Symantec s new endpoint encryption offering leverages the Symantec Endpoint Encryption Management Server, which offers superior reporting capabilities, support for Active Directory and non-active Directory environments and double the scalability of our previous platform. This platform s architecture also enables development to bring a number of industry asks to market much faster than if we relied on the Encryption Management Server s architecture. As we start to offer third-party encryption management capabilities this server is capable of pulling Drive Encryption clients One-Time Passwords (OTP) for recovery purposes from Encryption Management Server. Symantec s disk encryption capability leverages s technology for better performance (preboot and post-boot), better hardware compatibility and support for Windows 8 environments. Symantec s removable media capability leverages our previous removable storage edition s technology because our /Encryption Management Server offering did not have this capability. 3. What advantages do customers see over their previous disk encryption implementations? The advantages will vary depending on the solution your customer was using (see below for details). Heterogeneous Encryption Management Removable Media Encryption Entitlement Scalability Symantec Endpoint Encryption provides customers the option to manage native operating system encryption such as BitLocker for Windows and FileVault for Mac OS X. In addition customers can also manage a variety of self-encrypting drives manufactured by Intel, Seagate, Micron and Samsung among others. Symantec Encryption Desktop (PGP) customers would have had to pay for this while it is now included in the Endpoint Encryption offering and they are entitled to the feature at no extra cost. There should be a noticeable increase for many although the scale varies depending on what hardware a customer is running. 4

5 User Experience Windows password recovery for locked out users Reporting Whole Disk Recovery Token Management Policy-Based, Pre-Boot Bypass Endpoint Encryption requires no end user interaction to being encryption installation. It happens automatically once the software is pushed down to users machines. SEE (unlike SED ) supports password recovery on Windows for both online and offline use cases, which allows users to log into their Windows machines, in case a locked out user. This reduces help desk calls, hence lowering the total cost of deployment. Reporting within Endpoint Encryption Management Server is dramatically improved by providing these administrators with out-of-the-box reports and deep customization options. Although Endpoint Encryption Management Server cannot see clients, it can pull their WDRTs from Encryption Management Server, allowing help-desk administrators to only rely on a single management console to assist locked out employees. A policy can be configured so that authentication can be bypassed at pre-boot. Advantages of Endpoint Encryption v11 over previous versions of Endpoint Encryption Platform Support SEE supports Windows (including Win 10), Mac OS, Amazon Web Services, VMware vsphere Citrix XenDesktop, and Opal v2 compliant selfencrypting drives from Intel, Lenovo, Samsung, SanDisk, Seagate, Micron and Kingston. Hardware Compatibility Many hardware compatibility and stability issues have been eliminated Active Directory and Non-Active Directory Synchronization Previously Symantec Endpoint Encryption customers could only sync into Active Directory environments 5

6 4. What will customers who have purchased our encryption bundles be entitled to? All migrations happen automatically on a 1:1 ratio at no additional cost provided the customer is current on maintenance. Standalone products now include management and the ability to run unmanaged or managed. Old License Symantec Desktop Encryption with Encryption Server Limited Symantec Gateway Encryption with Encryption Server Limited Symantec File Share Encryption with Encryption Server Limited New License (includes Symantec Encryption Management Server) Symantec Desktop Encryption Symantec Gateway Encryption Symantec File Share Encryption Product bundles have been broken up and each respective product now includes management. Old License Symantec Encryption Desktop Corporate Symantec Encryption Desktop Professional Symantec Encryption Desktop Storage New License Entitlement (each includes Symantec Encryption Management Server) Symantec Endpoint Encryption Symantec Desktop Encryption Symantec File Share Encryption Symantec Endpoint Encryption Symantec Desktop Encryption Symantec Endpoint Encryption Symantec File Share Encryption 5. Can customers still run in unmanaged modes? Yes, users can install a standalone version of directly onto their clients without the Symantec Endpoint Encryption - Management Server. The new Endpoint Encryption offering can also be run in an unmanaged environment. However, the Symantec Endpoint Encryption Management Server is required to deploy the new solution, after which clients do not need to check in with the server. 6

7 6. Will DLP integration be affected by this change? No, DLP integration will continue as before. DLP + Removable Media Encryption: Sensitive files can be automatically encrypted before going onto removable media. DLP + Gateway Encryption: containing sensitive data can be automatically encrypted before being sent. DLP + File Share Encryption: Sensitive data is located on a customer s shared drives, then automatically encrypted Customer Profile 7. Which customers can benefit from in-place upgrades? Customers that have deployed Symantec Endpoint Encryption and Symantec Encryption Desktop can benefit from the in-place upgrade. 8. How do existing Symantec Encryption Desktop customers upgrade? Administrators will first need to install Symantec Endpoint Encryption 11.1 Management Server Create the SEE 11.1 package for Windows from the SEE Management Console and deploy on Windows machines that are encrypted with Symantec Encryption Desktop MP4 and greater. Run the executable on the Windows machine and upgrade to Symantec Endpoint Encryption Upon rebooting, the machine will be encrypted and managed by SEE How do existing Symantec Endpoint Encryption customers migrate? Administrators will need to upgrade their old Endpoint Encryption Management Server to v11.1 Create the SEE 11.1 package for Windows from the SEE Management Console and deploy on Windows machines that are encrypted with Symantec Endpoint Encryption Run the executable on the Windows machine and upgrade to Symantec Endpoint Encryption Upon rebooting, the machine will be encrypted and managed by SEE Will the licenses being migrated to new offerings or broken up (bundles) still be available for sale? No, as of October 6, 2014 we no longer offered these licenses for purchase separately. Customers looking for endpoint encryption functionality have to purchase the new offering. However, customers are free to install only the pieces they need, which includes continuing with their existing implementation. 7

8 11. Given the entitlements and 1:1 migrations, what happens if customers have more licenses than they need? Now that all products except for PGP Command Line include management and 1:1 migration ratios, we realize many customers may have extra licenses. Customers are free to distribute these extra licenses around their organization, as they need. Any additional licenses may be discontinued at renewal. 12. What is happening to standalone Encryption Management Server licenses? These licenses won t migrate into anything. Given the products that needed the license now include Encryption Management Server, we anticipate customers will drop these licenses at renewal. 13. What should my customer do if they want to discontinue the license before their renewal to save money? Kindly remind this customer that being up to date on maintenance is what gave them the extra licenses, functionality, and new offerings at no additional charge. They would pay for the additional licenses at their next renewal and would discontinue support. 14. Do customers who had previously purchased with Encryption Management Server Limited receive Removable Media Encryption, the full Encryption Management server and the new Endpoint Encryption offering at no additional cost? Yes, and their renewal should also be less since the MSRP dropped almost 60%. 15. I have a customer who previously purchased Symantec Endpoint Encryption with Removable Media Encryption 8.x. Their renewal is more expensive than before, and they are unwilling to pay the higher price for Symantec Endpoint Encryption Removable Media Encryption 11.x. As part of the October 2014 launch, Symantec migrated customers with licenses for Symantec Endpoint Encryption Removable Media Encryption to a 1:1 license entitlement for Symantec Endpoint Encryption Symantec Endpoint Encryption 11.x provides Removable Media Encryption capabilities and adds Drive Encryption capabilities. Given that the new offering is more robust, the maintenance renewal will be more expensive than if the customer was purchasing Removable Media Encryption standalone. When trying to obtain a renewal, Symantec employees should work within the existing discount approvals framework. If that doesn t work, reach out to Product Management with the details to discuss further. 8

9 and File & Folder Plus PGP Command Line 1. What s happening with the and File & Folder Encryption roadmaps? We continue to innovate and improve our and File & Folder solutions as resources allow. Currently, both solutions are unaffected by these changes and will continue to be managed, run and maintained as they have in the past by Encryption Management Server. We will continue to support this server and provide both incremental enhancements and maintenance packs for high priority issues as necessary. 2. How will customers who own and/or File Share Encryption along with be affected by this change? Customers who don t want to migrate from to the new offering can still manage their entire encryption solution with Encryption Management Server (SEMS). Customers who do migrate from to the enhanced offering will continue to manage and File Share with Encryption Management Server while Endpoint Encryption Management Server will manage the new Endpoint Encryption offering. 3. When will the Symantec Encryption Desktop functions (PGP Virtual Disk, PGP Zip, and PGP Shredder) be added to SEE 11.x? At this time, Symantec s Encryption roadmap does not include these functions. However, as we continue to develop our next-generation capabilities, we will consider supporting these features with sufficient customer/prospect interest. 4. What s happening with the PGP Command Line roadmap? PGP Command Line continues to be a strong, relatively unique product in the encryption market that needs few updates. Incremental product enhancements, platform updates and maintenance packs for high priority issues will continue as before. Regional Contacts For more information and discussion around what s happening, please reach out to the following individuals: NAM EMEA APJ Harsh Doshi Harsh Doshi Harsh Doshi Kathryn Kriese Nikhil Sinha 9

Symantec Drive Encryption Evaluation Guide

Symantec Drive Encryption Evaluation Guide Getting Started Installing Symantec Encryption Management Server is the first product deployment step for any Symantec Encryption evaluation (also known as a