McAfee Endpoint Encryption for PC

Transcription

1 McAfee Endpoint Encryption for PC Product Release Notes Version 5.2.8

2 McAfee, Inc. McAfee, Inc Freedom Circle, Santa Clara, CA 95054, USA Tel: (+1) Internet: Document: Endpoint Encryption for PC Product Release Notes Last updated: 2 February 2011 Copyright (c) McAfee, Inc., and/or its affiliates. All rights reserved. McAfee and/or other noted McAfee related products contained herein are registered trademarks or trademarks of McAfee, Inc., and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. Any other non McAfee related products, registered and/or unregistered trademarks contained herein is only by reference and are the sole property of their respective owners.

3 Introduction Introduction Intention of the Release Notes Document This paper describes the new functions and features introduced with the new Product Release of McAfee Endpoint Encryption for PC (EEPC). This document contains two main sections: 1. Notes on the Product issues you should know about. 2. Release Notes - New functions and features in this release. Upgrading from Previous Releases To apply this release to previous V4.0/V5.0 installations please follow the instructions in the Endpoint Encryption Update and Migration Guide, which can be found in the root folder of the software build. 3

4 Notes on the Product Notes on the Product Hard Disk hardware failure during Encryption If the Hard Disk of a machine is corrupt, or has a bad sector, this may cause the EEPC installation to fail. Therefore, we recommend running a CHKDSK prior to installing the product to ensure the Hard Disk is in a healthy state. Adding new features and fixes to an existing Enterprise If you want to add the new features and fixes to an existing Endpoint Encryption Manager, please follow the instructions in the Endpoint Encryption Update and Migration Guide, which can be found on the root folder of the software build. This document describes how to update an existing enterprise version of Endpoint Encryption to the latest version and how to implement dedicated features like Smart Cards and Tokens. If you are installing from new, please follow the instructions in the Endpoint Encryption Quick Start Guide. Adding new Smart Cards and Tokens To implement new smart cards and tokens in the Endpoint Encryption Manager please follow the instructions in the Endpoint Encryption Update and Migration Guide, which can be found, on the root folder of the software build. If you are performing a fresh installation, please follow the instructions in the Endpoint Encryption Quick Start Guide. Furthermore, please ensure your PC has the reader drivers installed before trying to install Endpoint Encryption for PC. You can find drivers for supported readers in the Tools software package, which can be downloaded from Dynamic and RAID Disks in Windows 2000 / XP/ 2003 / VISTA Because Endpoint Encryption works at sector level, it does not support software-based dynamic disks as seen in Windows 2000, etc. The following issues must be considered when installing Endpoint Encryption on a machine with this feature. a. Volumes spanning one or more physical drives Endpoint Encryption will only encrypt the first drive, which the volume exists on, and will leave the remaining volumes in plain text. b. Volumes mapped in as directories (hard links) Endpoint Encryption will not encrypt the Volume; this is because the physical sectors are not supported at BIOS level. 4

5 Notes on the Product c. Mirrored and RAID Volumes Endpoint Encryption is untested in this mode. It is not designed to support software mirroring and RAID. d. Hardware RAID Endpoint Encryption is untested in this mode; however, in a situation where pure Hardware RAID has been implemented, there is no reason why Endpoint Encryption should not work perfectly. That said, Endpoint Encryption cannot support diagnostic or disaster recovery in this situation. HP NoteBook PC s with SATA Hard Disks McAfee and HP discovered an issue with the BIOS support of SATA hard disks on HP Notebooks, which makes writing to the hard disk in SATA Native mode unreliable. The issue has been confirmed on the HP Compaq nw8440 Mobile Workstation, HP Compaq nc8430 Notebook PC, and HP Compaq nx8420 Notebook PC. If SATA Native Mode is enabled on these machines, the following issues will eventually occur due to incorrect writing of data by the HP BIOS: Corrupt graphics and text Pre-Boot, missing users, missing tokens Data Store Corrupt errors Missing Attribute errors Unknown User where the user previously functioned and has not been removed This issue is present in BIOS versions prior to F.10, released 17th April In these releases to prevent this issue occurring, please disable SATA Native Mode in your notebooks BIOS. You can obtain BIOS version F.10 and greater via your HP support service. If you are using a BIOS version of F.10 or greater, this issue does not apply. Download here Platform Support The integrated solution works on a wide variety of PC platforms. The McAfee Endpoint Encryption team has identified at least the following platforms that have known issues: HP6515b : The OS hangs in Pre-Boot for Laptops containing the NLG3500 card Gateway CA6 : No power provided to the NLG3500 card Split Builds The release of Endpoint Encryption for PC v5.2 (EEPC) and Endpoint Encryption Manager v5.2 (EEM) introduces the products as separate builds. Moving forward these 5

6 Notes on the Product builds will be maintained, updated, installed/upgraded and potentially released separately. This avoids dependency with other encryption product such as Endpoint Encryption for Files & Folders (EEFF), for example, therefore allowing for independent release schedules. Administrators will need to install the EEM first, followed by the product(s) they wish to use. The overall functionality of the products remains the same but their install/upgrade procedure can and may change. Anti-Virus Exclusions It is not necessary to use a virus scanner on the database (SBDATA). Most of the data is encrypted, so there is nothing to be scanned and scanning will reduce much of the performance. It is recommended you create the following exceptions for every Endpoint Encryption for PC Client: SbClientManager: The McAfee Endpoint Encryption Client Manager should be excluded on the client. The process is called SbClientManager.exe SBFS: It s recommended to exclude the McAfee Endpoint Encryption File System where there PreBoot environment is stored. Exclude the following folder: \Device\SafeBootFSVolumes\Disk0\ 6

7 EEPC Release Notes for EEPC Release Notes for Reference Description Enhance the Endpoint Encryption driver to use overlapping I/O An enhancement has been made to the driver to use overlapping I/O Incorporate a custom CHKDSK when client synchronizes. This feature has been included as a self healing tool for the Endpoint Encryption file system Unmount SBFS on hibernation and shutdown This feature has been added to help avoid file corruption during hibernation and shutdown Error reading disk sector on Toughbook CF18 Some instances reported of the error Error reading disk sector on a Toughbook CF18. This was caused by an error in our Pre boot partition code that caused us to read a sector beyond the end of the disk. Normally this would not be an issue as the BIOS would return an error. Unfortunately, with this machine, it causes the BIOS to fail. This issue has now been resolved Password timestamp synchronization issue There was an issue where a user logging on to two different machines could have their password reverted to a previously used one. This has now been resolved by amending how the password change information is stored Support the internal readers on Fujitsu T5010 Corrected an issue whereupon the ACER and Fujitsu BIOS highlighted when scanning the PCI bus to find USB or PCMCIA readers. The issue was related to how the BIOS enumerates PCI devices. The code was changed to handle this form of enumeration to allow PCI devices to be found. As a result, internal readers in these machines can now be found. If the reader is a supported reader, it can now successfully be used. 7

8 EEPC Release Notes for Language set to English at Pre boot following upgrade There was an issue with the Pre boot language being set to English during an upgrade. This has now been resolved and the Pre boot language will remain the same following an upgrade. Please refer to KB71091 for information on How to modify the locale.ini to work with non default keyboard international codes Added AES NI Support AES NI is now supported and a new algorithm included. HIS is the recommended option when FIPS certification is not required New 508 Compliance functionality 508 support has been extended to include password change at Pre boot Modified PIV token behavior Consistent behavior of display user name information across both self initialized and standard PKI tokens. 8