Release Notes DriveLock SE

Transcription

1

2 Release Notes Table of Contents Introduction 3 1 Document Conventions 3 2 DriveLock Documentation 3 System Requirements 5 1 DriveLock Agent 5 2 DriveLock Management Console and Control Center 5 3 DriveLock Enterprise Service 5 Part III Supported Platforms 7 Part IV Version History 9 1 DriveLock DriveLock DriveLock Part I Part II 12 Known Issues Part V 1 Installation of Management Components Using Group Policy 12 2 DriveLock Device Scanner 12 3 Manual Updates 12 4 Self Service unlock 12 5 DriveLock ios and itunes 12 6 Windows Portable Devices (WPD) 13 7 DriveLock Disk Protection 13 8 DriveLock File Protection and Microsoft OneDrive 14 9 BitLocker Management 14 Antivirus Test Installation and Upgrade Part VI 1 DriveLock Evaluation 16 2 Updating DriveLock Components 16 General Issues Updating DriveLock Disk Protection

3 Introduction 1 Introduction This document contains important information about the new version of DriveLock and changes from previous DriveLock versions. The DriveLock Release Notes also describes changes and additions to DriveLock that were made after the documentation was completed. This and other documentation can be found on our online help page Document Conventions Throughout this document the following conventions and symbols are used to emphasize important points that you should read carefully, or menus, items or buttons that you need to click or select. Caution: This format means that you should be careful to avoid unwanted results, such as potential damage to operating system functionality or loss of data Hint: Useful additional information that might help you save time. Italics represent fields, menu commands, and cross-references. Bold type represents a button that you need to click. A fied-width typeface represents messages or commands typed at a command prompt. A plus sign between two keyboard keys means that you must press those keys at the same time. For eample, ALT+R means that you must hold down the ALT key while you press R. A comma between two or more keys means that you must press them consecutively. For eample ALT, R, U means that you must first press the Alt key, then the R key, and finally the U key. 1.2 DriveLock Documentation The DriveLock Documentation consists of the following manuals: DriveLock QuickStart Guide The QuickStart Guide describes the required steps to setup DriveLock using the DriveLock QuickStart setup wizard.the DriveLock QuickStart setup wizard can be used to simplify the installation and configuration of a basic DriveLock environment. DriveLock Installation Guide The Installation Guide describes the available installation packages, the system requirements and the steps for installing each DriveLock component. This is the first document a DriveLock administrator should read. DriveLock Administration Guide The Administration Guide describes the DriveLock architecture and components. It contains detailed instructions for configuring DriveLock using the DriveLock Management Console (DMC). This document is intended for DriveLock administrators who need to become familiar with all available DriveLock functionality. DriveLock Control Center User Guide This manual describes how to configure and use the DriveLock Control Center (DCC). This document is intended for administrators and users who will use DriveLock Control Center for reporting and forensic analysis. DriveLock User Guide The DriveLock User Guide is aimed at end users. It describes how to request the temporary unlocking of a computer, how to use DriveLock Encryption 2-Go and how to use Network Profiles. 3

4 Introduction DriveLock Security Awareness This manual describes the new security awareness features, which are also included in DriveLock Smart SecurityEducation. You can read and download the latest version of these manuals from our online help website 4

5 Introduction 2 System Requirements This section contains recommendations and minimum requirements. The requirements may vary depending on your configuration of DriveLock, its components and features, and your system environment. 2.1 DriveLock Agent Before distributing or installing the DriveLock agents on your corporate network, please ensure that the computers meet these requirements and are configured properly to provide full functionality. Main memory: o at least 4 GB RAM Free disk space: o appro. 1 GB with average policies that do not include your own video files o at least 2 GB if Security Awareness campaigns are used with video sequences (Security Awareness Content AddOn) How much disk space you need largely depends on how DriveLock agents are configured via policies and on the settings and features they contain. It is therefore difficult to provide an eact specification here. We recommend that you verify and determine the eact value in a test setup with a limited number of systems before performing a company-wide roll-out. Additional Windows components: o.net Framework or newer (for Security Awareness Campaigns in general) o Windows Media Player (for Security Awareness Content AddOn) 2.2 DriveLock Management Console and Control Center Be sure to install the two management components on the same computer because the DCC will access some of the dialogs provided by the DriveLock Management Console. Before distributing or installing the DriveLock management components DMC and DCC on your corporate network, please ensure that the computers meet these requirements and are configured properly to provide full functionality. Main memory: o at least 4 GB RAM Free disk space: o appro.350 MB Additional Windows components: o.net Framework or newer 2.3 DriveLock Enterprise Service Before distributing or installing the DriveLock Enterprise Service on your corporate network, please ensure that the computers meet these requirements and are configured properly to provide full functionality. Main memory: o at least 8 GB RAM Free disk space: 5

6 System Requirements o at least 4 GB, with policies that do include Security Awareness campaigns with video sequences (Security Awareness Content AddOn), appro. 15 GB is recommended o if the server is also running the SQL-Server database, additional 10 GB are recommended for storing DriveLock data Additional Windows components: o.net Framework or newer Depending on the number and duration of the DriveLock events that are stored, the size of the DriveLock database can vary greatly from one system environment to another. It is therefore difficult to provide an eact specification here. We recommend setting up a test environment with the planned settings over a period of at least a few days to determine the eact values. These values can be used to calculate the required memory capacity. 6

7 System Requirements 3 Supported Platforms DriveLock has been tested and is released for all Windows versions (having the latest available patches installed), which have been official released by Microsoft by the time this DriveLock version was released and which have not reached their end-of-service date: XP 3) W7 SP1 2) W8.1 Device Control Application Control Operating System Windows 1) OS X Win Win / 1709 Win / ) Server 2008 SP2 2008R2 SP1 Server R2 Server 2016 Agent (DC/AC) File encryption Mobile Encryption Application File Protection6) Disk encryption Disk Protection 13) BitLocker Management Management components Management Console Control Center 9) Enterprise Server DriveLock Virtual Channel ICA RDP 8) 7) 7) 7) 7) 12) 12) 12) 12) IGEL WYSE Embedde elu UDLX Linu V6 d Thin Windows Clients 10) + DriveLock Thin-Client Support ICA (Citri) XenApp 6.0 RDP (Windows TS) XenApp ) 2008R SP R2 XenApp 7.X

8 Supported Platforms Database Microsoft SQL Server 5) / SP2 SP4 14 SP R2 SP Oracle Database14) Remarks 1) Windows Intel X86 based Systems (86_32, 86_64, AMD64) Windows Vista and Windows 8 are not supported any more. 2) Windows 7 SP1 KB (SHA-2 code signing support) is required on Windows 7 64-bit. 3) Windows XP Windows XP with SP3 fully patched and POSReady 2009 is supported. An additional license for support of legacy OS is required! Release has been tested with Windows ) Windows ) Microsoft SQL Epress 6) File Protection 7) Disk Protection 8) BitLocker 9) Control Center For installations up to 200 Clients. Citri Terminal Servers are not supported. UEFI and GPT Partitioning are only supported for disks up to 2 TB running on Windows bit or newer and UEFI Version V2.3.1 or newer. UEFI on Windows 7 is not supported. For UEFI running on Windows 10 Version 1703 the Update KB is mandatory. DriveLock Disk Protection is supported on Windows 10 version 1709 or newer with some limitations (see chapter "Known issues" for more information). Windows 7 32-bit is not supported in DriveLock. For more information see "Known issues -> BitLocker Management" Internet Eplorer 11 is required for remote connections to an DriveLock Agent. 10) Windows Embedded 11) XenApp Der DriveLock Virtual Channel and the DriveLock Agent must not be installed on the same Client. 12) DES 13) FDE and XP On these operating systems DES should only be installed for evaluation or testing purposes. DriveLock Disk Protection is supported only on Windows XP released for ATMs. XenApp 6.5 Hotfi Roll Up 4 or newer. 14) Oracle Support We still provide support for eisting customers. We strongly recommend new customers to use SQL Server instead of Oracle Database. 8

9 Supported Platforms 4 Version History The version history contains all changes and innovations since the last major release, DriveLock Version DriveLock DriveLock is a maintenance release Important Bug Fies: General: The interface control is now activated correctly when the Citri Receiver switches the virtual channel from "Optimized" to "Generic". To run application control correctly, you no longer need to restart the DriveLock agent after having unlocked and stopped it manually when rebooting the computer via agent remote control. Drive list rules are no longer applied directly to encrypted containers on an eternal drive. If you configured a DriveLock agent with a configuration file, then it will now use the cached last configuration to access the original configuration file via a web server in case connection problems occur. We improved the compatibility between the DriveLock interface control and BitDefender Endpoint Security (product version and older and engine version and older). Block access to USB media on locked drives is also prevented even if the user has the right to format the drive. The status of an agent during agent remote control is displayed correctly again in the DMC after updating from to the latest DriveLock version. File filter will be applied correctly to an encrypted container, when drive connection has changed. Even when a connection is changed, file filters are still correctly applied to encrypted containers. Placing a policy assignment at the top of the list will no longer freeze the DMC. When you upgrade to version 7.9, any eisting DriveLock AV service will now be completely uninstalled. The drive rules for USB drives connected to thin clients via the new Citri "Generic Virtual Channel" are now correctly applied. The current baramundi Agent is correctly recognized as a Trusted Installer again if it has been configured accordingly. BitLocker Management: Now the user is always prompted to change the BitLocker password, if the administrator requests this password change via the DCC. Users are now not prompted to change their BitLocker password if a central password has been assigned by an administrator. Before installing BitLocker encryption, the system verifies whether a previous encryption with Disk Protection has been completely decrypted and uninstalled. You can now use a license that contains both BitLocker Management and Disk Protection. On systems that have an additional encrypted data partition, only one dialog appears during recovery for resetting the password. 9

10 Version History We deactivated the option in the DMC that allowed you to store recovery keys in the file system; it was not used. Drives will no longer be decrypted if the Agent is assigned a policy completely without BitLocker license and settings. DriveLock BitLocker Management now correctly recognizes and treats eternal drives as such. After uninstalling, the original BitLocker menu entries are displayed again completely. Disk Protection: The PBA of the DriveLock FDE is correctly initialized on HP notebooks, where "Fast Boot" is already enabled in the UEFI settings. The bug that led to a blue screen on an HP Elite Desk 800 G3 Desktop Mini PC in combination with the 32bit PBA was fied. The PBA for BIOS (32bit PBA) and UEFI now also supports the following tokens: SafeNet etoken NG-OPT (CardOS), SafeNet etoken NG-OPT 72k/Java, SafeNet etoken 5105, SafeNet etoken Eisting Windows system settings (SSO, Fast Startup, BitLocker Etensions) are optimized while installing Disk Protection. On some Lenovo systems, keyboard layout is now available in a number of languages other than English. Improvements when uninstalling Disk Protection. File Protection: When you use File Protection to force encryption of USB media, Windows Eplorer no longer freezes for several seconds. We fied the issue with a missing signature in the DLFldEnc.sys file. 4.2 DriveLock DriveLock is a maintenance release Important Bug Fies: The DriveLock Agent correctly recognizes serial numbers in whitelist rules, if the policy has been created with a DriveLock version older than DriveLock DriveLock is a feature release New features: This version allows you to manage disk encryption with Microsoft BitLocker across your company now for the first time. As our customer you benefit from an additional range of advanced features when compared to the native BitLocker encryption: Automated unlocking of encrypted etended partitions Centralized and secure managing of recovery information (recovery keys) Detailed reporting and central Helpdesk capabilities Passwords assigned centrally 10

11 Version History DriveLock BitLocker Management creates new recovery keys automatically after recovering them successfully, which makes the old recovery key invalid to prevent it from being used multiple times The configuration uses the established DriveLock policies. You do not need a new installation to activate this functionality, the features are included in the update of version 7.9 and can easily be activated with a BitLocker Management license. Additional Improvements: Some minor fies for managing drive categories The header of a usage policy now shows the triggering drive or device Important Bug Fies: Routing works better now when unlocking agents remotely via self-service and DCC if the agents communicate with a linked DES The certificate wizard no longer overwrites an eisting encryption certificate with a certificate of the same name without notifying the user If an application is blocked, you will now see the properly configured custom user message The agent deletes security awareness content packages that are no longer used or required in rules The only time that events are considered duplicates within a time period is when both the ID and all parameters are completely identical Policy settings are copied correctly from a template even if this template was already used as a template and was changed later. All communication between the agent and the DES now requires at least TLS1.0, all older and less secure protocols are disabled Usage policies are correctly displayed for SD card readers even after restart and login 11

12 Version History 5 Known Issues This chapter contains known issues for this version of DriveLock. Familiarize yourself with the information in this chapter to avoid unnecessary effort during testing and deployment. 5.1 Installation of Management Components Using Group Policy Installing the DriveLock Management Console, the DriveLock Control Center or the DriveLock Enterprise Service by using Group Policy is not possible. Instead, use the DriveLock Installer to install these components as described in the Installation Guide. 5.2 DriveLock Device Scanner Use the Device Scanner integrated in the product in all environments where only the standard client "Root" has been set up. This applies to most customer installations. If you have a multi-client environment, you will receive an error message when viewing and saving the scan results. 5.3 Manual Updates If other policy deployment than GPO is used, on Windows 8 and higher, a manual update of the DriveLock Agent will not finish properly, if you start the DriveLock Agent.msi from the Windows Eplorer (e.g. by double clicking). Run the MSI-package from an administrative command window with msieec or use DLSetup.ee. 5.4 Self Service unlock Self Service unlock and Apple iphones If you use the Self Service wizard to unlock connected iphone devices, it will still be possible to copy pictures manually from the connected iphone after the unlock period ended. 5.5 DriveLock ios and itunes DriveLock recognizes and controls current generation Apple devices (ipod Touch, iphone, ipad etc.) For older Apple devices that are only recognized as USB drives no granular control of data transfers is available (for eample, ipod Nano). DriveLock and itunes use similar multicast DNS responders for automatic device discovery in networks. When installing both DriveLock and itunes the installation order is important: If DriveLock has not been installed yet you can install itunes at any time. DriveLock can be installed at any later time without any special considerations. If DriveLock is already installed on a computer and you later install itunes you have to run the following command on the computer before you start the itunes installation: drivelock -stopdnssd. Without this step the itunes installation will fail. After an update of the ios operating system on a device, itunes will automatically start a full synchronization between the computer and the device. This synchronization will fail if DriveLock is configured to block any of the data being synchronized (photos, music, etc.). 12

13 Known Issues 5.6 Windows Portable Devices (WPD) Locking Portable devices prevented, that some Windows Mobile Devices could be synchronized via "Windows Mobile Device Center", although the special device was released in a whitelist. Windows starting from Windows Vista and later uses a new "User-mode Driver Framework" for this kind of devices. DriveLock now includes this type of driver. The driver is deactivated on the following systems because of a malfunction in the Microsoft operating system: Windows 8 Windows 8.1 without Hotfi KB Windows 10 older than version DriveLock Disk Protection Antivirus protection software may cause the DriveLock Disk Protection installation to fail if the antivirus software quarantines files in the C:\SECURDSK folder. If this occurs please disable your antivirus protection for the duration of the Disk Protection installation and re-enable it after the installation is completed. We recommend that you configure your virus scanner with an eception for the C:\SECURDSK folder. When Installing DriveLock Disk Protection we strongly recommend that you deactivate the application control if they are active in the whitelist modus. This will prevent the blocking of programs that are necessary for the installation. On a small number of computer models the default DriveLock Disk Protection pre-boot environment configuration may not work correctly and cause the computer to become unresponsive. If this occurs turn off the computer and restart it while pressing the [Shift] key. When prompted select the option to use the 16-bit pre-boot operating environment. Hibernation will not work while a disk is encrypted or decrypted. After complete encryption or decryption windows has to be restarted once to make hibernate work again. UEFI mode Not all hardware vendors implement the complete UEFI functionality. We recommend not to use the UEFI mode with UEFI versions less than The full functionality of the Pre-Boot-Authentication (PBA) for UEFI is not yet available as for BIOS. Touchscreen is not supported. A hardware keyboard (USB or PS/2) is required. Mouse operation is not yet supported. Some PS/2 keyboards may work improperly. The PBA GUI is only available in English. Additional topics: Secure Boot must be deactivated up to version DriveLock and higher supports UEFI secure boot. If you update the firmware, the NVRAM variables on the mainboard that DriveLock requires may be deleted. We strongly recommend that you install the firmware updates for the mainboard /UEFI before installing DriveLock PBA / FDE ( this also applies to recently purchased devices or to bug fies). A 32 bit Windows operating system or 32 bit DriveLock cannot be installed on 64 bit capable hardware. Please use a 64 bit version of a Windows operating system and DriveLock instead. There is still a limitation to disks up to a maimum of 2 TB disk size. 13

14 Known Issues On some HP PCs Windows always will be set to position one again in the UEFI boot order and the DriveLock PBA has to be selected manually from the UEFI boot menu. In this case fast boot has to be switched off in UEFI to keep the DriveLock PBA at position one. Windows 10 Version 1703 (Creators Update) can remove the DriveLock boot entry from the UEFI boot menu while shutting down or when hibernating. Therefore the DriveLock PBA will no longer boot at the net startup and Windows cannot boot from the encrypted system hard disk. In August 2017 Microsoft released Update KB which resolves this issue. Update KB will be installed automatically by Windows or can be downloaded manually. Check if update KB or any later update that replaces KB is installed before you install DriveLock Disk Protection for UEFI. When upgrading to Windows 10 Version 1703 where DriveLock Disk Protection for UEFI is already installed, add update KB to the Creators Update before you upgrade. Due to an issue in Windows 10 Version 1709 and newer, DriveLock Disk Protection for BIOS cannot identify the correct disk if more than one hard disk is connected to the system. Therefore Disk Protection for BIOS is not yet released for Windows systems with more than one hard disk attached until Microsoft provides a fi for this issue. 5.8 DriveLock File Protection and Microsoft OneDrive Microsoft OneDrive With Microsoft OneDrive, Microsoft Office may synchronize directly with OneDrive instead of writing the file to the local folder first. Then the DriveLock encryption driver is not involved and the Office files will not be encrypted in the Cloud. To switch off the Office synchronization, uncheck Use Office 2016 to sync Office files that I open or similar settings in OneDrive. It must be assured, that Office files as other files always are stored locally. NetApp We currently investigate an incompatibility between the DriveLock encryption file filter and NetApp SAN solutions. Before using File Protection in such system environment, please check and test the required functionality. 5.9 BitLocker Management Supported Windows editions and versions DriveLock BitLocker Management is supported on: Windows 7 SP1 Enterprise and Ultimate, 64-Bit, TPM-Chip is required Windows 8.1 Pro and Enterprise, 32/64-bit Windows 10 Pro and Enterprise, 32/64-bit Your environment already includes BitLocker encrypted computers To manage an eisting system environment that already includes computers encrypted with BitLocker, make sure to decrypt them beforehand using the eisting BitLocker Management or Group Policy. After that, you can use DriveLock BitLocker Management to manage your computers and securely store and utilize the recovery information. 14

15 Known Issues Upcoming DriveLock versions are epected to support management of systems that have already been encrypted with BitLocker without prior decryption. Password compleity requirements With DriveLock BitLocker Management, the misleading differentiation between PINs, passphrases and passwords is simplified by using only the term "password". In addition, this password is automatically applied in the correct BitLocker format, either as a PIN or as a passphrase. Due to the fact that Microsoft has different requirements for the compleity of PIN and passphrase, the following restrictions apply to the password:: minimum: 8 characters maimum: 20 characters Encrypting etended disks By mistake, the user note that appears when encrypting the hard disks indicates that only the system partition C: is encrypted, even though other drives are also encrypted if configured accordingly. Microsoft BitLocker limitations prevent eternal hard drives (data disks) from being encrypted if you have selected "TPM only (no password)" mode, because BitLocker epects you to enter a password (so called BitLocker passphrase) for these etended drives. Group policy configuration Because of a technical restriction, you cannot set computer-specific passwords via the DriveLock Control Center if you have distributed the DriveLock BitLocker configuration to the agents via group policies. In this case, the DriveLock 7.9 agent ignores the necessary computer-specific policies Antivirus Antivirus generally Since DriveLock 7.8, the on-demand scanner (Cyren) will not be included any more. Customers with a valid Avira license/subscription can use the Avira scanner to scan eternal drives, until the subscription terminates. Avira Antivirus Since DriveLock 7.9 Avira is no longer supported. 15

16 Known Issues 6 Test Installation and Upgrade 6.1 DriveLock Evaluation You can install the DriveLock - the Agent, the Management Console, the Control Center, the Enterprise Service and Microsoft SQL Epress - on the same computer. This topology makes it easy to evaluate DriveLock s central reporting features using minimal hardware. On our website you can find a Quick Start Guide that guides you through the initial installation. This guide also shows you how to create a test installation and set up the initial configuration with the help of the Quick Start Wizard. If you downloaded the DriveLock software from the Web site ( a 30-day trial license is included. To evaluate DriveLock on a single computer, you don t need to perform any license configuration. If you install the DriveLock Agent on multiple client computers and configure DriveLock settings using Microsoft Group Policy, a Centrally Stored Policy or a configuration file or if you want to tests the Disk Protection too, you have to add a license key to the configuration. You can use the evaluation license key that is installed with DriveLock Management Console (by default, C:\Program Files\CenterTools\DriveLock MMC\Tools\AgentTrial.lic). When using the quick start wizard, this license is imported in the generated policy automatically. 6.2 Updating DriveLock Components General Issues The DriveLock Installation Guide describes all necessary steps required to update the components. In addition theses release notes may contain additional information. The DMC and the DCC will be installed in separate directories to avoid side effects when updating these components automatically. The DriveLock Control Center uses some components of the DriveLock Management Console for remote maintenance. Both components must each have the same version number, which must also match the version of the installed DES Updating DriveLock Disk Protection After the DriveLock Agent has been updated, an eisting DriveLock FDE installation will be updated automatically and without re-encryption to the most current version. After updating the FDE components, a reboot may be required. For further information on updating DriveLock Disk Protection or updating the operating system where DriveLock Disk Protection is already installed, see our separate document available for download from our website 16

17 Release Notes Die in diesen Unterlagen enthaltenen Angaben und Daten, einschließlich URLs und anderen Verweisen auf Internetwebsites, können ohne vorherige Ankündigung geändert werden. Die in den Beispielen verwendeten Firmen, Organisationen, Produkte, Personen und Ereignisse sind frei erfunden. Jede Ähnlichkeit mit bestehenden Firmen, Organisationen, Produkten, Personen oder Ereignissen ist rein zufällig. Die Verantwortung für die Beachtung aller geltenden Urheberrechte liegt allein beim Benutzer. Unabhängig von der Anwendbarkeit der entsprechenden Urheberrechtsgesetze darf ohne ausdrückliche schriftliche Erlaubnis der DriveLock SE kein Teil dieser Unterlagen für irgendwelche Zwecke vervielfältigt oder übertragen werden, unabhängig davon, auf welche Art und Weise oder mit welchen Mitteln, elektronisch oder mechanisch, dies geschieht. Es ist möglich, dass DriveLock SE Rechte an Patenten bzw. angemeldeten Patenten, an Marken, Urheberrechten oder sonstigem geistigen Eigentum besitzt, die sich auf den fachlichen Inhalt dieses Dokuments beziehen. Das Bereitstellen dieses Dokuments gibt Ihnen jedoch keinen Anspruch auf diese Patente, Marken, Urheberrechte oder auf sonstiges geistiges Eigentum, es sei denn, dies wird ausdrücklich in den schriftlichen Lizenzverträgen von DriveLock SE eingeräumt. Weitere in diesem Dokument aufgeführte tatsächliche Produktund Firmennamen können geschützte Marken ihrer jeweiligen Inhaber sein. Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the eample companies, organizations, products, domain names, addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. DriveLock and others are either registered trademarks or trademarks of DriveLock SE or its subsidiaries in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.