New in this Release...3 New in Pointsec Media Encryption New in this Release of Pointsec Media Encryption - MI Client...4

Size: px

Start display at page:

Download "New in this Release...3 New in Pointsec Media Encryption New in this Release of Pointsec Media Encryption - MI Client...4"

Kathlyn Jenkins
5 years ago
Views:

1 Release Notes Pointsec Media Encryption - MI Client 2.6 Version B Copyright Pointsec Mobile Technologies AB, 2007, a Check Point Software Techonologies Ltd. company. For full documentation, please see the Pointsec Media Encryption - MI Client Installation Guide, Pointsec Media Encryption - MI Client Administrator s Guide and the Pointsec Media Encryption User s Guide. Contents About this Document...3 About Pointsec Media Encryption - MI Client...3 New in this Release...3 New in Pointsec Media Encryption New in this Release of Pointsec Media Encryption - MI Client...4 Fixed in this Release...4 Fixed Issues in Pointsec Media Encryption Fixed Issues in this Release of Pointsec Media Encryption - MI Client...5 ed Media...6 System Requirements...6 Disk and Memory Space...6 Operating Systems and Software...7 Folder and Registry Permissions...7 Communication Shares and Folders...7 Installation Folder...7 Application Data Folder...7 Registry...8 General Recommendations...9 Compatibility between Releases...9 Upgrade Not ed...9 Encryption...9 Compatibility with Other Programs and GINAs...9 Pointsec for PC...9 Pointsec for PC and Recovery Floppies...10 Removing Pointsec for PC...10 Single Sign On with Pointsec for PC Requirements...10 No extra protection with PME for local folders if SSO used...10 About SSO

2 Symantec...11 WinShare...11 About Anti-Virus Interoperability:...11 McAfee HIPS...11 GINAs...12 Proventia Desktop...12 Microsoft EFS PME Interaction...12 Advanced NTFS Feature...12 Known Issues in this Release...13 Known Issues in Pointsec Media Encryption Late-breaking Documentation

3 About this Document Release Notes This document contains information such as system requirements about the MI Client version of Pointsec Media Encryption 2.6. In this document, the abbreviation N/A (Not Applicable) is used. About Pointsec Media Encryption - MI Client Pointsec Media Encryption enables encryption of sensitive information on both removable media and in local folders on the user s workstation. Pointsec Media Encryption can also be used to create encrypted packages for communication by e- mail, and standards-compliant secure deletion of files. Pointsec Media Encryption - MI Client uses the Pointsec Management Infrastructure (MI) to deploy Pointsec Media Encryption on end-users workstations. In this release of Pointsec Media Encryption - MI Client, Pointsec Media Encryption version 2.6 is included. New in this Release This section contains one sub-section describing news in the Pointsec Media Encryption software used on the end-users workstations, and one sub-section describing news issues in the Pointsec Media Encryption - MI Client software used by administrators to manage Pointsec Media Encryption. New in Pointsec Media Encryption 2.6 In the 2.6 version of Pointsec Media Encryption, you can: Mark individual files, extensions and folders on removable media/devices for encryption through inclusion and exclusion lists Set removable media/devices for automatic initialization of encryption Set a corporate password, so that all workstations installed with the same PME profile will automatically encrypt and decrypt when using removable media/devices Set sharing passwords, so that multiple users/workstations (that are not set up with a corporate password see previous item) can access information on removable media/devices Encrypt all of the following: floppy disks, CDs/DVDs, Firewire/USBconnected external hard drives Separate external Firewire/USB-connected hard drives Set authentication delay for removable media/devices Set logging to include actions on removable media/devices The pme.exe file is re-created on removable media/devices if removed by user Restrict debug log size Recreate recovery files on shares 3

4 Access backed up media key files New in this Release of Pointsec Media Encryption - MI Client This section describes what is new in this MI Client version of Pointsec Media Encryption. For information on new features of Pointsec Media Encryption 2.6, such as new settings etc., see New in Pointsec Media Encryption 2.6 on page 3. In this version of Pointsec Media Encryption - MI Client, this is new: When deploying Pointsec Media Encryption - MI Client, you now create a package in the same way as when deploying Pointsec for PC - MI Client. Fixed in this Release This section contains one sub-section describing the fixed issues in the Pointsec Media Encryption software used on the end-users workstations, and one sub-section describing fixed issues in the Pointsec Media Encryption - MI Client software used by administrators to manage Pointsec Media Encryption. Fixed Issues in Pointsec Media Encryption 2.6 The following issues have been fixed and verified in Pointsec Media Encryption 2.6: Short Description Description/Info 647/ pme.exe did not work with large files pme.exe did not work with files larger than 2GB. 645/ / / / / 8420 Misspelling Blue screen Package encrypted twice Empty folders not included Not able to enter password Misspelling at Worksation Keys dialog A blue screen occurred upon the deletion of a shortcut in the network share. On CDs, encrypted packages were encrypted twice. If a folder was empty, it was not included in an encrypted package. A password could not be entered for a floppy disk when RM encryption was set to No. 4

5 Short Description Description/Info 623/ 8141 Proper media type Detect proper media type even if the media is on USB I/F device. 621/ 8172 Authentication method Authentication method could not be changed at upgrade/reinstall. 504 Issue with packages encrypted with 3DES 497 Cosmetic error with Remote Help and non-writable removable media Packages encrypted with the 3DES algorithm could not be decrypted. Workaround: Use Blowfish or AES. After successfully providing one-time access to removable media, the following message was displayed: User Key was successfully recovered. New Password applied, however no new password was applied. 449/ / 3701 Media timeout Delayed logon after installing PME Media timeout did not work properly. Logon was delayed after installation of PME. Fixed Issues in this Release of Pointsec Media Encryption - MI Client This section describes what is new in this MI Client version of Pointsec Media Encryption. For information on new features of Pointsec Media Encryption 2.6, such as new settings etc., see Fixed Issues in Pointsec Media Encryption 2.6 on page 4. The following issues have been fixed and verified in this MI Client version of Pointsec Media Encryption: Short Description Description/Info 7670 Install process remained in install pending state if no license number Previously, if no license number had been entered for Pointsec Media Encryption - MI Client, the installation was not properly interrupted but remained in install pending state. This has been solved in this release. 5

6 ed Media The following media are supported in this release, and can be encrypted using Pointsec Media Encryption: Media All media which are recognized by Windows as of type Removable disk, and have file system FAT, FAT32 or NTFS Comment Right-click on the volume and choose Properties to see the disk type and file system. 3½-inch floppy disks CD-R, CD-RW DVD, DVD-RW USB storage units which appear as local drives in Windows Firewire-connected external hard drive Use Pointsec Media Encryption to create encrypted.iso images and then burn to CD/DVD, or choose to encrypt entire CD while burning. When first saving or copying a file to the USB storage unit or Firewire-connected external hard drive, you set a Pointsec Media Encryption password. After that, all information that you save on the unit or drive is encrypted. System Requirements The following sections describe operating system and memory and disk space requirements and limitations. Note: Unless otherwise noted, the requirements apply to the end-user s workstation where Pointsec Media Encryption is used to encrypt sensitive information. Disk and Memory Space Component: Pointsec Media Encryption on users workstations Space required: 20 MB 6

7 Operating Systems and Software On the: User s PC Operating system and software Windows 2000 Professional with SP 4 or Windows XP Professional For Pointsec Media Encryption and Pointsec for PC on the same workstation: pssogina.dll must be the active GINA pmegina.dll must be included in the list of GINAs compatible with Pointsec for PC. This list is stored in the registry. For Pointsec Media Encryption only on the workstation: pmegina.dll must be the active GINA. Certificates for CAPI authentication Administrator s PC Pointsec Management Infrastructure (MI) For system requirements, please see the Pointsec MI Release Notes. Folder and Registry Permissions Communication Shares and Folders Installation Folder The logged-on user account must have the following permissions for the default Pointsec Media Encryption program directory: Read, Execute - set by default List Folder Content - set by default Read - set by default Application Data Folder For subfolders of the Pointsec Media Encryption Application data folder ( Documents and Settings\All Users\Application Data\Pointsec\Pointsec Media Encryption in English versions of Windows), the Users group or at least the logged-on user account must have the following NTFS permissions: Read, Execute - set by default List Folder Content - set by default Read - set by default Write - set by default 7

8 The Local System account must have the following permission: Release Notes Full Control - set by default Note: In addition to the permissions set for Auth subfolder, the *.psk and *.bin files it contains also require Write permissions for the Users group or at least for logged-on user account this is added by the product. In PME s CAPI mode, for subfolders of Documents and Settings\Logged-on Username\Application Data\Pointsec\Pointsec Media Encryption (in English versions of Windows) the logged-on user account must have the following NTFS permission: Full Control - set by default Registry For the key HKEY_LOCAL_MACHINE\SOFTWARE\Pointsec Mobile Tech\Pointsec Media Encryption, the Users group or at least the logged-on user account must have the following permissions: Read - set by default The Local System account must have the following permissions: Full Control - set by default Read - set by default For the key HKEY_CURRENT_USER\SOFTWARE\Pointsec Mobile Tech\Pointsec Media Encryption, the logged-on user account must have the following permissions: Full Control - set by default Read - set by default The Local System account must have the following permissions: Full Control - set by default Read - set by default 8

9 General Recommendations We strongly recommend the following: Always follow the documented procedures for installing and upgrading Pointsec Media Encryption. When installing or removing programs on workstations with a system drive encrypted by PME, authenticate yourself to PME before starting the installation or removal. Always back up data on workstations and memory cards before installing, upgrading or removing Pointsec Media Encryption - MI Client. During initial encryption of files or final decryption of files added to or removed from the Protected list, do not try to access the files while Pointsec Media Encryption - MI Client is encrypting or decrypting them. When deleting files in protected folders, use Pointsec Media Encryption s secure delete function. Otherwise, files may be stored unencrypted in the Recycle Bin. Compatibility between Releases Upgrade Not ed In this version of Pointsec Media Encryption - MI Client, upgrade from previous versions is not supported. Encryption Files encrypted using Pointsec Media Encryption 2.0 are compatible with later versions of Pointsec Media Encryption, starting with 2.0 SR 1 Enterprise Edition. Compatibility with Other Programs and GINAs Pointsec for PC Pointsec Media Encryption is compatible with the following versions of Pointsec for PC. Pointsec for PC Version Service release numbers where applicable and later and later 5.x Service releases do not apply to 5.x versions 6.x Service releases do not apply to 6.x versions Note! Pointsec for PC version 4.3 is NOT supported. 9

10 Pointsec for PC and Recovery Floppies To create recovery information on floppy disks, you will need to use a PC that does not have Pointsec Media Encryption with floppy protection activated. Removing Pointsec for PC It is now possible to remove Pointsec for PC while Pointsec Media Encryption is still installed. However, if the securely generated random password for SSO was in use when removing Pointsec for PC, the user will be forced to use Remote Help to set a password for Pointsec Media Encryption. Single Sign On with Pointsec for PC Requirements If Pointsec Media Encryption is installed before Pointsec for PC, Single Sign-On (SSO) will only work properly if you manually insert the string value CompatibleGinas=pmegina.dll into Windows registry. This action does not have to be taken if Pointsec Media Encryption is installed after Pointsec for PC. Also, in order for SSO to work with Pointsec for PC, there must be at least one encrypted volume on the workstation. If boot protection only is enabled, SSO will not work. No extra protection with PME for local folders if SSO used Please note that encrypting local folders when Pointsec for PC is installed and encrypting the disk, encrypting them with Pointsec Media Encryption provides no extra protection if Single Sign On is used. Please contact Pointsec support for assistance if needed. 10

11 About SSO Pointsec Media Encryption SSO implementation uses a securely generated random password. Depending on how Pointsec Media Encryption SSO is configured at time of installation, the user may be prompted to set a password if SSO is turned "Off" at a later time. For example, if SSO setting is "On" at time of installation and later turned "Off", the user will be prompted to set a PME password. If Pointsec for PC is removed while the securely generated random password is in use, the user will be forced to use Remote Help to set a PME password. Symantec Add to exclusion list manually In this version, the administrator must add Symantec to the exclusion list manually. Add the following to the Exclude Folders list: C:\Program Files\Common Files\Symantec Shared\ C:\Program Files\Symantec AntiVirus\ C:\Program Files\Symantec\ C:\Documents and Settings\All Users\Application Data\Symantec\ Add the following to the Exclude Files list: *.log Note: these settings assume that Symantec is version 9.x and is installed in C:\Program Files. Virus scan delay Symantec does not start scanning for viruses instantly when the system drive is encrypted. The scan process begins after 2-4 minutes. WinShare Please see number 258 under Known Issues in this Release. About Anti-Virus Interoperability: If an infected file is encrypted and an anti-virus on-access or real-time scan is in force, it will take 1-2 minutes to decrypt the folder where this file is located. This may look like the system has frozen, but after a delay, decryption will finish successfully. McAfee HIPS This version does not support interoperability with current version(s) of McAfee HIPS. However, the upcoming 6.1 release of McAfee HIPS will resolve this. 11

12 GINAs Currently, we recommend that you do not allow the following GINAs when creating installation sets and update profiles: WinShare - wsgina. Unicenter Remote Control 5.2 -logonrem.dll Proventia Desktop If Proventia Desktop is used, disable the Prevent Unauthorized Changes to Agent Files setting. Microsoft EFS PME Interaction If a file is encrypted by PME, attempting to encrypt it using EFS fails access is denied. If a file is encrypted by EFS, PME will not encrypt it. No error message is displayed. No information is lost. The only result is the addition of some temporary files of 0 bytes in size in the folder where the file is located. Advanced NTFS Feature Pointsec Media Encryption does not support volumes that do not have assigned drive letters, or the mounting of an external HD, removable media, CD or floppy as a folder. Pointsec Media Encryption supports Volume Mount Points, provided that the Mount Point is a folder on a volume which has an assigned drive letter. Volume Mount Points are not treated like ordinary folders, but rather as an alternate naming convention for volumes (in addition to drive letters). Thus, to be able to manage files on a volume mounted to a folder on another volume, you must explicitly add an entry beginning with the Mount Point Name to the Protected or Excluded list. Example: You have C:\dir1\SomeMountPoint. The recursive mask C:\* in the Protected list does not dictate that files on the C:\dir1\SomeMountPoint volume will be encrypted. To allow for the encryption of these files, you must explicitly add a second mask so that the Protected list will now contain the following entries: C:\*, recursive C:\dir1\SomeMountPoint\*, recursive 12

13 Known Issues in this Release This section contains one sub-section describing the known issues in the Pointsec Media Encryption software used on the end-users workstations, and one sub-section describing known issues in the Pointsec Media Encryption - MI Client software used by administrators to manage Pointsec Media Encryption. Known Issues in Pointsec Media Encryption 2.6 The following are known issues in the 2.6 release of Pointsec Media Encryption: Short Description Description/Info N/A Managing keys in read-only media If media is read only, the Manage Keys dialog cannot be opened using the password but can instead be opened using Remote Help or Web Remote Help. 748 Progress indicator not sensitive to local setting 726 Indicator not shown properly 724 Logon cancellation gives error message 723 No Certificate Select option The progress indicator is not sensitive to the PME local setting. The encryption progress indicator is sometimes not shown properly. The cancellation of PME logon after new certificate selection results in an error message. The first logon after PME installation does not display the Certificate Select option. 715 PME Utility Error pme.exe does not decrypt files from folders located at a level below the fourth level. 706 PME.exe fails an when target disk is full Exception in PME.exe when target disk is full 646/ 9343 System crash when using basic script file on remote machine The system crashes when basic script is used on a remote machine. 637 Cosmetic error in File menu The word "Encryption" appears multiple times in the File drop-down menu if the menu is invoked multiple times. Workaround: Press F5 603/ 7338 Encryption context menu not available on non-mapped shares The Encryption context menu isnot available on nonmapped shares. 454 Upgrade of PME plug-in 384 Secure Delete cannot delete folders In versions 2.3 and earlier, after upgrading PME in Pointsec Administration Console an entry for the previous version remains in Windows Add/Remove Program list. You cannot use the PME Secure Delete function to delete folders. 13

14 377 Japanese symbols are not supported in packages on English Windows XP 340 PME authentication dialog box not opening If you create an encrypted package on a Japanese system containing file names or/and paths with Japanese symbols, the package will not be correctly extracted on an English system even if support for Asian languages is installed on the system. PME requires user accounts to be in the Users group list directly or indirectly. If you log on with a user account which is not in the "Users" group of "Local Users and Groups" you will not have permission to access the PME system component. This may happen if you delete built-in NT AUTHORITY\Authenticated Users and NT AUTHORITY\INTERACTIVE accounts from the Users group or use, for example, the Guest account or other account without authentication. Workaround: Ensure that the account you want to log on with is listed in the Users group. 313 Certificates from Windows 2000 cannot be decrypted in Windows XP This happens when accessing files with a valid certificate in Windows XP if the information was protected on a workstation running Windows Reproduced using Microsoft PKI. On Entrust PKI, everything works without any problem. Workaround: Do not use certificate authentication if PME is running on Windows 2000 when the information is protected and you want to access the information on a workstation running Windows XP. 258 WinShare and Pointsec Media Encryption compatibility problem If WinShare is installed before Pointsec Media Encryption, an error message will be displayed, saying that the 3 rd - party GINA failed to initiate. Known Issues in the Pointsec Media Encryption - MI Client 2.6 The following are known issues in the 2.6 release of Pointsec Media Encryption MI Client: Short Description Description/Info MI Web Remote Help for PME does not work If you log on to the MI Web Remote Help page, select the PME extension and then click on one client nothing happens. If you click on a new client, the session will be terminated and you will have to logon again. 14

15 Late-breaking Documentation The following is late-breaking documentation which will be added to the relevant guide as soon as possible: N/A Description/Info In the package decryption dialog, the button text Forgot Password has been changed to Web Remote Help. This change is not yet reflected in the Pointsec Media Encryption User s Guide or User Help. 15

Pointsec Mobile Symbian OS (S60) Revision and Device Tracking

Pointsec Mobile Symbian OS (S60) 3.3.4 Revision and Tracking Revised: October 22, 2009 This Revision and Tracking document contains information on changes and corrections implemented in previous versions