Steganos Safe Professional th June 2007

Transcription

1 Steganos Safe Professional th June 2007

2 Contents Page Introduction 4 Installation and Deployment 5 Managing and Policies 6 Recovery Using EDK 8 Setting Up Network Shares 8 Creating A Key Pair 8 System Requirements 9 Summary 10

3 Introduction Steganos is the German market leader in the area of data encryption. Safe Professional 2007 is our enterprise equivalent of the award winning Steganos Safe. This was designed to address problems that any large company will have concerns about How do you access data if the user forgets his password or - still worse has an accident? Or the contrary, how do you get a user to use secure passwords, which are really hard to remember? How can you specify who can access sensitive data and who can t? Steganos Safe Professional can contain an unlimited amount of confidential data - you can create any number of secure drives with a capacity of up to 256 GB each. In Steganos Safe Professional, AES, the world's most progressive encryption algorithm works with 256 bit long codes. Like all other Steganos encryptions this has never been cracked. Apart from the manual password entry, data can also be encrypted via USB stick or mobile phone, for example. Thus, employees do not have to remember their passwords: They only have to connect their USB stick to make the safe open automatically. If someone forgets about his password or loses a key device, the administrator can use the Emergency Decryption Key (EDK) to access the data. The password chosen originally still remains secret. The use of these features can be configured and controlled via group policies. Steganos Portable Safe turns a memory stick into a mobile safe: it can simply be decrypted on every PC*. This enables external employees to add new data very easily as soon as the USB device is removed, all information is encrypted. Alternatively, encrypted archives can be written to CD, DVD, or DVD-DL and therefore be securely transported. Naturally, this feature can be enabled and disabled for certain users via group policies. Steganos Shredder permanently destroys unwanted documents or whole folders. The Free Space Shredder removes all junk data which had been deleted just using the recycle bin from every hard drive including removable devices like USB sticks. This can be done by simply overwriting it if you want it to disappear quickly. Or, if you wish, you can use the technology employed by the US Department of Defence (DoD M/NISPOM 8-306). You should use the extremely thorough Gutmann method for your most sensitive data as it overwrites 35 times. *You need administrative privileges for installing the Steganos Live Encryption Engine to decrypt the data stored in the portable Safe.

4 1 Installation and Deployment Steganos Safe Professional consists of 2 parts. The client that sits on every PC that has access to safes, and the Admin console which provides the administration interface with which you manage the encryption keys. The Admin console should be installed on the server managing the domain. Additionally, you can install the application on the administrator s PC for managing the EDK (Emergency Decryption Keys) of the users. The client software needs to be installed on any machine that will have access to a safe. This can be set up to install in any folder you want, using the custom setup. Both the Administration component and the client are MSI packages and can be deployed via Radia using an Installshield setup. A full removal of Steganos can also be carried out if needed. Via group policies the administrator can specify by whom and how certain Safe functions can be used. The minimum password requirements can be predefined: this ensures that all users use passwords of a certain security level. The usage of key devices for storing passwords can be specified as well as the usage of the Steganos Shredder or Steganos Portable Safe. In addition, the Emergency Decryption Key functionality can be enabled during installation: Thus, an authorized person can access encrypted data at any time if the key gets lost without having to reveal the password of the safe concerned. Secure drives can be created not only on individual clients but also on the network. This means that several users can access data in a shared safe simultaneously*. *The first user connecting to the secure drive has read/write access. All other users have read access.

5 2 Managing and Policies Using the Group Policy Editor of Windows Server and Active Directory, you can specify various policies for creating, using and maintaining a secure drive on the user's computer as well as define the options of the File and Free Space Shredder. Here is a sample of some of the polices that can be configured for the user. Password policies This policy specifies the properties of passwords that may be specified by the users. Use key devices You have the option to store the passwords of secure drives on an ActiveSync-enabled device (e.g. USB stick, mobile phone, etc) and to use this device for opening the safe. Using this option, you can force users to implement this feature or prevent them from using it - or you can leave this decision up to them. Minimum password length Using this option, you specify the minimum password length for secure drives. Passwords must contain numbers Enable this option if you want to enforce the usage of numbers in passwords for secure drives. Passwords must contain capital letters Enable this option if you want to enforce the usage of capital letters in passwords for secure drives. Passwords must contain lower case letters Enable this option if you want to enforce the usage of lower case letters in passwords for secure drives. Passwords must contain special characters Enable this option if you want to enforce the usage of special characters in passwords for secure drives. Emergency Decryption Key

6 Enable this policy to use the EDK Manager. This policy controls the settings for the Emergency Decryption Key. Use EDK functionality With this policy you can enforce the usage of the EDK functionality or leave this decision up to the user. Location for EDK user key Enter the path to the share containing the EDK user key. T:\ if you connected the share as a drive. \\Servername\userkeys in order to access the server directly. Predefine secure drive This policy can be used to predefine a secure drive. The secure drive will then be displayed in the user's list of secure drives. Display name of secure drive Using this option you can specify the name of the secure drive to be displayed in the client software. Size of secure drive in MB This setting determines the size of the secure drive in MB. Drive letter of open secure drive Use this option to specify the drive letter to be used by the secure drive after it is opened. Disable the 'Store Portable Safe on a CD or DVD' option This setting controls whether the user may start Steganos Portable Safe to create secure drives on CD/DVD. While this policy is enabled, the user cannot use this feature. Disable the 'Store Portable Safe on a CD or DVD' option This setting controls whether the user may start Steganos Portable Safe to create secure drives on rewriteable disks. While this policy is enabled, the user cannot use this feature. Disable the 'File shredder' option

7 This policy controls whether the user can start the Steganos Shredder to destroy files. While this policy is enabled, Steganos Shredder cannot be used by the user. Disable the 'File shredder' option This policy controls whether the user can start the deep cleaning feature to clean unused sections of the hard disk. While this policy is enabled, the user cannot use this feature. Data destruction settings Here you can choose the method of data shredding. Data destruction settings 1. Gutmann method (overwrite file 35 times) 2. Multiple overwriting (overwrite file 3 times) 3. Complete overwriting (overwrite file 1 time)

8 3 Recovery using EDK An Emergency Decryption Key (EDK) is a second key with which you can open a secure drive even without knowing the password that has been chosen originally. If a user creates a secure drive or changes the password of an existing secure drive, the application generates an Emergency Decryption Key which can only be decrypted by the administrator. This key is then stored in a shared folder on the network. Using the Steganos EDK Manager, it is imported from this share into an encrypted password list only accessible to the administrator. Now the secure drive can be opened not only with the original password but also using the Emergency Decryption Key. 3.1 Setting up network shares Two shares have to be created on the network in order to ensure the security of key transactions. The first shared folder contains the public key for encrypting the EDK keys. The EDK keys themselves are stored in the second shared folder. You can choose the names of the shares freely. Share the folder for the public key using the following rights: Read-only Although the public key cannot be used to decrypt encrypted data, it must not be possible to overwrite or replace it. Share the folder for the EDK keys using the following rights: Don't overwrite existing data/folders In this way it is impossible to deliberately manipulate created keys of other users. In a domain it is recommended to create a new user group in order to facilitate share management. This ensures a more exact control of access rights and gives you the possibility of adding individual users to this group, thus minimizing future administration efforts. 3.2 Creating a key pair For encrypting the EDK key, a key pair consisting of a private and a public key must be created.

9 The public key can be used to encrypt information. This information can only be decrypted using the private key. It is not possible to use the public key for decryption. The private key remains with the administrator and is stored in the key pair list of EDK Manager. The public key is stored in the network share created in the previous section.

10 4 System Requirements For computers with Windows 2000, Windows XP Home Edition, Windows XP Professional, Windows Vista 32-Bit, Windows Server MB of space on your hard drive for installation Screen resolution of at least 800x600 pixels High colour (16 Bit) At least 32 MB of free memory 64 MB of free memory are recommended At least Pentium or comparable CPU A mouse or another Windows-compatible pointing device For Steganos Safe: Additional hard-disk space is needed for the secure drives. In order to use 256 GB per drive, you need the NTFS file system. The FAT32 file system enables a maximum capacity of 4 GB per secure drive. For Portable Safe: CD or DVD burner with corresponding software. Optional and temporary up to 8.5 GB hard-drive space for the Portable Safe package files. In order to use a Portable Safe on another computer administrator privileges are required for the installation of the decryption program. Secure drives cannot be decrypted when stored on compressed NTFS drives. Supported key devices: ActiveSync-compatible devices (e.g. SmartPhones, PDAs), all devices that are recognized by Windows as rewriteable removable media (e.g., USB sticks, memory cards, digital cameras). No key devices are included in the delivery.

11 5 Summary Steganos Safe Professional 2007 is designed to create a space (Safe), that is encrypted and holds all your sensitive data securely. This data would be stored in a cached folder, locally on a laptop and synchronised to a remote server when a network connection is present. On a desktop, there would be a permanent mapped drive to the server where the safe is stored. This product comes with Automatic Crash Protection (ACP) which will keep all your data encrypted even in the case of a power cut or system failure. This will also stop any files from becoming corrupt in these events. Some of the key features EDK (Emergency Decryption Key). If a user has forgotten his password, the administrator can still access the data using EDK. The original password remains a secret. Active directory. Easy installation, configuration and administration centrally using AD and Policies. Security guidelines. Administrative templates for the group policy editor enable the implementation of your security guidelines. You can determine password guidelines, if and how data is to be permanently destroyed, if key devices such as USB sticks can be used etc. Encrypt your Outlook Mailbox with the implemented Mailbox Encryption. Shared use of secure drives. Several authorized users receive read access to a common secure drive on the network. Any number of safes. You can create any number of secure drives, each up to 256 GB. Steganos Portable Safe. Simply take encrypted data with you on CD, DVD or USB devices. These are usable everywhere without additional software*.

12 *The Encryption Engine hast to be installed once on the computer you want to access the encrypted data.