SECUDRIVE USB Office User Guide Doc Ver. 3.0.1.383 2013-02-10 Brainzsquare, Inc.
Table of Contents 1. Overview... 3 1.1 Features... 3 1.2 Product... 4 1.3 Glossary... 4 2. How to use SECUDRIVE USB Office... 5 2.1 Running the Login Program Manually... 5 2.2 Agreeing to the End User License Agreement (EULA)... 5 2.3 Setting up the Password and Logging In... 6 2.4 User Info... 6 2.4 Auto-notification... 7 2.6 DRM Policy Management Setting... 7 2.7 Setup Complete... 8 2.8 Features of USB Office... 8 2.9 Login... 9 2.10 How to Use the Vaccine Program... 10 2.11 SECUDRIVE USB CAD Menu... 12 2.12 USB Settings Tab... 14 2.13 DRM Settings Tab... 18 2.14 Unlocking the USB Flash Drive... 26 2.15 Running the Product with Administrator Privileges in Windows Vista / 7... 27 3. How to uninstall SECUDRIVE Agent... 28 2
1. Overview Portable USB drives are very efficient tools for carrying data. Data saved on the USB drive however, is vulnerable to being copied to the local PC or other removable storage devices by unauthorized personnel. SECUDRIVE USB Office is a secure USB flash drive equipped with Digital Rights Management (DRM) technology in order to avoid this problem. Copying, copy & paste, clipboard copy, screen capture, and even printing are all prevented for the data stored on the USB. All of the saved data is automatically encrypted by the embedded AES 256-bit crypto chip. Detailed event logs are also gathered for further management and auditing purposes. Features 1.1 Login: To use the USB flash drive, a user must login by inputting the correct password.a user without the correct password will not be able to access the data in the device. The device will be locked and made unavailable after ten consecutive failed password attempts. So even if the USB flash drive is lost, data will be protected from unauthorized personnel. Prevent Copy & Paste: Data stored in the USB flash drive is prevented from being copied to the local disk or other removable disks. Prevent Save As: Saving a file that is originally stored in SECUDRIVE USB Office to a local PC with another name by using the Save As function is blocked. Prevent clipboard copy & paste: Data stored in the device is prevented from being copied using clipboard copy & paste, meaning that the user cannot copy data to a clipboard and paste it in a location outside of the USB or to another application. Clipboard copying is allowed within the same application as to not hinder work efficiency, but the location where the content is copied will now be copy protected and will have to be saved to the USB. Print protection and watermark printing: Data stored in the USB flash drive can be restricted from printing or allowed to perform watermark printing instead. Screen capture prevention: Attempts to capture the screen with capture tools and the print screen key are blocked and will instead show a green screen in their recording or a message saying that the print screen key cannot be used. Prevent file transfer over the network: Data stored in the device is prevented from being 3
transferred over the network through email attachments or messengers. Sett a valid period and maximum usage: The USB flash drive can be set to only work until a specified date or a maximum number of logins. Once it exceeds one of the limits, the user can no longer log into the device and the USB stick will no longer be available. Product SECUDRIVE USB Office flash drive 1.2 SECUDRIVE USB Office master token **The master token is an optional product and can be purchased seperately. 1.3 Glossary The terms used throughout this manual have the following meanings: USB: SECUDRIVE USB Office flash drive Administrator: Personnel in charge of setting DRM policy for the device User: End user of SECUDRIVE USB Office Policy setup PC: The designated PC where DRM policy can be set for the device. Or the PC where the master token is connected. For both cases, the product runs in administrator mode User PC: User s PC where SECUDRIVE USB Office is connected Secure zone: Secure storage area of SECUDRIVE USB Office where data is saved. A user can only access this area by executing the login program and inputting the correct password. CD area: CD drive that is shown when SECUDRIVE USB Office is connected to the PC. The CD area contains the login program for accessing the secure zone. DRM: Acronym for Digital Rights Management which is the control to restrict the user s ability to copy, screen capture, or print. 4
2. How to use SECUDRIVE USB Office 2.1 Running the Login Program Manually The license agreement or the login window will automatically be displayed when SECUDRIVE USB Office is connected to the PC. If either the license agreement or the login window does not appear, you should manually run the login program. Right click on the SECUDRIVE CD area as depicted below and select Open. Run the Login.exe to manually launch the login program. 2.2 Agreeing to the End User License Agreement (EULA) When using the product for the first time, you must agree to the terms by reading the agreement and selecting I accept the agreement and then click OK. 5
Setting up the Password and Logging In At your first use of the product, you should set up your login password to access the secure zone. The password must be more than 6 alphanumeric characters. 2.3 2.4 User Info Fill out the user information for the USB. You can choose to show this information at login by checking the check box near the bottom. Click Next to continue. This section is optional so click Next if you want to skip this section. 6
Auto-notification Choose whether or not you wish to have automatic notifications for the latest updates for USB Office. Click Next to continue. 2.5 2.6 DRM Policy Management Setting After setting the password, click OK and the DRM Policy Management window will be displayed. You can choose to make the PC able to set DRM policy or, if you purchased a master token, you can set the token for setting up DRM Policy. 7
Use this PC for DRM policy management: DRM policy setup and management is only available on the PC where the USB flash drive is currently connected to. Setup or change will not be possible on other PCs. Use Token for DRM policy management: DRM policy setup and management is available on any PC where the master token is connected. Note that on the DRM policy setup PC, copy protection features are disabled. 2.7 Setup Complete If you want to change any of these settings at a later time, right click on the SECUDRIVE icon in Windows Task bar after logging into the USB. Note that DRM Policy will only be accessible on either the designated DRM policy setup PC or when the optional token is connected. Otherwise, the DRM Policy option will not be available. Click Next to continue. 2.8 Features of USB Office To change the auto lock and DRM policy settings, right-click on the SECUDRIVE icon in the windows task bar. 8
Click Finish to proceed to login. 2.9 Login The login window will be displayed as follows: Enter the configured password and click OK to login. To execute the device in read-only mode, check Login as read-only before loggin. After 10 failed password attempts the USB flash drive is locked and no longer available. 9
The locked device can be unlocked on the policy setup PC or with the master token. When you have successfully logged in, you will see a removable disk called SECUDRIVE. This is the secure zone where the data will be stored and encrypted by the AES 256-bit crypto chip. Once logged in, the program will be displayed as an icon in the system tray as follows. How to Use the Vaccine Program 2.10 When using the product for the first time, accept the terms of the license agreement of the vaccine program and click Activate. Click Finish to complete installation. 10
Once installed, the vaccine program will initiate when the user logs into the USB flash drive and the Trend Micro icon will be displayed in the system tray. The program terminates when logging out of the USB flash drive. The vaccine program runs for 1 year from the date of agreement. After 1 year, it will stop operation. To continue Trend Micro USB Security service, the user must purchase the license update tool and extend the period. License renewal is only available less than 30 days of expiration. You will see the Restore folder and the Trend Micro folder in the secure zone of the USB flash drive. These folders are used by the vaccine program. 11
SECUDRIVE USB Office Menu Right click the tray icon and you will see the menu as follows. 2.11 Shortcut to Secure Zone: Access the secure storage area of the USB flash drive Change Password: Change the login password Auto Lock: Automatically lock the device when keyboard and mouse are not in use for a designated time. DRM Policy Settings: Set or modify DRM security policy (Copy Protection, print protection, capture protection, validity settings, etc.) Information: Either enter/edit the user information or view SECUDRIVE information. Help: Display the user guide of the product. You will need a PDF viewer on your PC to open the file. Close: Close the program and log out of the USB so you can safely disconnect the device from the PC. [Change Password] Right click on the tray icon and select Change Password. Enter both the current password and a new password and then click OK. 12
[Auto Lock] Right click on the tray icon and select Auto Lock. If keyboard and mouse are not in use for a designated time period, the user will be forcibly logged out of the USB. It is set to Never by default so select your own time period if you wish to use this feature and click OK. 13
[DRM Policy Settings] Right click on the tray icon and select DRM Policy Settings. This option will only be available on the DRM Policy Setup PC or when the master token is connected when logging in. The DRM Policy Settings window will be displayed as follows. 2.12 This window has two tabs for security policy settings: USB Settings and DRM Settings. USB Settings Tab [Secure Zone Access] Read-only: Set the USB flash drive to read-only. When logging in again after setting this option, the device works as read-only even in the policy setup PC. Read/Write: The USB drive runs in read/write mode. These settings will be applied on the next login. 14
[PIN Code Authentication] You can set a pin code for the master token. This means that in order to be able to acces the DRM Policy settings, the correct pin code must be entered when connecting the master token. Only when you select Use token for DRM policy management in the initial setup of the product, can you use the Pin Code Authentication feature. If you set Pin Code Authentication to ON, you will be prompted to set the pin code in the following window. If the master token already has a pin code, you must enter the current pin code when setting the Pin Code Authentication to ON. Next, Click Change Pin Code in order to change the current pin code. If your master token does 15
not already have a pin code Change Pin Code button will not be available. So if Pin Code Authentication is set ON, You must enter the correct pin code to be able to edit DRM Policy when you connect the USB flash drive with the master token. [User Rights ] Cannot change password: A user cannot change the password of the USB flash drive that has been configured by the administrator. When this option is checked, the Change Password option will not be displayed in the tray icon menu when logged in as a user. Cannot modify user information: A user cannot change the user information of the USB flash drive that has been configured by the administrator. When this option is checked, the User Information option will not be displayed in the tray icon menu when logged in as a user. Cannot change auto lock settings: A user cannot change the auto lock setting of the USB flash drive that has been configured by the administrator. When this option is checked, the Auto Lock option will not show in the tray icon menu when logged in as a user. [Log Collection] Latest 10,000 units: It gathers a total of 10,000 log entries. Once it exceeds the limit, older logs will be deleted and replaced with the most recent ones. Max 10,000 units: As many as 10,000 log entries will be collected. Once it exceeds the limit, the USB flash drive is forced to log out and becomes unavailable for use. To use the product again, the stored logs should be deleted on the policy setup PC. No log: No log entries will be recorded for the USB. 16
View: View the USBs stored logs. Delete : Click Delete and all of the stored logs will be deleted. [USB Validity Settings] Valid period: Set up valid period of the USB flash drive. When it exceeds the limit, the device is locked and will no longer be available. To use the product again, Valid period should be disabled or reset to a later date on the policy setup PC. Time sync with: By using this option the USB will then check the valid period based on the internet time server which provides a standard time. The connected PC must have access to the internet and be able to communicate with the internet time server. If not, the user will be either not be able to log into the USB or logged out of the USB if they are already logged in.. Maximum login: Set a maximum login count for the USB flash drive. Once it exceeds the limit, the device is locked and becomes unavailable. To use the product again, Maximum login should be disabled or reset on the policy setup PC or with the master token. 17
2.13 DRM Settings Tab Press the DRM Settings tab at the top to modify DRM policy. 18
[DRM Settings] [Apply Data Leakage prevention] Prevent copying files out of the secure zone of the USB flash drive. Note that copying functions will still work for files within the USB flash drive as to not impede on any work that needs to be done to the files. If it is set ON, the file saved in the USB flash drive is prevented from being copied out of the device using Copy &Paste, or the Save As function. Also, if a user tries save the content outside of the USB drive by copying the content of a file to the clipboard and pasting it, copying will be prevented. Please note that you will have to select at LEAST one application from the application list on the right. [Screen Capture Prevention] Prevent screen capture by capture tools or the PrintScreen Key. [Print Protection] Prevent printing of files in the USB flash drive. [Watermark Printing] This feature is only available when Print Protection is not selected. Use watermark when printing a file. Click Settings and you can set watermark options. 19
[Application List] On the right hand side of the window, there is a list of compatible applications. These applications are the only ones that can access the data on the USB. Applications outside this list will be blocked from opening or accessing the data on the USB. You must select at least one application from this list. For example, if you only select Adobe Photoshop from the Secure Process List, only Adobe Photoshop will be able to access the files in the secure zone of the USB flash drive. 20
For selected applications that can access the secure zone, network connection is blocked by default. You can make exceptions and allow network access for designated processes by changing the Allowed IP, Allowed Port, or Allowed URL. 21
After selecting an item(s) on the list, click by Allowed IP, Allowed Port, or Allowed URL to change the secure network settings as follows. No item is set (All network settings are NULL ): All network paths are blocked. Settings on IP and Port: Access is only available through the port of the registered IP. Settings on URL and Port: Access is only available through the port of the registered URL. Settings on IP only without Port: Access is available through all ports of the registered IP. Settings on URL only without Port: Access is available through all ports of the registered URL. Settings on Port only without IP or URL: Access is available through the registered port of any IP and URL. Allow entire network access: Access is available through all ports, IPs, and URLs. IP x x x x Port x x x URL x x x x Network Access status All access blocked Access available through port of designated IP Access available through port of designated URL All Ports will have access through designated IPs All Ports will have access through designated URLs All of IPs and URLs will be have access through designated port 22
Allowed IP Settings: Enable access by specified IPs. Type in the IP and click Add to add to the Allowed IP List. Allowed Port Settings: Enable access by specified Ports. Type in the Port number and click Add to add to the Allowed Port List. Allowed URL Settings: Enable access by specified URLs. Type in the URL and click Add to add to the Allowed URL List. 23
[User Information] Right click the tray icon and select Information User Information. In the window below, fill in the user information items and click OK when finished. If you have checked View user information before login, you can view user information in the login window.. 24
[About SECUDRIVE] Right click the tray icon and select Information About SECUDRIVE. You can view hardware and software information of the USB flash drive. 25
[Close] In order to log out of the USB, right click the tray icon and select Close. When you close the program, you will be logged out of the secure zone and you will be able to safely remove the USB flash drive from the PC. 2.14 Unlocking the USB Flash Drive The USB drive can be locked if an incorrect password is entered ten times consecutively. Once it is locked, it will show the following message when trying to log back into the device. When you log into the device on the policy setup PC or with the master token, the following message will be displayed. 26
Click Yes and the device will be unlocked and the login window will appear. 2.15 If the device is locked due to 10 consecutive failed login attempts, you can unlock it on the policy setup PC. If Valid period or Maximum login has exceeded the limit, you must login on the policy setup PC and disable the options in DRM Policy Settings or reset the number of maximum logins or the valide period to be able to use the product again. Running the Product with Administrator Privileges in Windows Vista / 7 When using the product as a user for the first time, the user will need to run the login program as an administrator. To do this, right click CD area of SECUDRIVE USB Office and click Open. 27
Right click on Login.exe and select Run as administrator. When you run Login.exe with administrator privileges, the SECUDRIVE Agent installation message will be displayed as follows. This agent is necessary for all SECUDRIVE USBs and needs to be installed on the PC to use the product. Click Yes to continue installation. 3. How to uninstall SECUDRIVE Agent For the installed SECUDRIVE Agent program, you can uninstall it by executing Uninstall.exe in C:\Program Files\SECUDRIVE Agent or in C:\Program Files (x86)\secudrive Agent. You can also manually uninstall it in the Windows Add/Remove Programs menu. 28