Documentation for Configuration of BeCrypt Removable Media Encryption

Transcription

1 Documentation for Configuration of BeCrypt Removable Media Encryption Laptop Configuration Procedure and Details. Laptops were to be configured with BeCrypt encryption application in such a manner that allows the users to save work/data to USB drive only. This was achieved by using BeCrypt in conjunction with Microsoft Steady State ; this utility is used to restrict user access in the desired manner. Steady State is configurable via the XP User administrator account. Partition Magic was used to create a partition to facilitate key export/import (and image storage if necessary) for users. (BeCrypt needs access to keys to import). See note below:- It was necessary to create a partition to export the key to so that the Becrypt utility could access the key to then import it. It was found that this couldn t be achieved by saving said key to the C: drive or a share(on the C: drive) that could be mapped to a drive, it was thought that Steady State prevented this by applying restrictions necessary to lock down the laptop. Appropriate NTFS permissions can then be applied to the partition or folder/files therein. XP User has full permissions to the X drive (XP User only), the IAF User should have/has read only access. Currently keys that are active on the D610 image are exported/saved to Stuart s system on root of C: in a directory called Encryption Keys. Install Partition Magic and configure as necessary before installing Becrypt or Steady State. (Remember to untick use simple file sharing to get access to the permissions. Place Social Work Word Templates in Word Templates directory, in this instance it is C:\Documents and Settings\IAF User\Application Data\Microsoft\Templates and C:\Documents and Settings\XP User\Application Data\Microsoft\Templates.Templates can be found in J:\Technicians\Social Work Encryption Back Up Files and Documents\Templates\Social Work Templates. Users will access the templates from within Word new>. Create XP User and IAF User with robust passwords. Install and configure Steady State as required. Configure logon message (how-to in Technicians dir on network) Install BeCrypt Removable Media Encryption and reboot PC. Log in as an Administrator (XP User) For future reference the IAF User password Open up DISK Protect Management Tool. Note: Contact Mary Timpany for passwords.

2 Right click on the XP User and select Add Key

3 Ensure that Generate a random key is selected and that a suitably indicative name is given to the Key Description. For our purposes we have named the key description as swencryptionkey. Select Generate Key, which will invoke the key generation procedure. You will notice the text next to Generate Key states Key successfully generated Select OK Key Recovery option is presented

4 The Recovery File name should again be indicatively named and for our purposes we have called it swencryptionkey_recoveryfile. Select Save As and save to an intermediate location i.e. memory stick. Select OK IMMEDIATELY (well relatively quickly) COPY THIS KEY TO THE CENTRAL ADMINISTRATIVE LOCATION. TYPICALLY AN ADMINISTRATOR S PC. The above dialogue will appear showing that the encryption key has been generated and successfully imported and saved. Select OK.

5 On returning to the opening screen you will notice that the swencryptionkey is now a valid key for the XP User. Notice that there is an option here to Disable Removable Media Encryption. This is self-explanatory. Only available to the administrator. IT SHOULD BE NOTED THAT ANY USB DEVICE (IPOD, OTHER MEMORY DEVICES ETC) PLUGGED INTO THIS DEVICE WHEN LOGGED IN AS THIS USER AND ENCRYPTION IS ENABLED WILL AUTOMATICALLY HAVE ALL THE DATA ON THIS DEVICE ENCRYPTED MAKING IT UNUSABLE AND RECOVERABLE. Exporting and Importing Key/s We now require to export the key that we have generated as XP User to make it available to a group of users (IAF Users). This will then be imported per user. Invoke the Becrypt application. On the DISK Protect Management Tool screen right click on the swencryptionkey and select export keys.

6 You will see the above screen. Enter the XP User s password Enter the password to secure the exported keys. Select Export Keys. Select an area to Save To where it can be accessed by the intended recipients (A safe accessible location. For our purposes we named the key swencryptionkey and saved it to the root of C:) The above screen should appear. Importing Previously Saved Keys After rebooting and logging in as IAF User, open up the DISK Protect Management Tool either from START/Programs or by double clicking the padlock icon in the system tray (next to the time).

7 Right click on IAF User and select Add Key. From the screen select Import a key or keys from a key file. Select Browse and navigate to where the key was previously saved. Input the password for the key file, established earlier. Select OK and you should see a 1 media key(s) successfully imported. After inputting the key for a given user, if it s not already, remove the USB stick and re-insert. You will then be prompted for the key to be used to encrypt the device. From the pull down for our purposes this was: swencryptionkey. This was the key we exported earlier. It was observed that when a key is imported the key name is modified (prepended) with a prefix, in this instance it was FFFE, this is normal. After selecting the key to encrypt data for the user you will be prompted to format the USB drive. This is normal and should be done. The USB device is now encrypted and data will not be visible on another PC unless equipped with the same key. The administrator will now have the key also and will be able to un-encrypt the data on the memory stick and manipulate it as required

8 Recovery Console ****Remove the Disk Protection on the laptop so that changes can be saved.**** Install the Recovery Console component of BeCrypt on the Administrators PC/System and ensure that the.brf file for that key is on on that Administrator s PC/System (this can be copied over from AN Other System). When the IAF User logs in they will be asked to type in their Windows password and then be given a challenge code. On the admin PC run Recovery Console and in Recovery Console Tab select new and set up a new recovery database. Then select Import and point to the.brf file. Then select Password Recovery, this will ask for the last 6 digits of the Challenge Code from the laptop. After adding the digits press the response button. This will generate a response code enquiry on the laptop, re-apply the disk protection once finished. Procedure when new/non encrypted USB Device is inserted. User will get prompt asking for key to be used to encrypt device. Select the socialwork key (actual name may differ slightly, ie; may be prepended by hex characters) User will also be prompted by the dialog below, select start, this is normal.

9 Format confirmation. Settings For Windows Steady State (For BeCrypt Encryption) The following are settings for Windows Steady State for the Social Work laptops. There is an image available for this.

10

11

12 On the above screen place a tick in the Hide Drives section in Local Disk (C:).

13

14

15