Cryptzone Group AB (publ) The Simple Encryption Platform An Overview. Created 2011 For technical questions

Transcription

1 Cryptzone Group AB (publ) The Simple Encryption Platform An Overview Created 2011 For technical questions

2 Agenda... Simple Encryption Platform (SEP) An introduction Product presentation Technical Presentation of Secured , Secured eusb, Secured efile, and Secured ecollaboration Use cases for the Simple Encryption Platform

3 More resources.. Direct access to Crytpzone Group resource center Webinars Demos / Workshops - Whitepapers Case Studies - Solution Guides - Product Sheets - Security as a Service - Software Manuals -

4 In short..... Secured Policy-controlled encryption Secured makes it possible for the end user to send secured s and attachment to anyone directly from Outlook and Lotus Notes. The receiver can open the secured on any platform as Mac, PC, iphone, ipad, Blackberry, Symbian and Android and reply back encrypted and secured. Secured eusb Centrally managed USB encryption tool Secured eusb makes it possible to convert a regular USB flash drive into a secured USB flash drive with strong security that users can safely travel with. The central management console offers detailed content reporting about every flash drive and the ability to lock down or wipe the flash drive. Secured efile Centrally controlled file/folder security and encryption Secured efile enables collaborative access to an individual user, work groups or Active Directory OU groups. The end user to secure any file or folder and assign individual or group access rights to it. The SEP manager will control authentication and key management. The secured data can be stored anyplace within the network, including networked share drives, desktops, laptops, USB flash drives and portable media. Secured ecollaboration Microsoft SharePoint File security & encryption Secured ecollaboration is a file encryption & security add-on to your existing Microsoft SharePoint deployment. It adds functionality which allows users to encrypt documents and files right from within SharePoint but also on the users desktop, USB flash drives, portable hard drives, network drives, etc.

5 SEP Simple Encryption Platform... See a video at Client Applications Server Management Console Document Security Secured Secured efile ecollaboration Outbound Compliance Secured Endpoint Security Secured eusb Global Object Synchronization: Policies Licenses Shared Secrets Encryption Keys EPM Stealth Keys Passwords Templates Standard SQL database platform One way synchronization with directories:. Active Directory Lotus Domino LDAP Microsoft SharePoint Basic Management: Role based administration User rights management Policy design and administration Auditing and incident reporting Education management Help Desk / Lost password Recovery Intellectual Property: EPM - Enterprise Protection Method Resource/ License Management DCR - Data Content Reporting Existing infrastructure integration such as Microsoft RMS and content management solutions

6 Secured Send a secured to any recipient that can then reply back secured... See Video Send a secured from Outlook or Lotus Notes including attachments will be encrypted. Options to save the secured in Outlook and Exchange. Recipient signs up - The recipient sign up for the service and can then view the secured . Recipients can view the secured on Mac, PC, iphone, ipad, Symbian, Blackberry, Android devices, etc. Reply securely The recipient can reply securely using any application or on device such as a Mac, PC, iphone, ipad, Symbian, Blackberry, Android device. The free reader It is possible for the recipient to download a free Reader that integrates into Outlook and Lotus Notes

7 Secured eusb Lifecycle management for encrypted USB flash drives... See Video Secure any standard flash drive - End user can secure and encrypt any standard flash drive. Zero footprint, which allows IT to secure flash drives and hand them out to end users without running an application on the endpoint. Enforce USB encryption - Users will be enforced to encrypt flash drives to be able to store information on them. Data Content Reporting (DCR) - Generate intelligent reports that shows all content movements on the flash drive. Kill Pill Close down access rights or wipe the secured flash drive remotely.

8 Secured efile File encryption solution for Data Protection and Compliance... See Video Secure any document Empower end users to secure any document on desktops, network drives and portable media. and Enterprise Protection Method (EPM) End users can change access rights to documents at any time. Access rights will be reflected to all versions of the document. Create portable packages End users can collaborate secured with external recipients by creating portable secure packages. Collaborate securely with customers and partners Partners and customers can download and install software that will enable them to create and open secured documents.

9 Secured ecollaboration Document encryption for SharePoint and the desktop... See Video Secure any document Empower end users to secure any document on SharePoint and the desktop. Enterprise Protection Method (EPM) End users can change access rights to documents at any time. Access rights will be reflected to all versions of the document. Create portable packages End users can collaborate secured with external recipients by creating portable secure packages. Collaborate securely with customers and partners Partners and customers can download and install software that will enable them to create and open secured documents.

10 Secured ecollaboration Document encryption for SharePoint and the desktop... SharePoint Encryption Deployment Manager Automatically encrypt thousands of documents based on document name, document list, document metadata tags, document creator, document classification, document type etc. SharePoint Encryption Rules Manager Documents that are uploaded to SharePoint will be automatically encrypted based on rules. Product SDK The SDK makes it possible to build automated workflows in SharePoint where documents automatically get encrypted. It is also possible to use the SDK to automatically encrypt files and folders located on other locations.

11 The Simple Encryption Platform - SEP Secured efile, Secured ecollaboration, Secured , and Secured eusb

12 Components From Small Businesses to Large Enterprises... Standard components SEP Server Run as a service on the main server. SEP Management Console -.NET based management application that can run on the server or at any desktop. You can deploy multiple instances of the SEP console which allows management from any location of choice. Client Distribution package Contains the MSI generator that will create the MSI package for 32bit and 64bit machines. Additional components Secured ecollaboration solution - A WSP add in that integrates into SharePoint. Secured For Lotus Notes there is a Lotus Notes Deployment tool and template editor. Secured eusb All encrypted USB flash drives have a Secured eusb client that operates the end user interface and the connection to the SEP server. SEP Client installation package generated inside the SEP Management Console.

13 Enterprise Deployment Architecture Diagram... Cryptzone deployment architecture diagram Storage All data is stored in a SQL database. The SEP server can connect to any standard Microsoft SQL database. Directories - The SEP main server can connect to Active Directory and SharePoint for user and group management. Directory Services Main company server SEP Server, SEP MC Microsoft SQL Server Backup server SEP Server, SEP MC The SEP client can connect to the central server using SSL or HTTPS. Organization Network Deployment and scaling instructions can be found at center/enterprise/ Synchronized SEP Client Clients using SEP

14 Installation and set up From Small Businesses to Large Enterprises... A standard installation takes 1-4 hours depending on the environment. There is a Best Practice Set up Wizard to simplify the deployment process. Also included is a default Best Practice security policy that is most commonly used among Cryptzone customers. The wizard will assist with set up of: AD connection and sync Define Master Password Define Admin Password Select the main administrator License management policy Assign default policy to all users Generate custom templates Cryptzone Professional Service team can assist organizations in the set up process of the solution. The configuration manual help organizations to configure the pre designed Best Practices policy to fit the organizations requirements. The configuration manual are available at center/enterprise/ A special manual how to set up the solution for external access using a web service is available at center/enterprise/ A special manual for Lotus Notes users are available at center/enterprise/

15 Redundancy and backup No worries... SQL Database The core component of Simple Encryption Platform is the database in SQL. This means it is very important to back up the database daily. The database can easily be moved to any location without any problems. SEP Clients will not be affected if the server where the SEP server components is installed will go down or fail. The SEP server and SEP Management console can easily be reinstalled and reconnected to the SQL Database in less than 10 minutes. Clients If the SEP server goes down the SEP clients will continue to function without any issues. Lost functionality will be; Policies can not be updated centrally NEW encryption keys cannot be synchronized. Users cannot change access rights to secured files/folders. If a user secures a file/folder the user cannot add access right to other users. USB memory sticks that has been encrypted with Secured eusb will capture logs file locally until the SEP server is up and running and will then deliver the updated information. Licenses cannot be moved or changed.

16 Considerations Storage and network utilization... Enterprise Server Desktop Client 1 user profile will on average store up to 100 k per user profile. The network handshake between the Management Server and the SEP Client or agent, takes 8KB. SEP Client and user agent have separate polices updates, but will average on 0.4Kb 1KB per policy depending on the information it includes. Event takes approximately 0.4KB. Sending an event to the Management Server takes 1KB, not including the event file itself (the log file). SEP Client, Secured eusb will store logs locally until synchronized with the server. Size of logs will vary depending on the number of changes performed per action. Logs are filtered and compressed before transferring to SEP to minimize traffic and storage. A log file for normal file usage will estimated on average take 0.6 KB per completed action. SEP Client dynamically load and release resources as needed, system resources used will vary depending on tasks and licenses. In passive mode the SEP monitor will use ~2700K of memory and USB monitor around 980K. CPU usage is negligible. In active mode during a user session the task of securing a file will average around 8 MB for SEP monitor and 4-10 MB SEMX Explorer. SEMX can have a peak memory usage of 27 MB for an operation and on a 2.4 Ghz system CPU usage averages on 50% during intense encryption operations. Opening additional secured folders will use 4-10 MB for each folder, so should a user choose to have 10 active secured folders the combined memory usage would be 40+ MB. As folders are closed and the SEP Client is logged out, memory usage will return to passive mode. During a normal install disk space usage is below 15MB for the SEP Client and log file can be size restricted or disabled depending on configuration.

17 Uninstallation What to think about... Encrypted data Files and folders - All encrypted files and folders needs to be unencrypted before uninstalling the software. USB Memory sticks - Encrypted USB memory stick will continue to function without the SEP Server. To uninstall the solution from the USB memory stick, unencrypt all data and then format the stick. SEP Server Store and document Master password and all Group passwords. Backup and store the database for future reference. Store a set of the installation files and manuals. s If the organization needs easy access to encrypted s then the archive function should be activated when the software is installed. Then the organization will have a centralized storage of all sensitive data. The data can be stored secured or unsecured.

18 Support and documentation With focus on professional support... Support Support calls available - 24/7/365. Cryptzone support is performed by highly skilled Solution Engineers that will contact customer within 24 hours for personal support. Phone UK: Phone USA/Canada: Phone Sweden: +46 (0) Documentation Manuals and instructions can be downloaded at prise For Whitepapers and more technical papers go to prise Customers can support questions to support@cryptzone.com or go to for more help. The Solution Engineers have access to professional tools making it possible for them to see customers screen and give better support. Cryptzone Professional Services team offers special support, deployment, educations etc. at a fee.

19 Additional details of the Simple Encryption Platform

20 Password Recovery For Secured ... No helpdesk necessary Shared secret recovery If the user would need to remember a shared secret created for a specific secured contact the user can find this information in their own client. The user simply goes to settings and the secured contact list. There they can display all shared secrets ever created to a secured contact. Central Policy - If this is possible or not can be defined by policy.

21 Password Recovery For Secured efile and Secured eusb... Password Recovery Wizard Helpdesk user - The system comes with a ready to go Helpdesk user that can perform the Password Recovery task. User message Everywhere where an end user needs to enter a password there is a message informing about password recovery. It is possible to centrally define the information. Recovery ticket For every Secured file, folder or USB there is a unique recovery ticket. Recover wizard - The system offers a Recovery Wizard for helpdesk. The wizard will tell the helpdesk personnel what user that created the secured file, folder or USB. This is to assist helpdesk to do a security check of the person calling.

22 Restore of user profile Nothing to worry about it is all automatic... Issues User profile in Citrix / Terminal server gets damaged and needs to be recreated User machine crashes and the data cannot be restored User have several machines Windows crashes Etc Solution Global Object Synchronization Cryptzone has built a synchronization concept where information like policies, licenses, encryption keys, logs, templates etc. are automatically synchronized between Cryptzone server and one or several clients. For the IT department this means that a recovery is fully automatic in case of the issues to the right happens. All that needs to be done is to reinstall the client. Encrypted s, files and folders can and will be backuped in the same procedure as any other , file or folder.

23 Give licenses to end users License management... How to give license Licensing for SEP is managed per user. Each user is allowed to have the software installed on several machines and only 1 license will be used. The SEP Management Console is used to manage licenses. A license can be added or removed from a user on the fly. The system comes with the ability to manage licenses by policies. Example: If user belongs to certain group the user will receive a license automatically. If user is removed from group the license will be removed. A group can be a AD group, SharePoint group or custom created group in the system. System manager can give licenses to end users manually.

24 An employee leaves How to recover all information... Data recovery Encrypted USB sticks All USB sticks can be opened with the master password. Secured files and folders All secured files and folders can be opened and unencrypted with the master password. Secured Simply log in as the user to a profile and all secured s can be accessed. Another possibility is also to use the archiving function where all secured s can be stored at central location. Lock down Encrypted USB sticks Can be lock down using the Kill Pill Command in the SEP Management Console Secured files and folders Will be locked down automatically using AD Disable or Delete command for an AD account. It is also possible to remove access by removing the user license. Secured Will be locked down automatically using AD Disable or Delete command for an AD account. It is also possible to remove access by removing the user license

25 Cryptzone Group (publ) AB Global Headquarters: Drakegatan 7, SE Goteborg, Sweden

26 Appendix Product Information

27 SEP Client Overview... SEP Client SEP Server SEP Management Console Best Practice Proactive management platform and intelligent client synchronizes: Security policies Stealth encryption keys User and system access rights Password & helpdesk recovery passwords Intuitive interface and workflows Intelligent Client Global Object Synchronization Active Directory Security Methodology Enterprise Protection Method Strongest methodology available Automatic authentication key management System generates dynamic one-time keys for each content element System access protection one password FIPS certified AES256 encryption algorithm Help Desk Lost Password Access client Applications Security Secured communications Secured econtrol Content Filtering for communications Data at Rest Storage Secured efile file and folder encryption Secured ecollaboration Document encryption for Microsoft SharePoint End Point Security Secured eusb portable device storage Secured edisk - laptop/desktop encryption Secured edevice portable device, portable media and port control w/dlp

28 Additional details of Secured

29 Why is encryption so complex? The problem for IT is: My users struggle with computers... My users struggles with any new procedures... My users... How to deliver the with strong encryption, but make it easy so that anybody can read/reply? My users and recipients use all types of mobility devices; iphones, Blackberry Phones, Android devices, PDA s how do you support them?

30 Questions that you have to ask?... How does the sender send the encrypted ? New procedures? Is there a way to automate the decision to encrypt or not? Does this encryption method ensure regulatory compliance? What happens if I need to archive my ? Is the local copy encrypted? & Can I still use Windows Desktop Search? Do I need to download a client to view an encrypted ? What if I want to? Is the web delivery a third party service or can I manage the service? Can recipients view and reply with a portable device ie., phones, etc?

31 Cliff Notes on Secured Proven market leader!... Simply press send secured button. Send to anybody in the world regardless Recipient can view s with client application, browser or portable device Centrally managed by SEP, integrated with Microsoft Active Directory Global Objects Synchronization - Proactive server and client synchronization Global Communications - Web service allow users to read/reply to encrypted s Strong Encryption - AES 256 bit FIPS Certified Methodology Enterprise Protection Method - Automatic authentication & key management

32 What is Global Communications? What does it do for my organization? It s a in-house service that you can customize to look exactly how you want the service to look like! It s is a fool-proof method of delivering encrypted s for any type of user, any client, any device! It can control how long you want to offer the delivery of the encrypted ! Secured and our Global Communications functionality doesn t impact your Microsoft Exchange Server nor require additional network infrastructure to support the web service! And it s available at a quarter of the cost of traditional appliance solutions.

33 Secured ... Secured End Point Security for Encryption Best Practice Proactive management platform and intelligent client synchronizes: Security policies Stealth encryption keys User and system access rights Password & helpdesk recovery passwords Intuitive interface and workflows Empowerment for internal/external users Audit trail of all end user actions Integration with Active Directory Security Methodology System SKG Patented encryption technology Strongest methodology available Automatic authentication key management System generates dynamic one-time keys for each content element System access protection one password FIPS certified AES256 encryption algorithm Features Regulatory Compliance Sarbanes Oxley, GLB Act, HIPAA HITECH, FTC Red Flag Rules Fully integrated into Microsoft Outlook and Lotus Notes End to End messaging virtual channel Send to anyone capability any client app or web based Receivers can download a full Reader and reply back secured for free Receivers can activate a Reader Lite with zero footprint Ease of use Press Send secured or Send with Secured econtrol policy Centralized policy based encryption Archive encrypted and compressed

34 Additional details of Secured eusb

35 Encrypts Any USB flash drive in the market today! Secured eusb.. Encrypt any brand, any model, any size... Simple to use optional automatic encryption Use on any computer in the world! Client application or zero footprint deployment SEP Manager - Data Content Reporting Complete inventory of USB flash drives by user Risk Intrusion Report DLP Content Search Origin of all of the data on the drive What was done with the data What data is currently on the drive real time! Centralized Control - Life Cycle Management Lock-out command to block access Kill Pill command to wipe data on drive Strong Encryption AES 256 bit FIPS Certified

36 What is Life Cycle Management? What does it do for my organization? Controls the birth, use and death of encrypted USB flash drives. It s a fool-proof method of managing the encryption process - auto encryption or chose the work flow with a custom process! LCM can be managed centrally to have standard security policies to protect the data and guarantee that the device will be disabled based those policies! Control user access of a trusted employee who is now an ex-employee. He has your data & won t return the drive. You can wipe the data and kill the device - no matter where the drive is - even off net!

37 Secured eusb... eusb Encrypts ANY USB flash drive in the market today! Best Practice Proactive management platform and intelligent client synchronizes: Security policies Stealth encryption keys User and system access rights Password & helpdesk recovery passwords Intuitive interface and workflows no training Audit trail of all end user actions Lost flash drive Kill Pill support Integration with Active Directory Web based connection to SEP Console Security Methodology EPM (Enterprise Protection Method) FIPS certified AES256 encryption algorithm Brute force protection and Automatic Data Compression up to 5:1 Enforced synchronization of portable device Regulatory Compliance Sarbanes Oxley, GLB Act, HIPAA HITECH, FTC Red Flag Rules Features Encrypt any brand, any model, any size Distributed or Zero Footprint Deployment Security Policy whole drive or partial encryption Security Policy based enforced encryption Fastest encryption 16 GB in one minute Encryption.exe is portable, use on any computer in the world no license required! Secured workflow - work in a secured vault create, edit, delete Unlimited Passwords Help Desk Lost Password Recovery Support DCR Data Content Reporting Inventory list of all secured USB flash drives & what user that owns it Monitor all content on every secured USB flash drive in the organization by manufacturer Automatic data audit reporting by user, access, actions and files Help Desk Audit Trail reporting

38 Additional details of Secured ecollaboration

39 Do I really need secure documents? Questions that need to be asked... I know that encryption can be complex, but isn t there a easier way? How do you provide collaborative access to documents and manage user rights? Do I have to manually encrypt the data? How do you manage encryption on documents on the desktop and SharePoint? How do you manage the encryption keys for documents on network drives, those locally stored, or ed?

40 What is EPM? What does it do for my organization?... EPM (Enterprise Protection Method) automates the way a user deals with authentication and key management basically one or two clicks. It s is a fool-proof method of providing access rights & the associated encryption key to documents for individuals, work groups, AD or SharePoint Groups! EPM is managed centrally so IT can have standard security policies and access rights for documents or empower the end users to make access decisions. Enterprise Protection Method can be configured to allow automatic encryption of uploaded documents to specific libraries. Also EPM can allow automatic encryption of previously stored documents!

41 Document encryption for SharePoint Secured ecollaboration... Secure Documents with automatic authentication Centrally managed by SEP, integrated with Active Directory & SharePoint EPM - Auto authentication & key management Simple to use one click encryption Added icon shows it s encrypted Sharing Access double click to open Supports full versioning & checkin/check-out Automatic upload of encrypted files Regulatory Compliance HIPAA HiTECH, SOX, GLB Act, FTC s Red Flag Rules

42 Secured ecollaboration - EPM... Secure Microsoft Documents with automatic authentication Best Practice Proactive management platform and intelligent client synchronizes: Security policies Stealth encryption keys User and system access rights Password & helpdesk recovery passwords Intuitive interface and workflows Empowerment for internal/external users Audit trail of all end user actions Integration with Active Directory Security Methodology EPM (Enterprise Protection Method) Document creator can add/remove access rights Manage access to documents Manager, Contributor and Reader levels System access protection one password FIPS certified AES256 encryption algorithm Features Regulatory Compliance Sarbanes Oxley, GLB Act, HIPAA HITECH, FTC Red Flag Rules User work flow doesn t change Simple to use one click encryption Supports full versioning, checkin, & checkout Document icon shown visually as encrypted Secure documents can travel and rest secured on any media or device including network shared drives, FTP servers, DVDs, etc. EPM Stealth Key Technology and Automatic authentication/key management End users can secure data and add access rights to AD users and groups Share data with customers and partners Free Reader Self-Extracting option

43 Additional details of Secured efile

44 Why protect files & folders? It s data at rest, but usually in use and stored everywhere! Providing collaboration access of files/folders is the most effective way to organize and maximize your employees intellectual talent, but what about protecting the data? Giving access could be a big mistake! Regulatory Compliance regarding data at rest!.. HIPAA HITECH Act.. Gramm-Leach-Bliley Act.. FTC s Red Flag Rules State Laws; Massachusetts, Nevada, California, New York. 38 other states. Companies that don t meet regulatory compliance rules and laws will receive punitive penalties and fines, and it s more than fines; non-compliance correlates to the company s monetary value!

45 Why is certificate based file encryption so complex? The problem for IT is: My users struggle with computers... My users struggles with any new procedures... My users... How to deliver access to secured files & folders with strong encryption, but make it easy for the right people to read? I would like to set up centralized rules so that when a member of a work group or AD groups encrypts a file - everybody that should have rights have rights, and others don t. I need to dumb this process down!

46 This is what I want to learn about? How do you provide collaborative access to files and folders, and manage user rights while maintaining high security? I assume I can create AD OU secured groups, but can I create work groups? Can my users add access rights individuals or groups to share secured data? Most users create files on their desktop and move them to network shared drive how do you manage encryption? And when you access the files do you have to use a certificate? Files and Folders located on network share drives are usually stored locally, on USB s, burnt on CD/DVD s are they controlled? How do I share encrypted files/folders to people outside my network?