Admin Guide. IronKey Enterprise Management Service IRONKEY ADMIN GUIDE

Transcription

1 Admin Guide IronKey Enterprise Management Service PAGE 1

2 Thank you for choosing IronKey. IronKey is committed to creating and developing the best security technologies and making them simple-to-use, affordable, and available to everyone. Years of research and millions of dollars of development have gone into bringing this technology to you in the IronKey. We are very open to user feedback and would greatly appreciate hearing about your comments, suggestions, and experiences with the IronKey. Standard Feedback: Anonymous Feedback: User Forum: PAGE 1

3 CONTENTS Overview Meet IronKey Enterprise IronKey Enterprise Administrative Features Setup and Deployment Getting Started Creating Your IronKey Enterprise Account Activation and Initialization Adding Users to the Enterprise Account Activating IronKey Enterprise for Basic Users Deploying IronKey Enterprise Deployment Method 1: Automated Distributed Deployment Deployment Method 2: Distributed Deployment Deployment Method 3: Manual Deployment Updating Device Software Best Practices for a Smooth Rollout Deployment Checklist Using IronKey Enterprise System Elements and Terminology IronKey Users IronKey Devices IronKey Policies Events and System Auditability Understanding the Silver Bullet Service Understanding Password Assistance Using the Admin Console Accessing the Admin Console The Enterprise Dashboard Managing Users Managing Devices Using the Silver Bullet Service Using Password Assistance Managing Policies Managing Licenses Enterprise Support Page PAGE 2

4 Using the Admin Tools Accessing the Admin Tools Using Secure Device Recovery Promoting a Standard User to be an Admin Recommissioning Devices Importing Authentication Credentials Importing RSA SecurID Tokens Importing a Digital Certificate into the IronKey Administering the IronKey Anti-Malware Service Interpreting IronKey Malware Scanner Reports Common Tasks Adding New Users Activating Devices for a User Adding New Admins Adding New Devices to Users Disabling Lost Devices Helping a User with Password Assistance Using Non-Administrative Features Known Issues Enterprise Support Product Specifications Contact Information PAGE 3

5 Overview Meet IronKey Enterprise The IronKey Enterprise Secure Flash Drive, designed to be the world s most secure USB flash drive, tightly integrates with the IronKey Enterprise Management Service to give you control over protecting your organization s data, ensuring that security policies are enforced, and remotely managing IronKey devices. IronKey Enterprise consists of three interrelated elements that provide a robust solution to USB flash drive security and device management: The IronKey Secure Flash Drive hardware Applications bundled on the IronKey (based on policy configuration) The IronKey s secure online services, which provide centralized administrative capabilities to IronKey Enterprise Admins This guide informs you about how to get the most out of IronKey Enterprise, as well as best practices for deploying and managing IronKeys in your enterprise environment. PAGE 4

6 IronKey Enterprise Administrative Features The Admin Console: Centralized Online Device Management IronKey Enterprise includes a centralized management console for managing tens, hundreds or thousands of devices, reducing overall deployment times and maintenance requirements. IronKey Policies: Enforcing Corporate Security Policies IronKey Enterprise allows you to configure policies for device password strength, selfdestruction settings, and enabling specific IronKey applications, services and more. Policies are downloaded to a device during activation, and changes to policies are automatically updated on affected devices after each device is unlocked. Silver Bullet Service: Protecting Against Malicious Users IronKey s Silver Bullet Service will confirm that IronKey devices are authorized before allowing them to be unlocked. This real-time service allows Admins to completely disable and even remotely detonate devices, extending the control needed to protect important data. It also supports users who are not always online by allowing a predetermined number of unlock attempts before disabling the device. When enabled, each IronKey will quickly check with the Silver Bullet Service immediately after the user tries to unlock the device, but prior to allowing the device to be unlocked. Active users will be able to unlock their IronKeys and continue as normal. Disabled users will receive a Deny command preventing them from unlocking the device, while lost or stolen devices that have been marked for detonation will receive a Destroy command and will initiate a selfdestruct sequence on the device. Admin Tools: Onboard each Administrator s IronKey Admins have additional functionality enabled in their IronKey s Control Panel, including Secure Device Recovery, Admin Approval, and Device Recommissioning. Secure Device Recovery: Securely Unlocking Users Devices Secure Device Recovery is IronKey s patent-pending PKI mechanism for Admins to unlock another user s IronKey device, such as in the case of employee termination, regulatory compliance, or forensic investigations. Unlike many other solutions, there is no central database of back-door passwords. Device Recommissioning: Securely Repurposing Users Devices When employees leave the organization, their IronKeys can be safely recommissioned to new users. This process requires Admin authentication and authorization using IronKey Enterprise s secure online services. Admin Approval: Securely Promoting Users to Become Admins When a new Admin is created, or a user is promoted to become an Admin, a verification procedure occurs not only on the service, but also on an existing Admin s IronKey device. This ensures that the new user is cryptographically approved and able to become an Admin for your Enterprise Account. PAGE 5

7 Setup and Deployment Getting Started IMPORTANT BEFORE YOU BEGIN IronKey Enterprise is designed to protect your organization from the risks of data loss and data leakage by delivering world-class security. However, it is important to follow a few best practices when setting up your Enterprise Account to ensure that the proper levels of security and usability are met: Make sure the person setting up the Enterprise Account has a thorough knowledge of your organization s security policies and is authorized to be the System Admin for all of your organization s IronKey devices. That person will define the default policy for IronKey devices. Make sure there are multiple System Admins. To ensure the highest security, even IronKey is unable to intervene in your Enterprise Account in the event that a lone System Admin leaves the organization, loses his only IronKey device, or forgets that device s password. Have multiple System Admins at all times, each with multiple active devices. Please review the Best Practices section in this document for a smooth deployment. CREATING YOUR IRONKEY ENTERPRISE ACCOUNT Before you can begin deploying and managing IronKey Enterprise drives for end-users, you must create your IronKey Enterprise Account. To set up the account, you need:» A PC running Microsoft Windows 2000 (SP4), XP (SP2), or Vista» A USB 2.0 port for high-speed data transfer» An Internet connection» The you received from IronKey with your Enterprise Account Number PAGE 6

8 Step 1 Enter your Account Number at 2 You must confirm that you are the appropriate authority for setting up your organization s IronKey Enterprise Account. Description This can also be done by clicking the link in the you received from IronKey regarding setting up your IronKey Enterprise Account. Select the checkbox and click Continue. 3 The next several steps allow you to establish security policies for your drives. To start, select the number of failed password attempts that a user may enter before the IronKey self-destructs and all the data on the IronKey is lost. All policy items can be changed later. 4 Set the password policy options, including minimum password length allowed, the minimum number of required characters, and requirements for backing up device passwords. PAGE 7

9 5 Configure the set of software applications and services that your users will have on their IronKeys. Putting the mouse over the help icon for each item shows a brief description of what that item is. See the section on Policy Items later in this document for more information. 6 Define a Lost and Found message that appears on the IronKey Unlocker screen when each device is plugged in. For example, this may include contact information in case a lost device is found, or department information for easily distinguishing devices. You may optionally choose to leave this blank or to allow users to define their own Lost and Found message. 7 The next several steps guide you through creating your own my.ironkey.com account for how you individually will access your organization s Enterprise Account. This involves creating a username and password, confirming your address, answering Secret Questions, and choosing a Secret Image and Phrase for antiphishing protection. PAGE 8

10 ACTIVATION AND INITIALIZATION After confirming your information, an is sent to you containing the Activation Code for your first IronKey Enterprise Secure Flash Drive. Step 1 Plug in any unactivated IronKey drive from the set you purchased. 2 The Activate Your IronKey screen appears. 3 Retrieve the with your Activation Code. Copy and paste the code into the IronKey window. Click Continue when you are ready. 4 Create a device password and a nickname for your IronKey. 5 Back up your password online to your my.ironkey.com account Description Your IronKey must be activated on a Windows (2000, XP, or Vista) or Mac computer. To use the full speed of the IronKey, plug it into a USB 2.0 port. The IronKey autoruns as a virtual CD-ROM. Windows: This screen might not appear if your computer does not allow devices to autorun. You can start it manually by double-clicking the IronKey Unlocker drive in My Computer and doubleclicking the IronKey.exe file. Mac: Double-click the IronKey drive on your desktop, and double-click the IronKey file. NOTE: You can install the IronKey Auto-Launch Assistant, which automatically opens the IronKey Unlocker when you plug in an IronKey. See Preferences in IronKey Control Panel Settings. (Mac only) Enter your address and your Activation Code into the fields provided on the IronKey window. If your IronKey cannot connect to the Internet, click Edit Proxy Settings to adjust its network settings. Because you can have multiple IronKeys associated with one IronKey account, the nickname helps you distinguish between different IronKey devices. Your password is case-sensitive and must match your organization s password policy. If enabled, you have the option to back up your password online to your my.ironkey.com account. That way, if you ever forget your password, you can safely log into and recover it. 6 The IronKey initializes. During this process, it generates the AES encryption keys, creates the file system for the secure volume, copies secure applications and files to the secure volume, and configures the onboard Firefox browser. Depending on your configuration, this might take several minutes. After this device has been initialized, use the same steps to activate a second System Admin s device. IronKey Enterprise is ready for use. IMPORTANT: Label this drive now as the administrator drive or leave it unmarked based on your security preferences. Keep this drive in a safe place. It is essential for maintaining your IronKey Enterprise Account. PAGE 9

11 ADDING USERS TO THE ENTERPRISE ACCOUNT You can now begin adding users to your Enterprise Account. Step 1 Click the my.ironkey.com icon in the IronKey Control Panel to access the Admin Console. Description 2 Click Manage Users in the sidebar of the Admin Console tab. 3 Click the Add button in the top right. 4a To add a single user, enter the user s name (optional), (optional), role, policy for the user s device, and if you want the system to send the user an with the Activation Code for setting up his IronKey device (this requires that an address be supplied). Then click Submit. The user will then be added to the Enterprise Account. PAGE 10

12 4b To add a list of multiple users, click the Add Multiple Users button at the top right. 5 Copy and paste a CSV file s contents into the textbox provided and click Continue. Use this format: Name, ,Role,Policy The Role can be one of the following: System Admin Admin User Auditor Standard User Up to 100 users can be added in a single import. NOTE: All fields are optional and default to an anonymous Standard User with the Default Policy if not specified. Unless you are a System Admin, you can only add Standard Users. 6 You will be required to fix any errors before the data can be submitted. Once all data is verified and correct you will be allowed to submit it. Once all errors are fixed, click Submit, and the users will be added to the Enterprise Account. Watch the online demonstration for more information. An example of a row might be: John Doe,John_Doe@Organization.com,Auditor,IT Policy where the user s name is John Doe, address is John_Doe@Organization.com, he will be an Auditor, and his device will use a policy with the name IT Policy. ACTIVATING IRONKEY ENTERPRISE FOR BASIC USERS To remotely manage users with IronKey Basic devices, you can ask them to activate IronKey Enterprise on their devices: 1. Add a new user in the Admin Console. 2. Send an activation code for the user to enter in the IronKey Basic Control Panel. 3. The user confirms the organization and its system administrator. The device binds to the organization s Enterprise account, receiving the Enterprise device policy. PAGE 11

13 Deploying IronKey Enterprise You are now ready to distribute IronKey Secure Flash Drives to your users. Inside the packaging is an IronKey device, a Quick Start Guide, and a lanyard. There are three basic ways of deploying IronKeys to your organization. You can decide which one is right for your organization based on your security, privacy, and IT considerations. DEPLOYMENT METHOD 1: AUTOMATED DISTRIBUTED DEPLOYMENT The simplest and most cost-effective way to deploy IronKeys to your userbase is to add users to the Enterprise Account and then hand them an IronKey device. IronKey Enterprise will take care of the rest. Step 1 Add a user to the Enterprise Account. Review the detailed instructions elsewhere in this document for more information. 2 Give the user an IronKey Enterprise Secure Flash Drive. 3 Have the user retrieve the with his Activation Code and copy and paste it into the IronKey. Description Make sure to provide the user s address and select the checkbox that will send the user an with his Activation Code. Mass imports of up to 50 users will also have the users Activation Codes automatically ed to them. Any purchased or recommissioned device will work. Instructions for this step are provided to the user in the Quick Start Guide and in the . (NOTE: Requires a Windows or Mac computer.) The user is now active in the Enterprise Account. DEPLOYMENT METHOD 2: DISTRIBUTED DEPLOYMENT If you have a very large userbase, want to customize the invitation , or your corporate privacy policy is such that you will not import your users addresses into the Enterprise Account, you can import your users first and then their setup information yourself. Step 1 Add users to the Enterprise Account. Review the detailed instructions elsewhere in this document for more information. Description Make sure to clear the checkbox that would send the user an with his Activation Code. IMPORTANT: Even if you are performing a mass import and do not want the users ed, we strongly recommend providing their addresses to avoid problems during activation and online account setup. PAGE 12

14 2 The setup information for that user s device is presented on the screen (or in the case of a mass import, in a downloadable CSV file). 3 each user his IronKey setup information. 4 Give the user an IronKey Enterprise Secure Flash Drive. 5 Have the user retrieve the with his Activation Code and copy and paste it into the IronKey. This can be done manually for small numbers of users. Any purchased or recommissioned device will work. Instructions for this step are provided to the user in the Quick Start Guide and in the . DEPLOYMENT METHOD 3: MANUAL DEPLOYMENT If you do not want your users to be involved in the activation process, you can manually set up each IronKey and then hand it to the user. This method is simpler to the end-users, though requires a little more effort from those deploying the devices. Step 1 Add a user to the Enterprise Account. Review the detailed instruction earlier in this document for more information. 2 The setup information for that user s device is presented on the screen (or if for a mass import, in a downloadable CSV file). 3 Activate an IronKey Enterprise Secure Flash Drive, but stop before creating the device password. 4 Give the device to the appropriate user. Description Make sure to clear the checkbox that would send the user an with his Activation Code. IMPORTANT: Even if you do not want the user ed, we strongly recommend providing their address to avoid problems during activation and online account setup. Any purchased or recommissioned device will do. Enter your address and the Activation Code. (NOTE: Your address will not be associated with the device after Activation.) When you get to the next screen, where you can create the device password, exit the setup process and unplug the device. Make sure not to mix up your users devices. Use the serial number on the back of the device as a reference. PAGE 13

15 Updating Device Software You can get software updates for devices via download. Step 1 In the IronKey Control Panel, click Settings and then click the Check for Updates button. Description The IronKey can securely update its software and firmware through signed updates that are verified in hardware. This allows users to keep their devices up-to-date and protect themselves from future malware and online threats. 2 Click the Download Update button to download the updates and install them on the device. 3 After the installation is completed, you can check that the device is updated to the latest version: a. Lock and unplug the device, and then reinsert it. b. In the IronKey Control Panel, click Settings and then click About IronKey to view version information. Windows: If an update is available, you can download and install it by clicking the Download Update button. Mac: You can check for and download policy updates. However, you must download software updates on a Windows computer. You can view details about your device, including model number, serial number, software and firmware version, secure files drive, and OS. You can also click the copy button (CTRL+C) to copy device details to the clipboard for your forum posting or support request; visit the website (CTRL+W); or view legal notices (CTRL+N) and certifications (CTRL+?). PAGE 14

16 Best Practices for a Smooth Rollout UPDATE PASSWORD POLICIES ONLY WHEN NEEDED When you update the password policy items in a policy, devices with that policy will update to the latest version. However, since the password policy has changed, users will be required to change their password so it conforms to the new password policy. Change the password policy items only when needed so users do not have to excessively change their device passwords. CREATE A SEPARATE POLICY FOR LINUX USERS If you plan to leverage IronKey s Silver Bullet Service, create a separate policy for Linux users that does not include Silver Bullet or that includes a large number of Silver Bullet attempts. The Silver Bullet Service is not available for Linux systems. On Linux computers, device usage is disabled. HAVE USERS BACK UP THEIR PASSWORDS FOR PASSWORD ASSISTANCE You can mandate through policy that each user back up his/her device password online. This will allow Admins to use Password Assistance to users a temporary link that reminds them of their password in case they ever forget it. If your policy is to not have users back up their device password, you can use Secure Device Recovery to change their password for them. BACK UP YOUR DATA REGULARLY Encourage users to use the onboard Secure Backup software for backing up their onboard data. In the case that an IronKey is lost or stolen, that data can later be recovered to a new IronKey. KEEP ADMIN AND USER DEVICES UP-TO-DATE Ensure that Admin devices have the latest IronKey software. You can do this by clicking the Check for Updates button in the IronKey Control Panel (under Settings ). To ensure that Windows XP users can update their devices, install the IronKey Assistant (see the IronKey Assistant Deployment Guide for details). USE SILVER BULLET WISELY It is recommended not to set the Silver Bullet policy too strict (e.g. deny if not online or from a specific IP address) for remote or travelling employees; otherwise, sometimes they might not be able to use their IronKey. Deployment Checklist IronKey Enterprise Account successfully created and Default Policy defined First IronKey device activated confirmed access to Admin Console Redundant System Admin added confirmed access to Admin Console Users added/imported into Enterprise Account Deployment Methods 1 and 2 s with Activation Code sent IronKey devices distributed to users Deployment Method 3 IronKey devices manually activated IronKey devices distributed to users PAGE 15

17 Using IronKey Enterprise System Elements and Terminology IRONKEY USERS Each member of your IronKey Enterprise Account is called a User. Only System Admins can add Admin users, delete users and change user roles. User Roles There are five separate user roles, differentiated by the user s privileges:» System Admin: Can modify all users and system settings, including adding Admins, approving Admins, changing user roles, and deleting users.» Admin User: Can manage users and add Standard Users» Custom Admin: Has a mixture of privileges, such as policy management» Auditor: Can view the Admin Console with read-only access» Standard User: An IronKey user who cannot view the Admin Console All Admins and Auditors will have online IronKey accounts, as this is needed to access the Admin Console. Standard Users do not have online IronKey accounts. PAGE 16

18 User Statuses The current status of a user signifies what state his account is in. There are several user statuses, including:» Pending: System is waiting for user to activate his IronKey» Active: User has activated at least one IronKey and has set up his online IronKey account» Active (without online account): User has activated at least one IronKey but does not have an online IronKey account» Locked: User s account has been locked after three incorrect answers to challenge questions» Disabled: User s account has been temporarily disabled by an Admin» Disabled (without online account): A user who does not have an online IronKey account has been temporarily disabled by an Admin» Deleted: User s name has been deleted by a System Admin, but can be re-used (NOTE: A user s online account name cannot be used twice even if the user is deleted.) Other User Properties For purposes of organization and smooth deployment, you can set a name and address for each user. These fields are optional, and if left blank users will be displayed as User1, User2, User3... in the Admin Console. IRONKEY DEVICES Users can have more than one IronKey device Every IronKey Enterprise Secure Flash Drive in your Enterprise Account is associated with a user. Users can have one or many IronKey devices. Device Properties IronKey devices include the following properties:» Device Name, useful for inventorying the Case ID» Device Status, similar to user statuses» The capacity of the drive (in GB)» The unique serial number of the IronKey Cryptochip inside the device Consistent, unique serial numbers for enhanced asset inventory management and endpoint security control are in these locations: Lasered onto the device, including a barcode Printed on the product packaging On the About IronKey pane of the IronKey Control Panel On the IronKey Admin Console, with the device s model number Integrated into the USB standard field name, so that it is available to Windows and other operating systems for security whitelisting and inventory management by other products For large-scale deployments, you can export IronKey Admin Console information including the serial number to a.csv file for electronic transfer to another system. PAGE 17

19 » Product identification numbers (PIDs) for S200 and D200 models are useful for inventory management and security control (Basic: ; Personal: ; Enterprise: ).» The policy to which this device is adhering» The date on which this device was activated» The date and user for when the device was created and last modified Devices also include a comments section, in which you may write information as needed. For example, you could enter information regarding your own inventory data, the device s case serial ID, or information regarding the use or purpose of this device. IRONKEY POLICIES IronKey Enterprise devices comply with the policies you define in the Admin Console. Policy items you can control include: PASSWORD SECURITY POLICIES» The number of invalid password attempts before self-destruction After too many consecutive invalid password attempts, IronKey devices initiate a selfdestruct sequence with advanced flash-trash technology. This hardware-level security protects against brute-force password attacks. Configure this feature with a balance of security and end-user convenience in mind. Range is from 2 to 200 attempts Default: 10 attempts Recommendation: 10 attempts» The minimum password length for device passwords Only passwords with this many or more characters will be allowed. Range is from 4 to 20 characters Default: 4 characters Recommendation: Depends on self-destruct limit» The minimum number of uppercase letters in device passwords Only passwords with this many or more uppercase letters will be allowed. Range is from 0 to 5 letters Default: 0» The minimum number of lowercase letters in device passwords Only passwords with this many or more lowercase letters will be allowed. Range is from 0 to 5 letters Default: 0» The minimum number of digits in device passwords Only passwords with this many or more digits will be allowed. Range is from 0 to 5 digits Default: 0 PAGE 18

20 » The minimum number of special characters in device passwords Only passwords with this many or more special characters will be allowed. Range is from 0 to 5 characters Default: 0» Whether whitespaces are allowed in device passwords This setting determines whether or not spaces are permitted in IronKey device passwords. Default: Yes Recommendation: Yes APPLICATION POLICIES» Whether Mozilla Firefox is available on the device If enabled, a Firefox web browser will be included onboard each IronKey device. This onboard browser is portable, so cookies, history files, bookmarks, add-ons and online passwords are not stored on the local computer. Default: Enabled» Whether the IronKey Identity Manager is available on the device If enabled, the IronKey Identity Manager will be included on each IronKey device. It allows users to seamlessly log into their online accounts (using IE6, IE7, IE8 and the onboard Firefox) and most applications that require username and password credentials, as well as generate strong passwords and manage portable bookmarks. Not having to type out passwords provides added protection from keyloggers and other crimeware. Additionally, websites that support VeriSign Identity Protection (VIP) can be locked down to the IronKey for two-factor authentication. IronKey devices using a version prior to are using the IronKey Password Manager. This policy is compatible with the IronKey Password Manager. Default: Enabled» Whether IronKey s Secure Backup software is available on the device If enabled, IronKey s Secure Backup software will be included on each IronKey device. This software allows users to back up an encrypted copy of files from their IronKey device to their local computer. If the IronKey device is lost or stolen, backed up data can be restored to another IronKey. Default: Enabled Recommendation: Enabled» Whether RSA SecurID is available on the device If enabled, each IronKey will include an application for generating RSA SecurID one-time passwords for strong authentication. A.stdid file will need to be imported to use this application. Default: Disabled» Whether CRYPTOCard is available on the device If enabled, each IronKey will include an application for generating CRYPTOCard one-time passwords for strong authentication. A token file will need to be imported to use this application. Default: Disabled PAGE 19