Protect Sensitive Data Using Encryption Technologies. Ravi Sankar Technology Evangelist Microsoft Corporation

Transcription

1 Protect Sensitive Data Using Encryption Technologies Ravi Sankar Technology Evangelist Microsoft Corporation

2 Where is the User Data Stored? Q: Where is the biggest data exposure risk? SQL

3 Clients Documents Where do users keep their documents? User Profile Outlook, Sharepoint, Desktop, Temp, IE Per-machine Data Search index, offline file cache, pagefile Non-standard Locations ISV & in-house apps

4 What are the data protection options? BitLocker Drive Encryption Encrypting File System Rights Management Service But don t forget Data backup Data minimizing Data classification

5 Each year, hundreds of thousands of computers without appropriate safeguards are lost, stolen, or improperly decommissioned around the world

6 BitLocker TM / EFS in Vista

7 Disk Layout & Key Storage Operating System Volume Contains: Encrypted OS Encrypted Page File Encrypted Temp Files Encrypted Data Encrypted Hibernation File Where s the Encryption Key? 1. SRK (Storage Root Key) contained in TPM 2. SRK encrypts the VMK (Volume Master Key). 3. VMK encrypts FVEK (Full Volume Encryption Key) used for the actual data encryption. 4. FVEK and VMK are stored encrypted on the Operating System Volume. Operating System Volume System FVEK 3 4 VMK 2 SRK 1 System Volume (1.5GB) Contains: MBR Boot Manager Boot Utilities

8 BDE Protection Methods Factors BDE Function and Remarks TPM TPM + PIN TPM + Startup Key Startup Key Transparently validates early boot components on OS startup Best ease of use Protects against HW-only attacks Vulnerable to some HW attacks User must enter 4-20 digit PIN on OS startup BDE validates PIN and early boot components Protects against software-only and many hardware attacks Vulnerable to TPM breaking attacks Looks for USB flash drive with Startup Key BDE validates saved key and early boot components Protects against many HW attacks Protects against TPM attacks Looks for USB with Startup Key BDE validates saved key Protects against many HW attacks Vulnerable to lost token and pre-os attacks

9 BitLocker Scenario 1

10 BitLocker Scenario 2

11 BitLocker Scenario 3 Normal Vs. BitLocker Decommission Nothing ****** * Reformat drive Delete keys Admin wipes drive

12 Encrypting File System Encrypts each file Requires NTFS Smart card support for user/ recovery key

13 Confidential information is leaked out by accidental forwarding of s and other documents

14 Does your policy support enforcement..?

15 End User Scenarios Safeguard Sensitive Information with RMS Protect , documents, and Web content Secure s Outlook 2003 Windows RMS Keep corporate off the Internet Prevent forwarding of confidential information Templates to centrally manage policies Secure Documents Word 2003, PowerPoint 2003 Excel 2003, Windows RMS Control access to sensitive info Set access level - view, change, print... Determine length of access Log and audit who has accessed rights-protected information Secure Intranets IE w/rma, Windows RMS Users without Office 2003 can view rightsprotected files Enforces assigned rights: view, print, export, copy/paste & time-based expiration

16 Federated Rights Management Contoso Adatum Account Federation Server Federation Trust Web SSO Resource Federation Server Together AD FS and AD RMS enable users from different domains to securely share documents based on federated identities AD RMS is fully claimsaware and can interpret AD FS claims Office SharePoint Server 2007 can be configured to accept federated identity claims

17 RMS does not protect against analog attacks

18 Windows Vista/Server 2008 Information Protection Scenarios BitLocker EFS RMS Laptops Branch office server Local single-user file & folder protection Local multi-user file & folder protection Remote file & folder protection Untrusted network admin Remote document policy enforcement Some cases can result in overlap. (e.g. Multi-user roaming laptops with untrusted network admins)