Understanding Northwestern University s contract with Symantec. Symantec Solutions for Cost Reduction & Optimization

Transcription

1 Understanding Northwestern University s contract with Symantec Symantec Solutions for Cost Reduction & Optimization Chris Hagelin and Shane Scholes Symantec Account Manager and Symantec Sales Engineer Presentation Identifier Goes Here 1

2 Agenda Symantec Overview Agreement Overview Symantec Endpoint Encryption Presentation Identifier Goes Here 2

3 Industry Recognition Security Leadership Consumer Endpoint Security (#1 market position 1 ) Endpoint Security (#1 market position 2, Positioned in Leader s Quadrant in Gartner Magic Quadrant 3 ) Messaging Security (#1 market position 4, Positioned in Leader s Quadrant in Gartner Magic Quadrant leader 5 ) Storage and Availability Management Leadership Storage Infrastructure Software (#1 market position 14 ) Core Storage Management Software (#1 market position 15 ) Data Protection (#1 market position 16 ) Policy & Compliance (#1 market position 6 ) Archiving (#1market position 7, Positioned in Leader s Quadrant in Gartner Magic Quadrant 8, Forrester Wave leader 9 ) Data Loss Prevention (#1 market position, Positioned in Leader s Quadrant in Gartner Magic Quadrant 10 and Forrester Wave leader 11 ) Security Management (#1 market position 12 ) Security Information & Event Management (SIEM) (Positioned in Leader s Quadrant in Gartner Magic quadrant 13 ) Datacenter Optimization 3

4 We Understand Your Reality end-point evolution Federated vs Consolidated Education Compliance Technical data growth, data duplication Deliver an increasing number of business services with significantly fewer resources than last year. Delivery of Open Education Facilities cost Confidential Data Exposure Personnel - lack of resources Datacenter Optimization 4

5 Symantec and Northwestern University Partnership Symantec is committed to: Working in partnership with Northwestern University to provide a comprehensive and sustainable solution for all aspects of member s requirement. Ensuring successful projects and minimizing risk for all member s information risk management initiatives. Providing support and advice to NU members after deployment to ensure smooth operation and continued protection. Presentation Identifier Goes Here 5

6 Symantec and Northwestern University Partnership Agreement Outline: A three year Agreement (expires: June 30, 2013) Symantec Security and End Point Management Solutions FTE based license model Perpetual and Subscription options License, Support and Competitive Replacement Models Delivered thru Software Partner: SHI Presentation Identifier Goes Here 6

7 Symantec and Northwestern University Agreement Outline: Technology Solutions include: Symantec Protection Suite Anti Virus (SEP) Anti spam (SEP) Anti spyware (SEP) Network Access Control (SEP) Mail Gateway Security (Brightmail) Back up Exec for end points Additional Options Available on Contract Encryption Data Loss Prevention Altiris Presentation Identifier Goes Here 7

8 Obtaining the Software SEP available for download via NUIT Web site Requests for additional quotes go to Presentation Identifier Goes Here 8

9 Symantec Endpoint Encryption 7.0

10 The Problem with Data Data is Pervasive and Portable: Desktops and Laptops Computer hard drives Removable storage devices, such as CDs and USB drives Risk for organizations: Loss of data and associated expenses Data at Risk puts your Business at Risk 10

11 Where s the biggest risk? Other includes paper Lost or stolen laptops Data stolen without authorization External attacks Lost CD or other removable media Data sent to wrong recipient Fifty six data cases were investigated by the Financial Crime Operations team at the FSA in 2007, according to FOI statistics obtained by Computer Weekly. Oct 2008 Sarah Hilley 11

12 What customers are looking for.. Centralized Management AD Integration/No AD Integration Non Intrusive User experience Data secured from review by external persons The ability to share data with external persons Device Control Certifications (FIPS, CC.) Full/Whole Disk* Integration with. TECHNICAL 12 12

13 What they are really looking for. The ability to deploy a solution with minimal trouble. The ability to say that a lost or stolen system will not be compromised. Advice.How other people are deploying. Something that will not break another solution they have deployed. To know What is Encryption? (no joke) To do this in this easiest way possible. NON-TECHNICAL 13

14 Endpoint Encryption Terms Full Disk Encryption secures all data stored on a PC s hard drive File based Encryption secures individual files on a PC s hard drive or on removable storage devices such as CD/DVD, USB memory sticks, ipods, portable hard drives, etc. Data in use data that is currently being accessed and used. Data in motion data that is being transmitted via IM, , etc. Data at rest data that exists on PCs that are in shutdown, sleep, or hibernate mode or that have invoked screensaver passwords The bottom line is that a significant number of PCs and media devices carrying business data will not be properly encrypted and are fated to cause disasters for companies and the individuals who are affected. The odds suggest that this will happen to your organization, whether it is small, midsize or large. The rosters of companies listed in various public sources and blogs touch business entities of all types in countries around the world. Gartner, Nov

15 Symantec Endpoint Encryption Symantec Endpoint Encryption Full Disk Edition Symantec Endpoint Encryption Symantec Endpoint Encryption Removable Storage Edition Advanced encryption for desktops, laptops and removable storage devices offering scalable security and prevention of information compromise. 15

16 Endpoint Encryption Full Disk FIPS validated, CC EAL4 pending Pre boot authentication Password recovery Self Service Authenti Check Remote one time password recovery Advanced enterprise ready capabilities Multiple user / administrator accounts Software setup and installation tools Administrative drive recovery Wake on LAN Symantec Endpoint Encryption Full Disk Edition OS and system files Swap / hibernation files Data / multiple partitions 16

17 Endpoint Encryption Full Disk Full partition or disk encryption Encrypts boot disk Encrypts up to 26 partitions on system boot disk FIPS validated AES cryptography 256 bit key (default) or 128 bit key for disk encryption Excellent performance Partition or disk level encryption Initial encryption after installation Runs in low priority background Users can continue to use their machine Power loss feature always enabled Run time encryption Users typically do not notice performance 5% to 15% depending on variety of factors 17

18 Endpoint Encryption Full Disk Encrypts all disk sectors Includes swap files, hibernation files, temporary files Supports standby and hibernation modes Encrypts hibernation file Prompts for user credentials when resume from hibernation if pre boot authentication enabled Low level encryption driver Intercepts all Windows calls to read and write files Encrypts data from memory and writes to disk Decrypts data from disk and writes to memory Completely transparent to all Windows applications Completely transparent to Windows operating system Data stored on disk is always encrypted No temporary files with decrypted data 18

19 Pre boot Authentication Hardened pre boot operating system Small footprint and attack surface Adds extra layer of security when enabled Users authenticate to pre boot logon dialog Key management included Does not require separate key management infrastructure User logon credentials securely stored in PB environment Single sign on Windows Single Sign on integration Novell Single Sign on Supports version SP3 or later User password changes automatically synchronized Recovery Recovery keys automatically encrypted and escrowed in server Optional per installation by administrator Customers can elect to deploy without it Windows responsible for user authentication Drive fully encrypted even if pre boot authentication is disabled 19

20 Password recovery Self service recovery for lost or forgotten passwords Authenti Check challenge/response questions and answers Administrator or user provisioned questions User provisioned responses Administrator option to deploy Help Desk assisted One Time Password Challenge/response keys Unique to each workstation Keys automatically escrowed to server during client check in Separate administrative role with read only access to necessary key information Separate application for Help Desk personnel only Administrator option to deploy Requires user to change password after OTP gives access to machine Enables recovery for registered users if machine locked due to missing required reporting period 20

21 Endpoint Encryption Removable Storage File level encryption FIPS certified algorithms 256 bit and 128 bit AES File Encryption Key (FEK) Unique key per file Symantec Endpoint Encryption Removable Storage Edition Key protection / user authentication Passwords Certificates Workgroup key Administrative data recovery certificate 21

22 Endpoint Encryption Removable Storage Transparent end user operation Comprehensive encryption support Policy based encryption for removable media FIPS certified AES 256 bit or 128 bit, CC EAL4 pending Encrypt plain text data on devices Best in class storage media support Flash drives, Hard drives, SD cards CF cards, CDs/DVDs, ipods, etc. Portability Access utility Install by policy, read / write encrypted data Self extracting archives Group and Kiosk mode operation Centrally managed data recovery 22

23 Key Management 23

24 Endpoint Encryption Removable Storage Key considerations: Data files only One password per CD/DVD Up to 12 levels of nested folders One session per disc Will not block unencrypted writes from other burning applications Leverages SEE policies: Encryption Encryption Method Group Key Administrative Data Recovery Certificate Auto copying of Access utility 24

25 Endpoint Encryption Removable Storage Administrative access to encrypted data Lost / destroyed password User left company Recovery Key Certificate distributed with software install Administrator controls private key Requires Certificate Authority but not PKI 25

26 Symantec Endpoint Encryption Management Server Application services: deployment, policy management, reporting, database operations, directory services integration (LDAP) Web services: IIS enabled client communications Client / Server Communications SOAP over HTTP SOAP over HTTPS (optional) Database Microsoft SQL Server 2005 (Express Edition with Advanced Services, Standard Edition, Enterprise Edition) Familiar, robust, and scalable data management Enables fast and comprehensive reporting 26

27 Deployment and administration Server installation Standard MSI installer packages SEE Management Server (SEEMS) Microsoft Internet Information Service (IIS) Microsoft SQL Server 2005 (Express, Standard or Enterprise) SEE Manager and administrative tools Client installation Standard MSI installer package Supports Active Directory, edirectory and non domain endpoints Supports installation through GPO or any enterprise software deployment tool E.g. Altiris, Tivoli, SMS, etc. Silent installation Automatically launches disk encryption Automatically reports back to server Escrows encrypted recovery keys Periodically reports state of encryption for all partitions Audit trail for validating endpoint state when it goes lost or missing 27

28 Multiple user and administrator accounts Supports multiple users Over 250+ registered users per endpoint Option for automatic user registration Supports public machines or kiosks No prompt for user during registration process Clear separation of administrative accounts and roles Server administration Installation, administration, password management Endpoint policy administration Creating and deploying security policies to endpoints Leverages Active Directory by using Group Policy Objects Assisting users with One Time Password access Help Desk personnel Read only access to OTP challenge/response keys Hands on endpoint administration User lockout recovery, data recovery, decryption Over 250+ Client Administrators per endpoint 28

29 Policy Administrators Symantec Endpoint Encryption Policy Administrators Create Client Setup (.msi) files and deploy to users computers Create and deploy policy updates to clients Audit clients with Symantec Endpoint Encryption Client Monitor Establish Symantec Endpoint Encryption Client Administrators 29

30 Client Administrators Symantec Endpoint Encryption Client Administrators Perform administrative tasks on clients Unregister users Extend a scheduled lockout condition Initiate data recovery operations Unlock a machine 30

31 Client reporting and Auditing The Group View and global reporting features display comprehensive audit information on the state of endpoint encryption 31

32 Operating system support Support for enterprise Windows 32 bit and 64 bit versions Client Microsoft Windows 2000 SP4 Microsoft Windows XP Professional SP 2 and SP 3, Tablet PC Microsoft Windows Vista R1 and SP 1 Business, Ultimate and Enterprise Editions Microsoft Windows 7 Professional, Ultimate, or Enterprise; 32 bit or 64 bit Server Microsoft Windows Server 2003 All service packs 32

33 Advanced management tools Comprehensive suite of administrative tools Remote machine access Supports Wake On Lan Pre boot authentication suppressed for machine maintenance Deployed by administrator policy or MSI Local machine access Enables local machine administration while disk remains encrypted Data recovery Enables local data recovery for failed or corrupted disks Uses escrowed recovery keys if local keys damaged Includes ability to force disk or partition decryption Forensic data recovery Integration with Guidant Software EnCase forensic data recovery solution 33

34 Security validations FIPS validated cryptographic library AES encryption algorithm Industry and government standard Fast symmetrical encryption algorithm Primarily used for data encryption and decryption SHA 1 hash algorithm One way hash Primarily used for credential and key management Securely encrypts user credentials in pre boot environment Pseudo random number generator Generates unique workstation keys for encryption Common Criteria EAL 1 validated, EAL 4 pending 34

35 NU TechTalk Symantec Series Upcoming Events NUIT Tech Talk Symantec Series Symantec Protection Suite September 28 Data Loss Prevention October 26 Altiris Overview November 30 Presentation Identifier Goes Here 35