PGP Whole Disk Encryption Training

PGP Whole Disk Encryption Training

Agenda WDE Overview Licensing Universal Server & Client Basics Installation Password Recovery OS Maintenance Support Questions 2

Whole Disk Encryption Protects against: personal computer loss / theft / compromise / improper disposed Reduces risk of data and loss of PII (personally identifiable information) Protects against loss of reputation Encrypts desktops, laptops, and removable media Enables business continuity without disrupting user productivity Demonstrates compliance to regulatory standards 3

Full Disk vs. File Encryption Unsecured File Encryption Encrypts individual files / folders Requires authentication to decrypt and access files Full Disk Encryption Encrypts entire hard drive Replaces Master Boot Record with pre-boot environment Decrypts automatically as files are accessed 4

Notebook with Sensitive Info Protected threat: theft or loss Whole disk encryption Best guarantee of protecting data Only protects on that drive (encryption doesn t follow the file when it is moved) New login prompt on boot

How it Works Encrypts entire drive Block by block (including unused space) Passphrase for key (or token) Boot sector replaced with encryption authentication process Drive decrypts and encrypts on read/write Key is in memory while running, wiped on sleep 6

PGP BootGuard 7

Doesn t protect from Hacking Malware Social engineering Users leaving computer unlocked Mishandling of sensitive information 8

Disk Encryption Policy Restricted SSN, CCN, ephi, PII, legally/contractually protected Confidential Access limited to a select group of employees, but not meeting restricted definition Required Portable with restricted Desktop with >500 restricted Recommended Portable with confidential Desktop with <500 restricted http://policies.emory.edu/5.12 9

Licensing Details Emory currently owns 1,501 PGP licenses. Many units have already committed to an initial license purchase. Each license is $45.50. Licensed per computer and not per user. Additional licenses may be purchased by sending a Remedy ticket or an email to securityteaml@listserv.emory.edu containing the following information: School/Division/Business Unit name. Requestor s contact information. Number of licenses being purchased. Smart Key number. 10

Server & Client Basics Server Linux based soft appliance provided by PGP. Maintains copies of any user keys. Provides encryption verification and auditing. Assigns user policies based on AD group membership. Client Most users will never interact with the client except to enroll. Client communicates with the server to report encryption status, synchronize any keys, reset recovery tokens, etc. Features can be enabled or disabled by policy. 11

Architecture EHC Domain Emoryunivad Domain LDAP Proxy PGP Server 1 PGP Server 2 F5 Load Balancer VIP ` Clients 12

Available Features WDE PGP Shredder securely erases files. PGP Zip create encrypted zip files and self-extracting executables. PGP Virtual Disk create virtual encrypted volumes (similar to TrueCrypt). 13

PGP Policies Assigned using LDAP attributes We will focus on AD groups Per user, not per computer Client configuration Available features Automatic or manual disk encryption Can end users create keys Can end users encrypt/decrypt other things 14

Administrative Access Aladdin USB etokens Windows only ~$40 each from CDW Add local user manually Whole disk recovery tokens Retrieved from server One-time use Admin password (future version) 15

Supported OS s Windows 2000, XP, Vista, 7 both 32 and 64 bit Use of PGP on Windows Server is not recommended Mac OS X 10.4-10.6 Linux PGP v10 supports some variants of Linux, but this has not been tested at Emory 16

Installation Overview Create policies on PGP server, associated with (emoryunivad, EHC) AD groups Installed via simple Windows MSI or Mac pkg installer Run chkdsk.exe /R on Windows clients Install on client, let end user enroll Client grabs policy associated with end user (based on AD group membership) Disk encryption starts automatically (if configured by policy) Additional users can be added to the system as necessary by adding a new passphrase user 17

Installation Caveats Active Directory groups must be created and associated with a policy prior to deployment. Do you need a delegated OU? The initial encryption process will find bad sectors if they exist. May also uncover failing disks. Run chkdsk.exe /R first. Make sure that the end user enrolls their system with the server - don t user your credentials. 18

A Word on Groups Be careful not to place users into multiple groups that control PGP policy enrollment. If you re creating a new group, please include PGP, your unit, and a descriptive item in the group name. E.g. EC-PGP-WDE Only, SOM- DOM-PGP-All Features. Be careful with users that you think might be using PGP in other schools (think faculty with dual appointments). 19

Password Recovery Unique, one time use recovery token for forgotten passphrases (Whole Disk Recovery Tokens) See documentation for full WDRT and forgotten passphrase steps. 20

OS Repair/Upgrades Special steps are required to upgrade the OS on systems encrypted with PGP. Decrypt boot drive. Uninstall PGP. Perform upgrade. Reinstall PGP and re-encrypt the boot drive. Any operation that makes a change to the MBR will require special planning. 21

Dual Booting OK as long as both OS support PGP and both have PGP Desktop installed. (Ex. Windows XP & Windows 7 on the same box) If dual booting Windows & Linux, the Linux partition must remain unencrypted (as of version 9). Neither of these scenarios has been tested and should probably be avoided if possible. 22

Getting the Software E-mail securityteaml@listserv.cc.emory.edu, or submit a Remedy ticket with the following information: Full path of the AD group(s) that you will use to manage PGP policy enrollment. Which policy features you want enabled. You will receive a reply confirming that your policy has been configured, along with a link to download the client software. 23

Where to go for Help Submit a Remedy ticket to the UTS Security Team to: Gain access to client installation software Request PGP policy changes Associate AD groups with policies Tier II troubleshooting Request WDRT administrator privileges Submit a Remedy ticket to the UTS Identity Management Team to: Request a delegated active directory OU In Health Care, contact Mike Chilcott or Mickey McKinney. 24

? 25