Sophos SafeGuard Enterprise Administrator Guide

SafeGuard Enterprise administrator help

Product version: 8.0

2

Contents

1 About SafeGuard Enterprise....................................................................................................4

1.1 What's New.................................................................................................................7

2 Installation .............................................................................................................................11

2.1 SafeGuard Enterprise components..........................................................................11

2.2 Getting started..........................................................................................................13

2.3 Setting up SafeGuard Enterprise Server..................................................................17

2.4 Setting up SafeGuard Enterprise Database.............................................................20

2.5 Setting up SafeGuard Management Center.............................................................33

2.6 Testing communication.............................................................................................44

2.7 Securing transport connections with SSL.................................................................46

2.8 Registering and configuring SafeGuard Enterprise Server......................................50

2.9 Creating configuration packages..............................................................................53

2.10 Setting up SafeGuard Enterprise on endpoints......................................................55

2.11 Installing the encryption software on Windows.......................................................58

2.12 Installing the encryption software on Mac OS X.....................................................70

2.13 About upgrading.....................................................................................................74

2.14 About migrating ......................................................................................................77

2.15 About uninstallation................................................................................................80

3 SafeGuard Management Center............................................................................................83

3.1 Logging on to the SafeGuard Management Center..................................................83

3.2 SafeGuard Management Center user interface.......................................................84

3.3 Language settings....................................................................................................86

3.4 Check database integrity..........................................................................................86

3.5 Working with policies................................................................................................86

3.6 Working with configuration packages.......................................................................92

4 Managing Mac endpoints.......................................................................................................96

4.1 Create configuration package for Macs....................................................................96

4.2 About SafeGuard Native Device Encryption for Mac................................................96

4.3 About SafeGuard File Encryption for Mac..............................................................101

4.4 Troubleshooting.......................................................................................................110

4.5 Inventory and status data of Macs..........................................................................112

5 Modules................................................................................................................................113

5.1 Synchronized Encryption........................................................................................113

5.2 Manage full disk encryption....................................................................................139

5.3 Location-based File Encryption..............................................................................150

5.4 Cloud Storage.........................................................................................................160

5.5 SafeGuard Data Exchange.....................................................................................166

5.6 SafeGuard Full Disk Encryption..............................................................................174

5.7 SafeGuard Configuration Protection.......................................................................224

6 Recovery..............................................................................................................................225

6.1 Synchronize full disk encryption keys with mobile devices ....................................225

6.2 Recovery for BitLocker............................................................................................225

6.3 Recovery key for Mac endpoints.............................................................................227

6.4 Virtual Clients..........................................................................................................228

6.5 Repair a corrupted Management Center installation..............................................230

6.6 Repair a corrupted database configuration.............................................................231

7 Advanced management .......................................................................................................233

7.1 Security recommendations.....................................................................................233

7.2 Working with multiple database configurations (Multi Tenancy)..............................235

7.3 SafeGuard Management Center - advanced..........................................................239

7.4 SafeGuard Enterprise Security Officers.................................................................251

7.5 Managing the organizational structure...................................................................266

7.6 Keys and Certificates..............................................................................................274

7.7 Company Certificate Change Orders.....................................................................283

7.8 Licenses..................................................................................................................285

7.9 Tokens and smartcards...........................................................................................290

7.10 Scheduling tasks...................................................................................................305

7.11 Auditing.................................................................................................................313

7.12 Policy types and their fields of applications..........................................................346

7.13 Troubleshooting.....................................................................................................383

7.14 SafeGuard Enterprise and self-encrypting, Opal-compliant hard drives..............402

8 Technical support..................................................................................................................405

9 Legal notices........................................................................................................................406

3

4

SafeGuard Enterprise

1 About SafeGuard Enterprise

SafeGuard Enterprise is a comprehensive data security solution that uses a policy-based encryption strategy to provide reliable data protection on workstations, network shares, and mobile devices.

It allows users to securely share information and work with files on Windows, Mac OS X, iOS, and Android devices with the help of the Sophos Secure Workspace app.

In the SafeGuard Management Center, you manage security policies, keys, and certificates using a role-based administration strategy. Detailed logs and report functions ensure that you always have an overview of all events.

On the user side, data encryption and protection against unauthorized access are the main security functions of SafeGuard Enterprise. SafeGuard Enterprise can be seamlessly integrated into the user's normal environment.

Synchronized Encryption - application-based File Encryption

Synchronized Encryption is built on two assertions – that all data is important and must be protected

(encrypted) and that encryption should be persistent wherever the data is located. In addition, important data should be encrypted automatically and transparently so that a user need not be bothered with having to decide whether or not to encrypt a file based on its perceived importance.

This very basic premise, that all data is important and must be protected, ensures that all data is encrypted seamless without user intervention. This allows the user to remain productive, have their data secure and follow their existing workflows, see

Synchronized Encryption (page 113).

Location-based File Encryption

■

Cloud Storage

Cloud storage services are useful to help users access their data, wherever they are, on whatever device they're using. Improving productivity of users is important, but it’s equally critical to ensure your sensitive information stays secure once it moves to the cloud. SafeGuard

Enterprise automatically and invisibly encrypts/decrypts files as they are uploaded or downloaded from cloud services.

■

Encrypts files uploaded to cloud storage services

■

Allows secure data sharing everywhere

■

Automatically detects and supports most popular cloud storage services such as Box,

Dropbox, OneDrive and Egnyte

■

Reads encrypted files using our free Sophos Secure Workspace app for iOS and Android

■

File Encryption

Encryption isn’t only for making sure data stays safe from prying eyes outside your business.

It’s also useful for enabling secure collaboration and controlling files inside it. SafeGuard

administrator help

Enterprise goes beyond simple folder permissions and guarantees that only the right people can read the right files while still allowing IT to manage files and backups.

■

Configures file encryption for shared folders

■

Makes sure only certain users or groups are able to access data

■

Doesn’t require any interaction from your users

■

Provides an extra layer of protection if/when your corporate servers move to the cloud

■

Data Exchange

SafeGuard Enterprise automatically and transparently encrypts files on removable media such as USB sticks, memory cards and CDs/DVDs.

■

Share encrypted data on removable media easily across your organization without impacting your users

■

Using a portable application and password, easily and securely share encrypted removable media with users not using SafeGuard Enterprise

■

Removable media whitelisting makes encryption management easier and more flexible

Full disk encryption

■

For UEFI platforms, use BitLocker managed by SafeGuard Enterprise for disk encryption. For these endpoints SafeGuard Enterprise offers enhanced Challenge/Response capabilities. For details on the supported UEFI versions and restrictions to SafeGuard BitLocker

Challenge/Response support, please see the Release Notes at http://downloads.sophos.com/readmes/readsgn_8_eng.html

.

Note: Whenever the description only refers to UEFI, it is mentioned explicitly.

■

For BIOS platforms you can choose between SafeGuard Full Disk Encryption and BitLocker encryption managed by SafeGuard Enterprise. The BIOS version comes with the BitLocker native recovery mechanism.

Note: If SafeGuard Full Disk Encryption or SafeGuard Power-on Authentication is mentioned in this manual, it refers to Windows 7 BIOS endpoints only.

The table shows which components are available.

Windows 7 BIOS

SafeGuard Full Disk

Encryption with SafeGuard

Power-on Authentication

(POA)

BitLocker with pre-boot authentication (PBA) managed by SafeGuard

SafeGuard C/R recovery for BitLocker pre-boot authentication (PBA)

YES YES

5

SafeGuard Enterprise

Windows 7 UEFI

Windows 8.1 BIOS

Windows 8.1 UEFI

Windows 10

Windows 10 Threshold

2

SafeGuard Full Disk

Encryption with SafeGuard

Power-on Authentication

(POA)

BitLocker with pre-boot authentication (PBA) managed by SafeGuard

SafeGuard C/R recovery for BitLocker pre-boot authentication (PBA)

YES YES

YES

YES

YES

YES

YES

YES

YES

Note: SafeGuard C/R recovery for BitLocker pre-boot authentication (PBA) is only available on 64-bit systems.

SafeGuard Full Disk Encryption with SafeGuard Power-on Authentication (POA) is the

Sophos module for encrypting volumes on endpoints. It comes with a Sophos implemented pre-boot authentication named SafeGuard Power-on Authentication (POA) which supports logon options like smartcard and fingerprint and a Challenge/Response mechanism for recovery.

BitLocker with pre-boot authentication (PBA) managed by SafeGuard is the component that enables and manages the BitLocker encryption engine and the BitLocker pre-boot authentication.

It is available for BIOS and UEFI platforms:

■

■

The UEFI version additionally offers a SafeGuard Challenge/Response mechanism for BitLocker recovery in case users forget their PINs. The UEFI version can be used when certain platform requirement are met. For example the UEFI version must be 2.3.1. For details, see the Release

Notes.

The BIOS version does not offer the recovery enhancements by the SafeGuard Challenge /

Response mechanism and serves also as fallback option in case the requirements for the

UEFI version are not met. The Sophos installer checks whether the requirements are met, and if not automatically installs the BitLocker version without Challenge/Response.

Protect your Macs

Data on a Mac is as valuable as data on a Windows PC, which makes it vital to include Macs in your data encryption strategy. SafeGuard Enterprise protects your Macs with file and disk encryption and ensures that the data on your Macs is secure at all times. It includes encryption capability for removable media, network file shares and cloud on Mac.

■

Manage file or disk encryption for Macs in the same Management Center as all other devices

■

Manage FileVault 2 encrypted devices

6

administrator help

■

Works in the background without impacting performance

■

Complete visibility and reporting on encryption status

For Mac endpoints the following modules are available. They are also managed by SafeGuard

Enterprise or at least report to the Management Center.

OS X 10.9

OS X 10.10

OS X 10.11

macOS 10.12

Synchronized Encryption

- application-based

Sophos SafeGuard File

Encryption

- location-based

Sophos SafeGuard Native Device

Encryption

- FileVault 2 management

YES

YES

YES

YES

YES

YES

YES

YES

YES

YES

YES

YES

Sophos Secure Workspace

Encryption keys from the SafeGuard Enterprise key ring can be made available in the Sophos

Secure Workspace (SSW) app managed by Sophos Mobile Control. Users of the app can then use the keys to decrypt and view documents, or to encrypt documents. These files can then be securely shared between all SafeGuard Enterprise and SSW users. For more information, see the Sophos Secure Workspace documentation .

1.1 What's New

■

Synchronized Encryption (page 113)

■

Application-based file encryption

■

■

■

Outlook add-in

Integration with Sophos Central Endpoint Protection - remove keys on compromised machines

Share key ring between Sophos SafeGuard Enterprise and Sophos Mobile Control

■

■

■

■

Synchronize full disk encryption keys with mobile devices

(page 225)

Enhanced Authentication - the .Unconfirmed Users group (page 8)

Improved Active Directory synchronization and autoregistration (page 9)

Improve Sophos SafeGuard by sending anonymous usage data (page 9)

7

SafeGuard Enterprise

1.1.1 Enhanced authentication - the .Unconfirmed Users group

Users who log on to SafeGuard Enterprise need to be authenticated against Active Directory before they have access to their key rings.

Note: If you use BitLocker managed by SafeGuard Enterprise you need to allow registration of new SGN users for Everybody:

1. In the Policies navigation area, create a new policy of the type Specific Machine Settings or select an existing one.

2. In the User Machine Assignment (UMA) section, go to the Allow registration of new SGN

users for setting and select Everybody from the drop-down list.

3. Go to Users and Computers and assign the policy to your user groups.

If users cannot be authenticated when they log on they will be moved to the .Unconfirmed Users group. This group is displayed in the global root node and in every domain or workgroup.

Possible reasons for which users cannot be authenticated when they log on are:

■

The user provided credentials that do not match the credentials stored in Active Directory.

■

The user is a local user on the endpoint.

■

The Active Directory authentication server is not reachable.

■

The user belongs to a domain that is not imported from Active Directory.

Note: These users will be added to the global .Unconfirmed Users group that is displayed directly below the Root node in Users and Computers.

■

The authentication failed due to an unexpected error.

■

See also Sophos knowledgebase article 124328 .

Note: Only Active Directory users can be authenticated. This requires that Active Directory is configured properly.

As long as users reside in the .Unconfirmed Users group they do not have access to their key rings.

If you click on an .Unconfirmed Users group, details of the users in the group are displayed in the Unconfirmed Users tab on the right-hand pane, for example, the reason why the user has been moved to this group.

The Client Status dialog on the users' endpoints displays unconfirmed user under SGN user

state:.

1.1.1.1 Confirm users

As a security officer you have to verify users in the .Unconfirmed Users group. If they are authorized users, you have to explicitly confirm them to allow access to their key rings. Without their key ring users cannot access encrypted data.

8

administrator help

To confirm users in the .Unconfirmed users group:

1. In the Management Center, select the .Unconfirmed Users group.

Users who have not been authenticated against Active Directory are listed. You can click on individual users to display detailed information in the right-hand pane.

2. Verify if users are allowed to access the SafeGuard Enterprise key ring.

3. If they are, select a user, right-click and click Confirm user in the context menu.

You can confirm all users in the .Unconfirmed Users group by selecting the group itself and clicking Confirm all users in the context menu.

Confirmed users will be moved to the correct Active Directory structure and will be able to access their key ring.

Note: Confirmation of users can also be performed via scripting API calls.

1.1.1.2 Log events for unconfirmed users

Events are logged when users are added to the .Unconfirmed Users group (event 2801) and when users have been confirmed successfully (event 2800). You can view a list of these events in the SafeGuard Management Center under Reports in the Event viewer.

1.1.2 Improved Active Directory synchronization and auto-registration

■

■

New customers are guided through the process of setting up a complete system by the

SafeGuard Management Center Configuration Wizard. The initial import of the Active Directory structure is done during initial configuration, see

Start initial SafeGuard Management Center configuration (page 35).

Added computers and users will be moved to the right OU/ group automatically and will immediately get the right policies and keys. A triggered AD synchronization is no longer needed in this case.

1.1.3 Improve Sophos SafeGuard by sending anonymous usage data

Sophos is continuously trying to improve SafeGuard Enterprise. Accordingly, clients regularly send anonymized data to Sophos. This data is exclusively utilized for improving the product. It cannot be used to identify customers or machines, and does not contain any other confidential information. For more information, see Sophos knowledgebase article 123768 .

Sending data to Sophos is optional. Because all data is sent anonymized, the data collection function is enabled by default.You can disable the function in the SafeGuard Management Center

(Policies > General Settings > Feedback > Improve Sophos SafeGuard

®

by sending anonymous usage data).

9

SafeGuard Enterprise

1.1.3.1 Create policy to disable sending anonymous usage data

To disable sending anonymous usage data:

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

The General Settings tab is displayed.

2. Go to the Feedback section.

3. From the Improve Sophos SafeGuard

®

by sending anonymous usage data drop-down list, select No.

4. Go to Users and Computers and assign the new policy to your user groups.

The function is now disabled. No usage data will be sent to Sophos.

10

administrator help

2 Installation

Note: Available features depend on the type of license you have. For information on what is included in your license, contact your sales partner.

2.1 SafeGuard Enterprise components

This section provides an overview of the SafeGuard Enterprise components and explains how they interact.

The minimum modules in order to build up a working SafeGuard Enterprise infrastructure are:

■

SafeGuard Enterprise Database

■

■

■

■

SafeGuard Enterprise Server

SafeGuard Management Center

SafeGuard Enterprise Client

SafeGuard Enterprise Web Helpdesk

A Microsoft SQL database stores information about the clients (endpoints) on the company network. The Master Security Officer (MSO) uses the SafeGuard Management Center to manage the database contents and to create new security instructions (policies).

The endpoints read the policies from the database and report to the database. The communication between the database and the endpoints is maintained by an Internet Information Services (IIS) based web server which has the SafeGuard Enterprise Server installed on it.

11

SafeGuard Enterprise

12

The table below describes the individual components:

Component Description

SafeGuard Enterprise

Database(s) based on Microsoft

SQL Server Database

The SafeGuard Enterprise Database(s) hold all relevant data such as keys/certificates, information about users and computers, events and policy settings. The database(s) need to be accessed by the SafeGuard

Enterprise Server and by only one security officer through the SafeGuard

Management Center, usually the Master Security Officer. The SafeGuard

Enterprise Database(s) can be generated and configured using a wizard or scripts.

SafeGuard Enterprise Server on

IIS based web server

SafeGuard Enterprise Server runs as an application on a Microsoft Internet

Information Services (IIS) based web server and enables communication between the SafeGuard Enterprise database and the SafeGuard

administrator help

Component Description

Enterprise endpoint. On request, the SafeGuard Enterprise Server sends policy settings to the endpoints. It requires .NET Framework 4.5 and

ASP.NET 4.5.

When choosing SSL as transport encryption method for the client-server communication, the Basic Authentication role needs to be installed.

SafeGuard Management Center on administrator computer

Central management tool for SafeGuard Enterprise protected endpoints, used for managing keys and certificates, users and computers, and for creating SafeGuard Enterprise policies. The SafeGuard Management

Center communicates with the SafeGuard Enterprise Database. .NET

Framework 4.5 is required.

Directory Services (optional)

SafeGuard Enterprise encryption software on endpoints

Import of an Active Directory. It holds the company's organizational structure with users and computers.

Encryption software for data encryption and secure authentication.

SafeGuard Enterprise protected endpoints can either be connected to a

SafeGuard Enterprise Server (managed) or not connected to a SafeGuard

Enterprise Server at all (unmanaged). Managed endpoints receive their policies directly from the SafeGuard Enterprise Server. Unmanaged endpoints receive their policies inside configuration packages that can be deployed using third-party distribution mechanisms.

2.2 Getting started

This section guides you through a typical SafeGuard Enterprise installation with best practice examples and recommendations. It is designed for system/network/database administrators installing SafeGuard Enterprise (SGN) and describes a setup that is focused on the best possible security and performance with regards to the communication between the single components.

The document describes a domain situation in which all machines are members of the same domain. As a result of this, operating system specific tasks may differ when using other software or a workgroup environment.

■

First-time installation: The SGN Install Advisor simplifies the first time installation of the management components including default policies. To launch the SGN Install Advisor for a new SafeGuard Enterprise installation, start

SGNInstallAdvisor.bat

from your product delivery. A wizard guides you through installation.

■

Update installation: Follow the steps described here:

About upgrading

(page 74).

2.2.1 What are the key steps?

Before you can deploy any SafeGuard Enterprise Client, a working backend is required.

Consequently, we recommend adhering to the installation steps described below.

13

SafeGuard Enterprise

Note: SafeGuard Enterprise for Windows does not support Apple hardware and cannot be installed in a Boot Camp environment. Instead, use a virtual Windows client.

You find all SafeGuard Enterprise components (.msi packages) in the product delivery.

Step

1

2

3

4

5

6

7

8

9

Description Package/Tool

Download the installers (see

Sophos knowledgebase article

111195 ).

Install .NET Framework and

ASP.NET 4.6.1 as well as the

Basic Authentication role.

Set up Internet Information

Services (IIS) for SafeGuard

Enterprise (see

Installing and configuring Microsoft Internet

Information Services (IIS)

(page

18)).

Install SafeGuard Enterprise

Server.

Configure Microsoft SQL Server database authentication for the

SafeGuard Enterprise Master

Security Officer (see

Database authentication (page 21)).

SGNServer.msi

Generate the SafeGuard

Enterprise Database(s) with a script.

SafeGuard Management Center

Configuration Wizard or scripts in product delivery

Install the SafeGuard Management

Center for central management of users, computers, policies, keys, and reports.

SGNManagementCenter.msi

Configure SafeGuard Management

Center: database and database server connections, certificates,

Master Security Officer credentials.

SafeGuard Management Center

Configuration Wizard

Register and configure SafeGuard

Enterprise Server: Create server configuration package and deploy it on the web server.

SafeGuard Management Center

Configuration Package Tool

14

administrator help

Step

10

11

12

13

Description Package/Tool

Create the organizational structure from Active Directory or manually.

SafeGuard Management Center

Prepare endpoints for encryption.

SGxClientPreinstall.msi

Create initial configuration package for endpoint configuration.

SafeGuard Management Center

Configuration Package Tool

Install encryption software and initial configuration package on endpoints.

For available packages, see

About managed and unmanaged endpoints

(page 55).

2.2.2 Check the system requirements

Before you deploy SafeGuard Enterprise, check the system requirements.

For hardware and software requirements, service packs and disk space required during installation as well as for effective operation, see the current release notes on the SafeGuard release notes landing page .

2.2.3 Download installers

1. Using the web address and download credentials provided by your system administrator, go to the Sophos website and download the installers. For more information, see Sophos knowledgebase article 111195 .

2. Store them in a location where you can access them for installation.

2.2.4 Language settings

The language settings for the setup wizards and the different SafeGuard Enterprise components are as follows:

Wizards

The installation and configuration wizards of the different installation packages use the language setting of the operating system. If the operating system language is not available for these wizards, they default to English automatically.

SafeGuard Management Center

You can set the language of the SafeGuard Management Center as follows:

■

In SafeGuard Management Center, click Tools > Options > General. Select Use user defined

language and select an available language.

15

SafeGuard Enterprise

■

Restart SafeGuard Management Center. It is displayed in the selected language.

SafeGuard Enterprise on endpoints

You set the language of SafeGuard Enterprise on endpoints in a policy of the type General

Settings in the SafeGuard Management Center, setting Customization > Language used on

client:

■

If the language of the operating system is selected, SafeGuard Enterprise uses the language setting of the endpoint's operating system. If the operating system language is not available in SafeGuard Enterprise, the SafeGuard Enterprise language defaults to English.

■

If one of the available languages is selected, SafeGuard Enterprise functions are displayed in the selected language on the endpoint.

2.2.5 Compatibility with other Sophos products

This section describes the compatibility of SafeGuard Enterprise 8.0 with other Sophos products.

2.2.5.1 Compatibility with SafeGuard LAN Crypt

SafeGuard Enterprise 8.0 can coexist with SafeGuard LAN Crypt 3.90.2 on one endpoint. Make sure you do not use older versions of SafeGuard LAN Crypt.

If SafeGuard LAN Crypt 3.90.2 is already installed:

1. Install the SafeGuard pre-installation package on the endpoint (Windows 7 only).

2. Install SafeGuard Data Exchange on the endpoint.

3. Install the SafeGuard client configuration package on the endpoint.

4. Restart the endpoint.

Note: During installation, a message informs you that the SGLC Profile Loader is already in use.

You can ignore this message. It is caused by the fact that SafeGuard LAN Crypt and SafeGuard

Enterprise share common components. The affected components will be updated upon restart.

If SafeGuard Enterprise 8.0 is already installed:

1. Install SafeGuard LAN Crypt 3.9 on the endpoint.

2. Restart the endpoint.

2.2.5.2 Compatibility with Sophos Enterprise Console

If you use Sophos Enterprise Console (SEC) to manage encryption, do not install the SafeGuard

Enterprise Server or a SafeGuard Management Center on the server where the SEC management server is installed.

2.2.5.3 Compatibility with Sophos Mobile Control

SafeGuard Enterprise collaborates with Sophos Mobile Control by sharing a common key ring.

This means that users can securely access files that are encrypted with any SGN key on their

16

administrator help mobile devices. Conversely, users can create files on their Secure Workspace app and open them on an SGN-protected computer.

Prerequisites:

■

■

■

Register the SMC server with its certificate at the SGN server in the Management Center

(Tools > Configuration Package Tool > Servers).

Establish a secure SSL/TLS connection between the servers. We strongly recommend using

TLS 1.2 encryption protocol to avoid known SSL attacks.

Use Active Directory so mobile users can be identified in SGN via their AD information.

2.2.6 General restrictions

Note the following general restrictions for SafeGuard Enterprise on endpoints:

■

SafeGuard Enterprise for Windows does not support Apple hardware and cannot be installed in a Boot Camp environment. Instead, use a virtual Windows client.

■

■

The SafeGuard full disk encryption (SafeGuard volume-based encryption and BitLocker support) modules do not support systems that are equipped with hard drives attached through an SCSI bus.

Fast User switching is not supported.

■

■

Operating SafeGuard Enterprise in a terminal server environment is not supported.

When using Intel Advanced Host Controller Interface (AHCI) on endpoints with POA, we recommend using slot 0 for the boot hard disk.

■

On Endpoints with POA, SafeGuard volume-based encryption for volumes that are located on

Dynamic Disks and on GUID Partition Table disks (GPT) is not supported. In such cases, installations are terminated. If such disks are found on the endpoint, they are not supported.

2.3 Setting up SafeGuard Enterprise Server

The SafeGuard Enterprise Server acts as the interface to the SafeGuard Enterprise Clients. Like the SafeGuard Management Center, it accesses the database. It runs as an application on a web server based on Microsoft Internet Information Services (IIS). Make sure you use the most recent version of IIS.

For ideal security and performance, we recommend that you install SafeGuard Enterprise Server on a dedicated machine. This also ensures that other applications cannot conflict with SafeGuard

Enterprise.

SafeGuard Enterprise Server also includes the Task Scheduler to create and schedule periodic tasks that can be based on scripts. The tasks are automatically run on the SafeGuard Enterprise

Server. You find the scripts in the SafeGuard Enterprise product delivery.

17

SafeGuard Enterprise

2.3.1 Prerequisites

The following prerequisites must be met:

■

You need Windows administrator rights.

■

Microsoft Internet Information Services (IIS) must be available.

IIS is available for download on the Microsoft website.

■

If you use SSL transport encryption between SafeGuard Enterprise Server and SafeGuard

Enterprise Client, you have to set up the IIS for it in advance, see

Securing transport connections with SSL

(page 46).

■

A certificate must be issued and the IIS server configured to use SSL and point to the certificate.

■

■

■

The server name specified when configuring the SafeGuard Enterprise Server must be the same as the one specified in the SSL certificate. Otherwise, client and server cannot communicate.

For each SafeGuard Enterprise Server, a separate certificate is needed.

If you use Network Load Balancer, make sure that the port range includes the SSL port.

■

.NET Framework 4.5 and ASP.NET 4.5 (provided in the SafeGuard Enterprise product delivery) must be installed.

2.3.2 Installing and configuring Microsoft Internet Information Services (IIS)

The section explains how to prepare Microsoft Internet Information Services (IIS) to run with

SafeGuard Enterprise Server.

2.3.2.1 Install and configure IIS 7/7.5 on Microsoft Windows Server 2008/2008 R2

IIS is available for download on the Microsoft website.

1. On the Start menu, click All Programs > Administrative Tools > Server Manager.

2. In the Server Manager, click Roles > Add Roles.

3. In the Add Roles Wizard, on the Before you Begin page, verify the following:

■

The administrator account has a strong password.

■

The network settings, for example IP addresses, are configured.

■

The latest security updates from Windows Update are installed.

4. Select Select Roles on the right, and then select Web server (IIS). On the next page, click

Add Required Features. Web Server (IIS) is listed in the navigation area of the Add Roles

Wizard.

5. Click Web Server (IIS), then click Roles Services. Keep the default roles services.

6. On the right, additionally select the following: ASP.NET, which also selects the necessary sub-role services.

18

administrator help

7. Select IIS Management Scripts and Tools that is needed for correct IIS configuration.

8. Click Next > Install > Close.

IIS is installed with a default configuration for hosting ASP.NET.

9. Check that the web page is displayed properly using http://< server name>. For further information, see: http://support.microsoft.com

.

2.3.2.1.1 Check .NET Framework registration on IIS 7

.NET Framework version 4.5 is required. You can find the program in the SafeGuard Enterprise product delivery.

To check whether it is installed correctly on IIS 7:

1. From the Start menu, select Run....

2. Enter the following command:

Appwiz.cpl

. All programs installed on the computer are displayed.

3. Check if .NET Framework Version 4.5 is displayed. If it is not displayed, install this version.

Follow the steps in the installation wizard and confirm all defaults.

4. To test that the installation is correctly registered, go to C:\Windows\Microsoft.NET\Framework.

Each installed version must be visible as a separate folder showing the version as folder name, for example "v 4.5".

2.3.2.1.2 Check ASP.NET registration on IIS 7

ASP.NET Version 4.5 is required.

1. To check that ASP.NET is installed and registered with the correct version, enter the command

aspnet_regiis.exe -lv at the command prompt.

Version 4.5 should be displayed for ASP.NET.

2.3.2.2 Install and configure IIS 8 on Microsoft Windows Server 2012/2012 R2

IIS is available for download on the Microsoft website.

1. On the Server Manager Dashboard, select Manage > Add Roles and Features.

2. In the Add Roles and Features Wizard, on the Before you Begin page, verify the following:

■

The administrator account has a strong password.

■

The network settings, for example IP addresses, are configured.

■

The latest security updates from Windows Update are installed.

3. Select Server Roles on the left hand pane and then select Web server (IIS). Click Add

Features in the displayed window. Web Server Role (IIS) is listed on the left hand pane of the Add Roles and Features Wizard.

4. In the left hand pane select Role Services under Web Server Role (IIS). Keep the default roles services.

5. Scroll down to the Application Development node and select:

■

■

■

ASP.NET 4.5

ISAPI Extensions

ISAPI Filters

19

SafeGuard Enterprise

Necessary sub-role services are selected automatically.

6. Under the Security node, select:

■

■

Basic Authentication

Windows Authentication

7. Click Next > Install > Close.

IIS is now installed with a default configuration for hosting ASP.NET on the Windows Server.

Confirm that the web server works using http://(Enter machine name without brackets). If the web page is not shown properly, please consult the Microsoft Knowledge Base

(http://support.microsoft.com) for further information.

2.3.3 Install SafeGuard Enterprise Server

After the IIS is configured, you can install SafeGuard Enterprise Server on the IIS server. You find the install package

SGNServer.msi

in the product delivery.

1. On the server where you want to install SafeGuard Enterprise Server, double-click

SGNServer.msi

. A wizard guides you through the necessary steps.

2. Accept the defaults on all subsequent dialogs. Task Scheduler is automatically installed with an installation of type Complete.

SafeGuard Enterprise Server including Task Scheduler is installed.

Note: To enhance performance, the connection of logged events is deactivated for the SafeGuard

Enterprise Database by default after installation of SafeGuard Enterprise Server. However, the connection of logged events is necessary for integrity protection of logged events. All entries in the event table are concatenated so that if an entry is removed this is evident and can be verified with an integrity check. To make use of integrity protection, you need to set the connection of

logged events manually. For further information, see Reports

(page 315).

To ensure that the installation has completed successfully, open the Internet Information Services

Manager (run

inetmgr

) and check if a web page named SGNSRV is now available.

2.4 Setting up SafeGuard Enterprise Database

SafeGuard Enterprise stores all relevant data such as keys, certificates, information about users and computers, events, and policy settings in a database. The SafeGuard Enterprise Database is based on Microsoft SQL Server.

Check the list of currently supported SQL Server types in the system requirements section of the current release notes in the Sophos knowledgebase article 112776 .

Note: When using the SQL Express Edition, remember the maximum file size limitation of the database given by Microsoft. In large environments, using the SQL Express Edition might be inappropriate.

You can set up the database either automatically during first-time configuration in the SafeGuard

Management Center or manually using the SQL scripts provided in your product delivery.

Depending on your enterprise environment, check which method to choose. For more information, see

Database access rights

(page 21).

20

administrator help

To enhance performance, the SafeGuard Enterprise Database may be replicated to several SQL

servers. To set up database replication, see Replicating the SafeGuard Enterprise Database

(page 29).

Multiple SafeGuard Enterprise Databases can be created and maintained for different tenants such as different company locations, organizational units or domains (multi tenancy). To configure multi tenancy, see

Multi Tenancy configurations

(page 35).

Note: We recommend that you operate a permanent online backup for the database. Back up your database regularly to protect keys, company certificates and User Machine Assignments.

Recommended backup cycles are, for example: after the data is first imported, after major changes or at regular intervals, for example every week or every day.

2.4.1 Database authentication

To access the SafeGuard Enterprise Database, the SafeGuard Management Center's first security officer must be authenticated at the SQL Server. This can be done in the following ways:

■

Windows authentication: promote an existing Windows user to SQL user

■

SQL authentication: create an SQL user account

Find out from your SQL administrator which authentication method is appropriate for you, as a security officer. You need this information before generating the database and before first-time configuration in the SafeGuard Management Center Configuration Wizard.

Use SQL authentication for computers that are not part of a domain, but otherwise use Windows authentication. If you use SQL authentication, we highly recommend that you secure the connection

to and from the database server with SSL. For further information, see Set up SSL

(page 47).

2.4.1.1 Database access rights

SafeGuard Enterprise is set up in such a way that, to work with the SQL database, it only needs a single user account with minimum access rights for the database. This user account is used by the SafeGuard Management Center and is only issued to the first SafeGuard Management Center security officer. This guarantees the connection to the SafeGuard Enterprise Database. While

SafeGuard Enterprise is running, a single SafeGuard Management Center security officer only needs read/write permission for the SafeGuard Management Center Database.

The SafeGuard Enterprise Database can either be created manually or automatically during first-time configuration in the SafeGuard Management Center. If it is created automatically, extended access rights for the SQL database (db_creator) are needed for the first SafeGuard

Management security officer. However, these rights can be revoked afterwards by the SQL administrator until the next install/update.

If extending permissions during SafeGuard Management Center configuration is undesirable, the

SQL administrator can generate the SafeGuard Enterprise Database with a script. The two scripts included in the product delivery, CreateDatabase.sql and CreateTables.sql, can be run for this purpose.

The following table shows the necessary SQL permissions for Microsoft SQL Server.

21

SafeGuard Enterprise

SQL Server 2012, SQL Server 2012 Express

Create database

Server

Master database

SafeGuard Enterprise Database

Use database

Server

Master database

SafeGuard Enterprise Database

Access Right db_creator

None db_ownerpublic (default)

None

None db_datareader db_datawriter public (default)

2.4.1.2 Configure a Windows account for SQL Server logon

The description of the individual configuration steps below is aimed at SQL administrators and relates to Microsoft Windows Server 2008 and Microsoft SQL Server 2014 Standard or Express

Edition.

As an SQL administrator, you need the right to create user accounts.

1. Open SQL Server Management Studio. Log on to the SQL Server with your credentials.

2. Open the Object Explorer, right-click Security, point to New and then click Login.

3. In Login - New on the General page, select Windows authentication.

4. Click Search. Find the respective Windows user name and click OK. The user name is displayed as Login name.

5. In Default Database, if a script has not been used to create a SafeGuard Enterprise Database yet, select Master.

6. Click OK.

22

administrator help

7. To create the database automatically during SafeGuard Management Center first-time configuration, you have to change the access rights as follows: In Login - New, assign the access rights/roles by clicking Server Roles on the left. Select dbcreator. Once SafeGuard

Enterprise has been installed, the database role can be reset to dbowner.

2.4.1.3 Create an SQL account for SQL Server logon

Every user that should be able to use the SafeGuard Management Center must have a valid SQL

User account when using Windows authentication to connect to the SafeGuard database.

The description of the individual configuration steps below is aimed at SQL administrators. It relates to Microsoft Windows Server 2008 (all editions) with Microsoft SQL Server 2008 Standard

Edition.

As an SQL administrator, you need the right to create an SQL user account.

1. Open SQL Server Management Studio. Log on to the SQL Server with your credentials.

2. Open the Object Explorer, right-click Security and select New > Login.

3. In Login - New on the General page, select SQL Server authentication.

23

SafeGuard Enterprise

4. On the General page, in Login name, do the following: a) Enter the name of the new user, for example SGN SQLSERVICE.

b) Enter and confirm a password for the account.

c) Clear Enforce password policy.

d) In Default Database, if a script has not been used to create a SafeGuard Enterprise

Database yet, select Master. Click OK.

Take a note of the authentication method and the credentials.You have to inform the SafeGuard

Management Center security officer about them.

24

administrator help

5. To create the database automatically during SafeGuard Management Center first-time configuration, you have to change the access rights as follows: In Login - New on the General page, assign the access rights/roles by clicking Server Roles on the left. Select dbcreator.

Once SafeGuard Enterprise has been installed, the database role can be reset to dbowner.

The SQL user account and the access rights are now set up for the SafeGuard Enterprise security officer.

2.4.2 Generating the SafeGuard Enterprise Database

After setting up the user account for the SQL Server logon you need to generate the SafeGuard

Enterprise Database. There are two ways to do so:

■

Using SafeGuard Management Center Configuration Wizard

As a security officer, you can easily create the SafeGuard Enterprise Database during first-time configuration in the SafeGuard Management Center. The SafeGuard Management Center

Configuration Wizard takes you through the basic configuration, which also includes database creation. To do so, install and configure SafeGuard Management Center, see

Setting up

25

SafeGuard Enterprise

SafeGuard Management Center (page 33), and then change the relevant access rights, see

Change access rights for the SafeGuard Enterprise Database (page 27).

■

Using SQL scripts provided in the product delivery

This procedure is preferable if extended SQL permissions during SafeGuard Management

Center configuration are not desirable.

It depends on your enterprise environment which method should be applied. It is best to agree this between SQL administrator and SafeGuard Enterprise security officer.

2.4.2.1 Prerequisites

The following prerequisites must be met:

■

Microsoft SQL Server must already be installed and configured. Microsoft SQL Express Edition is suitable for use in smaller companies, as there are no license fees.

■

For performance reasons Microsoft SQL Server should not be installed on the computer on which SafeGuard Enterprise Server is installed.

■

Database authentication methods and database access rights should be clarified.

2.4.2.2 Generate SafeGuard Enterprise Database with a script

If you want to create the SafeGuard Enterprise Database automatically during SafeGuard

Management Center configuration, you can skip this step. If extended SQL permissions during

SafeGuard Management Center configuration are not desirable, carry out this step. Two database scripts are provided in the product delivery (Tools folder) for this purpose:

■

CreateDatabase.sql

■

CreateTables.sql

The description of the steps below is aimed at SQL administrators and relates to Microsoft SQL

Server 2008 Standard Edition.

As SQL administrator, you need to have the right to create a database.

1. Copy the scripts CreateDatabase.sql and CreateTables.sql from the SafeGuard Enterprise product delivery to the SQL Server.

2. Double-click the CreateDatabase.sql script. Microsoft SQL Server Management Studio is launched.

3. Log on to the SQL Server with your credentials.

4. Check that the two target paths at the beginning of the script, under FILENAME (MDF, LDF), exist on the local hard drive. Correct them if necessary.

5. Click Execute from the toolbar to generate the database. You have created the database

SafeGuard. Next use the CreateTables.sql script in the product delivery to generate the tables.

6. Double-click CreateTables.sql . A further pane is opened in Microsoft SQL Server Management

Studio.

7. At the top of the script, enter

use SafeGuard

to select the SafeGuard Enterprise Database in which the tables are to be created.

26

administrator help

8. Click Execute from the Toolbar to generate the tables.

The SafeGuard Enterprise Database and the associated tables have been created.

2.4.3 Change access rights for the SafeGuard Enterprise Database

When the SafeGuard Enterprise Database has been created, the user account must be granted access to the database. These access rights are required for all security officers who work with the SafeGuard Management Center when Windows NT authentication is used. As it is possible to assign different roles and permissions to a user on a database, only the minimum required ones are described.

1. Open the SQL Server Management Studio. Log on to the SQL Server with your credentials.

2. Open the Object Explorer, double-click Security, and then double-click Logins.

3. Right-click the respective user name and click Properties.

4. Select User Mapping on the left. Under Users mapped to this login, select the database

SafeGuard.

5. Under Database role membership for set the minimum access rights to use the SafeGuard

Enterprise Database: select db_datareader, db_datawriter and public.

6. Click OK.

2.4.4 Check SQL Services, named pipes, and TCP/IP settings

In order to install the SafeGuard Management Center, it is required that the SQL Browser Service is running and that Named Pipes and TCP/IP are enabled. These settings are required to access the SQL server from other machines. This can be checked in the SQL Server Configuration

Manager. The description relates to Microsoft Windows Server 2008 (R2) and Microsoft SQL

Server 2012 Standard or Express Edition.

1. Open SQL Server Configuration Manager.

2. From the navigation tree on the left, select SQL Server Services.

3. Make sure that the State of both SQL Server and SQL Server Browser is Running and that

Start mode is set to Automatic.

4. From the navigation tree on the left, select SQL Server Network Configuration and select the current instance.

5. Right-click the protocol Named Pipes and click Enabled.

6. Right-click the protocol TCP/IP and click Enabled.

7. Additionally, right-click the protocol TCP/IP and click Properties. On the IP Addresses tab, under IPAll, leave TCP Dynamic Ports blank. Set TCP Port to 1433.

8. Restart the SQL Services.

2.4.5 Create Windows Firewall rule on Windows Server

This section relates to Microsoft Windows Server 2008 (R2) with Microsoft SQL Server 2012

Standard or Express Edition. When you use this configuration, carry out the steps below to ensure

27

SafeGuard Enterprise that a connection between SafeGuard Enterprise Database and SafeGuard Management Center can be established.

1. On the computer hosting the SQL Server instance, click Start, select Administrative Tools and then click Windows Firewall with Advanced Security.

2. From the navigation tree on the left, select Inbound Rules.

3. Click Action from the menu bar, and then click New Rule. The New Inbound Rule Wizard is launched.

4. On the Rule Type page, select Custom and click Next.

5. On the Program page, select the program and services this rule should apply to, and then click Next.

6. On the Protocol and Ports page, select TCP as Protocol type. For Local port, select Specific

Ports and enter

1433

. For Remote Port, select All Ports. Click Next.

7. On the Scope page, you can specify that the rule applies only to network traffic to or from the

IP addresses entered on this page. Configure as appropriate, and then click Next.

8. On the Action page, select Allow the connection, and click Next.

9. On the Profile page, select where to apply the rule, and click Next.

10. On the Name page, type a name and description for your rule, and click Finish.

2.4.6 Configure Windows authentication for SQL Server logon

This section relates to Microsoft Windows Server 2008 with Microsoft SQL Server 2012 Standard

Edition and IIS 7.

To enable communication between SafeGuard Enterprise Server and SafeGuard Enterprise

Database when using Windows authentication, the user must be made a member of Active

Directory groups. Local file permissions must be adjusted, and the SQL user account must be populated to the Application Pool of the IIS.

1. Select Start and then Run. Enter dsa.msc. Open the Active Directory Users and Computers snap-in.

2. In the navigation tree on the left, expand the domain tree and select Builtin.

3. Add the respective Windows user to the following groups: IIS_IUSRS, Performance Log Users,

Performance Monitor Users.

4. Exit the snap-in.

5. On the local file system, in Windows Explorer, right-click the C:\Windows\Temp folder and select Properties. In Properties, select the Security tab.

6. In Security, click Add, and enter the respective Windows user name in the Enter the object

names to select field. Click OK.

7. In Security, under Permissions click Advanced. In Advanced Security Settings for Temp dialog, on the Permission tab, click Edit. Then set the following permissions in the Object dialog to Allow: List folders / read data, Create files / write data, Delete.

8. Click OK, exit Temp Properties and then Windows Explorer.

9. Open Internet Information Services Manager.

10. In the Connections pane on the left, select Application Pools of the relevant server node.

11. From the Application Pools list on the right, select SGNSRV-Pool.

12. In the Actions pane on the left, select Advanced Settings.

28

administrator help

13. In Advanced Settings, under Process Model, for the Identity property, click the ... button.

14. In Application Pool Identity, select Custom account and click Set.

15. In Set Credentials, type the relevant Windows user name in the following form:

Domain\<Windows user name>

. Type and confirm the respective Windows password and then click OK.

16. In the Connections pane on the left, select the relevant server node and click Restart from the Actions pane.

17. In the Connections pane on the left, under the relevant server node, under Sites, Default

Web Sites, select SGNSRV.

18. On the SGNSRV home page, double-click Authentication.

19. Right-click Anonymous authentication and select Edit.

20. For Anonymous user identity, select Specific user and check that the user name is IUSR.

Correct it, if necessary.

21. Click OK.

Additional configuration when using a Windows account for SQL Server logon is now completed.

2.4.7 Replicating the SafeGuard Enterprise Database

To enhance the performance of the SafeGuard Enterprise Database it may be replicated to several

SQL Servers.

This section describes how to set up replication for the SafeGuard Enterprise Database in a distributed environment. It is assumed that you already have some experience in working with the replication mechanism in Microsoft SQL Server.

Note: Administration should only be carried out on the master database, not on the replicated databases.

Important:

The proposed solution does not describe database replication for the purposes of redundant failover, but for improving performance in multi-site scenarios.

2.4.7.1 Merge replication

Merge replication is the process of distributing data from Publisher to Subscribers, allowing the

Publisher and Subscribers to make updates independently, and then merging the updates between sites.

Merge replication allows various sites to work autonomously and at a later time merge updates into a single, uniform result. The initial snapshot is applied to Subscribers, and then Microsoft

SQL Server tracks changes to published data at the Publisher and at the Subscribers. The data is synchronized between servers continuously, at a scheduled time, or on demand. Because updates are made on more than one server, the same data may have been updated by the

Publisher or by more than one Subscriber. Therefore, conflicts can occur when updates are merged.

Merge replication includes default and custom choices for conflict resolution that you can define as you configure a merge publication. When a conflict occurs, a resolver is invoked by the Merge

Agent and determines which data will be accepted and propagated to other sites.

29

SafeGuard Enterprise

2.4.7.2 Setting up database replication

Setting up a replication for the SafeGuard Enterprise Database is described by means of an example based on Microsoft SQL Server.

In the example, SafeGuard Enterprise is administered exclusively from the database in Vienna.

Any changes are passed on by the SafeGuard Management Center to the databases in Graz and Linz by way of the replication mechanism in Microsoft SQL Server. Changes reported by the client computers through the web servers are also passed on to the Microsoft SQL Server by way of the replication mechanism.

2.4.7.2.1 Generate the master database

Set up the SafeGuard Enterprise master database first. In the example, this is the VIENNA database.

The procedure for generating the master database is the same as for a SafeGuard Enterprise installation without replication.

■

Generate the master database in the SafeGuard Management Center Configuration Wizard.

This procedure requires that the SafeGuard Management Center is already installed. For

further information, see Start initial SafeGuard Management Center configuration (page 35).

30

administrator help

■

Generate the master database with an SQL script.You find the scripts in your product delivery.

This procedure is often preferred if extended SQL permissions during SafeGuard Management configuration is not desirable. For further information, see

Generate SafeGuard Enterprise

Database with a script (page 26).

2.4.7.2.2 Generate the replication databases Graz and Linz

After setting up the master database, generate the replication databases. In the example, the replication databases are called Graz and Linz.

Note: Data tables and EVENT tables are held in separate databases. Event entries are not connected by default so that the event database can be replicated to several SQL Servers to enhance performance. If EVENT tables are connected, problems may arise during replication of the data records.

To generate the replication databases:

1. Create a publication for the master database in the Management Console of the SQL Server.

A publication defines the set of data that is to be replicated.

2. Select all tables, views and stored procedures for synchronization in this publication.

3. Create the replication databases by generating a subscription for Graz and a subscription for

Linz. The new Graz and Linz databases then also appear in the subscriptions SQL configuration wizard.

4. Close the SQL configuration wizard. The replication monitor shows whether the replication mechanism runs correctly.

5. Make sure to enter the correct database name in the first line of the SQL script. For example, use

Graz

or use

Linz

.

6. Generate the snapshots again using the Snapshot Agent.

The replication databases Graz and Linz have been created.

2.4.7.3 Install and register SafeGuard Enterprise Servers

To install SafeGuard Enterprise Server on the web servers proceed as follows.

1. Install SafeGuard Enterprise Server on server WS_1.

2. Install SafeGuard Enterprise Server on server WS_2.

3. Register both servers in the SafeGuard Management Center: On the Tools menu, click

Configuration Package Tool, and then click Servers. On the Servers tab, click Add.

4. You are prompted to add the server certificates

ws_1.cer

and

ws_2.cer

. You can find them in the

\Program Files\Sophos\Sophos SafeGuard\MachCert\

folder.These certificates are needed to create the appropriate configuration packages.

The SafeGuard Enterprise Servers are installed and registered.

31

SafeGuard Enterprise

2.4.7.4 Create the configuration packages for the Graz database

You need to create the configuration packages for the Graz database: one for server WS_1 to communicate with the Graz database and one for the SafeGuard Enterprise Clients Graz connecting to web service WS_1.

1. In the SafeGuard Management Center, on the Tools menu, click Options, and then click

Database.

2. Under Connection settings, select

WS_1

as Database Server and Graz as Database on

Server. Click OK.

3. On the Tools menu, click Configuration Package Tool, and then click Server Packages.

Select the

WS_1

server, select the output path and click Create Configuration Package.

4. Switch to the Managed client packages tab. Click Add Configuration Package and enter a name for the package. Under Primary Server, select the correct server the SafeGuard

Enterprise Clients Graz are to be connected to (

WS_1

). Select the output path and click Create

Configuration Package.

The SafeGuard Enterprise Server and Client configuration packages for the Graz database have been created in the defined location.

2.4.7.5 Create the configuration packages for the Linz database

You need to create the configuration packages for the Linz database: One for server WS_2 to communicate with the Linz database and one for the SafeGuard Enterprise Clients Linz connecting to web service WS_2.

1. In the SafeGuard Management Center, on the Tools menu, click Options, then click Database.

2. Under Connection settings, select

WS_2

as Database Server and Linz as Database on

Server. Click OK.

3. On the Tools menu, click Configuration Package Tool and then click Server Packages.

Select the

WS_2

server, select the output path and click Create Configuration Package.

4. Switch to the Managed client packages tab. Click Add Configuration Package and enter a name for the package. Under Primary Server select the correct server the SafeGuard

Enterprise Clients Linz are to be connected to:

WS_2

. Select the output path and click Create

Configuration Package. Click Close.

5. Link the SafeGuard Management Center to the Vienna database again: On the Tools menu, click Options, then click Database.

The SafeGuard Enterprise Server and Client configuration packages for the Linz database have been created in the defined location.

2.4.7.6 Install the SafeGuard Enterprise Server configuration packages

1. Install the server configuration package

ws_1.msi

on web service WS_1 which is to communicate with the Graz database.

2. Install the server configuration package

ws_2.msi

on web service WS_2 which is to communicate with the Linz database.

32

administrator help

3. Test the communication between the SafeGuard Enterprise Servers and these databases: a) On the computer with SafeGuard Enterprise Server installed, open Internet Information

Services (IIS) Manager.

b) In the tree structure, click Internet Information Services. Click "Servername", Web Sites,

Default Web Site. Check that the web page SGNSRV is available in the Default Web Site folder.

c) Right-click SGNSRV and click Browse. A list of possible actions is displayed on the right-hand side of the window.

d) From this list, select CheckConnection. The possible action is displayed on the right-hand side of the window.

e) To test the connection, click Invoke.

The following output indicates a successful connection test:

<Dataroot><WebService>OK</WebService><DBAuth>OK</DBAuth>

2.4.7.7 Set up the endpoint

To install the encryption software on endpoints, see

Installing the encryption software centrally

(page 62) .

Note: For configuration of the endpoints, make sure that you install the correct configuration package after installation:

1. Install the Graz configuration package on the endpoints that are to be connected to the Graz server WS_1.

2. Install the Linz client configuration package on the endpoints that are to be connected to the

Linz server WS_2.

2.5 Setting up SafeGuard Management Center

This section describes how to install and configure SafeGuard Management Center.

SafeGuard Management Center is the central administrative tool for SafeGuard Enterprise. You install it on the administrator computers that you intend to use for managing SafeGuard Enterprise.

SafeGuard Management Center can be installed on any computer on the network from which the

SafeGuard Enterprise Databases can be accessed.

SafeGuard Management Center supports multiple databases by using tenant-specific database configurations (Multi Tenancy).You are able to set up and maintain different SafeGuard Enterprise

Databases for different tenants such as company locations, organizational units or domains. To make management easier, these database configurations can also be exported to and imported from files.

33

SafeGuard Enterprise

2.5.1 Prerequisites

The following prerequisites must be met:

■

Make sure that you have Windows administrator rights.

■

.NET Framework 4.5 must be installed. It is provided in the SafeGuard Enterprise product delivery.

■

If you want to create a new SafeGuard Enterprise Database during SafeGuard Management

Center configuration, you need the necessary SQL access rights and credentials, see Database access rights (page 21).

2.5.2 Install SafeGuard Management Center

1. Start SGNManagementCenter.msi from the install folder of your product delivery. A wizard guides you through the necessary steps.

2. Accept the defaults in the subsequent dialogs except as follows: On the Select Installation

Type page, do one of the following:

■

For SafeGuard Management Center to support one database only, select Typical.

■

■

The Custom option allows users to choose which features will be installed.

For SafeGuard Management Center to support multiple databases (Multi Tenancy), select

Complete. For further information, see Multi Tenancy configurations

(page 35).

SafeGuard Management Center is installed. If necessary, restart your computer. Next you carry out initial configuration in the SafeGuard Management Center.

2.5.3 Configuring SafeGuard Management Center

The SafeGuard Management Center Configuration Wizard provides help with specifying the basic

SafeGuard Management Center settings and the database connections during the initial configuration. The wizard opens automatically when you start the SafeGuard Management Center for the first time after installation.

You may configure the SafeGuard Management Center for use with a single database or with multiple databases (Multi Tenancy).

The SafeGuard Management Center Help provides context-sensitive help as well as a full-text search. It is configured for full functionality of the help system content pages with JavaScript enabled in your browser. If JavaScript is disabled, you can still display and navigate the SafeGuard

Management Center help system. However, certain functionality such as the search cannot be displayed.

2.5.3.1 Prerequisites

The following prerequisites must be met:

■

Make sure that you have Windows administrator rights.

34

administrator help

■

Have the following information at hand. Where necessary, you can obtain this information from your SQL administrator.

■

■

■

SQL credentials.

The name of the SQL Server which the SafeGuard Enterprise Database is to run on.

The name of the SafeGuard Enterprise Database, if it has already been created.

2.5.3.2 Multi Tenancy configurations

You are able to configure different SafeGuard Enterprise Databases and maintain them for one instance of the SafeGuard Management Center. This is particularly useful when you want to have different database configurations for different domains, organizational units or company locations.

For each database (tenant), you need to set up a separate SafeGuard Enterprise Server instance.

Each database must be the same version. For example, it is not possible to manage SGN 7 databases and SGN 8 databases with a single SGN 8 Management Center.

To make configuration easier, you can import previously created configurations from files, or export newly created configurations to be reused later.

To configure SafeGuard Management Center for Multi Tenancy, first carry out initial configuration and then proceed with further specific configuration steps for Multi Tenancy.

Note: The feature Multi Tenancy must have been installed with an installation of type Complete.

2.5.3.3 Start initial SafeGuard Management Center configuration

After installation of the SafeGuard Management Center, you need to carry out initial configuration.

You need to do so in Single Tenancy as well as in Multi Tenancy mode.

To start the SafeGuard Management Center Configuration Wizard:

1. Select SafeGuard Management Center from the Start menu. The Configuration Wizard is launched and guides you through the necessary steps.

2. On the Welcome page, click Next.

2.5.3.4 Configure the database server connection

A database is used to store all SafeGuard Enterprise specific encryption policies and settings.

For the SafeGuard Management Center and the SafeGuard Enterprise Server to be able to communicate with this database, you must specify an authentication method for the database access, either Windows NT authentication or SQL authentication. If you want to connect to the database server with SQL authentication, make sure that you have the required SQL credentials at hand. Where necessary, you may obtain this information from your SQL administrator.

On the Database Server Connection page, do the following:

1. Under Connection settings, select the SQL database server from the Database Server list.

All computers on a network on which a Microsoft SQL Server is installed are listed. If you cannot select the server, enter the server name or IP address with the SQL instance name manually.

35

SafeGuard Enterprise

2. Select Use SSL to secure the connection between SafeGuard Management Center and SQL database server. We strongly recommend that you do so if you select Use SQL Server

Authentication with the following credentials under Authentication, because this setting will encrypt the transport of the SQL credentials. SSL encryption requires a working SSL environment on the SQL database server which you have to set up in advance, see

Securing transport connections with SSL

(page 46).

3. Under Authentication, select the type of authentication to be used to access the database server instance.

■

Select Use Windows NT Authentication to use your Windows credentials.

Note: Use this type when your computer is part of a domain. However, additional mandatory configuration is required as the user needs to be authorized to connect to the database, see

Configure a Windows account for SQL Server logon (page 22) and

Configure Windows authentication for SQL Server logon

(page 28).

■

Select Use SQL Server Authentication with the following credentials to access the database with the relevant SQL credentials. Enter the credentials for the SQL user account that your SQL administrator has created. Where necessary, you may obtain this information from your SQL administrator.

Note: Use this type when your computer is not part of a domain. Make sure that you have selected Use SSL to secure the connection to and from the database server.

4. Click Next.

The connection to the database server has been established.

2.5.3.5 Create or select a database

On the Database Settings page, it is possible to either create a new database or to use an existing one. When the database has already been created by the SQL scripts, the wizard will automatically select the existing database. In this case, no further configuration is required.

If the database was not created beforehand, do the following:

1. Select Create a new database named and enter a name for the new database. To do this, you need the relevant SQL access rights, see

Database access rights (page 21). SafeGuard

Enterprise database names should only consist of the following characters to prevent localization issues: characters (A-Z, a-z), numbers (0-9), underscores (_).

2. Click Next.

2.5.3.6 Define Active Directory authentication

Before creating a new database, you can define all settings that are necessary to access an Active

Directory. In this step, you define server name and user credentials.

We recommend that you provide the Active Directory credentials at this stage so that the base structure of the Active Directory can be imported automatically. This import includes all containers that are synchronized with the SafeGuard Enterprise database including organizational units and groups. No computers or users are imported with this initial directory import, but all keys are created and assigned to the corresponding containers. After the import, the administrator can assign policies to different containers without executing a complete AD synchronization. Computers and users will receive their policies as soon as they are registered at the SGN server.

36

administrator help

If you do not yet have your credentials, you may skip this step and you can manually configure your Active Directory import later.

Note: For large enterprises with complex AD structures as well as for the handling of removed, changed, or moved objects, you need to use the LDAP Authentication wizard, see

Importing an Active Directory structure

(page 41).

1. On the Directory Authentication page, enter the server name or IP address.

2. We recommend using SSL for securing the connection between the SafeGuard Enterprise

Server and endpoints.

3. Define your user credentials.

4. Click Next.

After the SafeGuard Enterprise database has been created and the Initial Configuration wizard is complete, the base structure of the defined directory is imported to the database. All necessary keys are created and assigned to the corresponding containers.

2.5.3.7 Create the Master Security Officer (MSO)

As a security officer, you access the SafeGuard Management Center to create SafeGuard

Enterprise policies and configure the encryption software for the end users.

The Master Security Officer (MSO) is the top-level administrator with all the rights and a certificate that does not expire.

1. On the Security Officer Data page under Master Security Officer ID, enter a name for the

Master Security Officer, for example,

MSO

.

2. Under Certificate for Master Security Officer, do one of the following:

■

■

■

Create the Master Security Officer certificate

(page 37)

Import the MSO certificate (page 37)

Export the MSO certificate

(page 38)

2.5.3.7.1 Create the Master Security Officer certificate

In Create Master Security Officer Certificate, you create a password for the personal certificate store. The SafeGuard Enterprise Certificate store is a virtual store for SafeGuard Enterprise certificates. This store is not related to Microsoft functionality. The password defined in this step is the password that is used to log on to the Management Center afterwards.

1. Under Master Security Officer ID, confirm the Master Security Officer name.

2. Enter a password for the certificate store twice and click OK.

The MSO certificate is created and saved locally (<mso_name>.cer).

Note: Make a note of the password and keep it in a safe place. You need it to access the

SafeGuard Management Center.

2.5.3.7.2 Import the MSO certificate

If an MSO certificate is already available, you need to import it into the certificate store.

Note: A certificate cannot be imported from a Microsoft PKI. An imported certificate must have a minimum of 1024 bits and a maximum of 4096 bits. We recommend a certificate length of at least 2048 bits.

1. In Import authentication key file, click [...] and select the key file.

37

SafeGuard Enterprise

2. Enter the password for the key file.

3. Enter the password for the certificate store.

4. Confirm the password for the certificate store.

5. Click OK.

Certificates and private keys are now contained in the certificate store. Logging on to SafeGuard

Management Center then requires the password to the certificate store.

2.5.3.7.3 Export the MSO certificate

The MSO certificate is exported to a private key file (P12). In Export certificate, you define a password to protect this private key file. The private key file is needed to restore a broken

SafeGuard Management Center installation.

To export an MSO certificate:

1. In Export certificate, enter and confirm a password for the private key (P12 file). The password must consist of 8 alphanumeric characters.

2. Click OK.

3. Enter a storage location for the private key file.

The private key is created and the file is stored in the defined location (mso_name.p12).

Important: Create a backup of the private key (p12 file) and store it in a safe place right after initial configuration. In case of PC failure the key is otherwise lost and SafeGuard Enterprise has to be reinstalled. This applies to all SafeGuard generated security officer certificates.

As soon as the security officer certificate is exported and the certificate store and the security officer are created, the wizard proceeds with the creation of the company certificate.

2.5.3.8 Create the company certificate

The company certificate is used to differentiate between SafeGuard Management installations.

In combination with the MSO certificate, it allows you to restore a broken SafeGuard Enterprise

Database configuration.

1. On the Company Certificate page, select Create a new company certificate.

2. Enter your company name.

Note: Certificates generated by SafeGuard Enterprise, such as the company, machine, security officer, and user certificates are signed with hash algorithm SHA-256 for enhanced security in a first-time installation.

For endpoints with SafeGuard Enterprise older than 6.1, you must select SHA-1 under Hash

algorithm for generated certificates. For further information, see Change algorithm for self-signed certificates (page 280).

3. Click Next.

The newly created company certificate is stored in the database.

Create a backup of the company certificate and store it in a safe place right after initial configuration.

To restore a broken database configuration, see

Repair a corrupted database configuration

(page

43).

38

administrator help

2.5.3.9 Complete initial SafeGuard Management Center configuration

1. Click Finish to complete the initial configuration of SafeGuard Management Center.

A configuration file is created.

You have created the following:

■

A connection to the SafeGuard Enterprise Server.

■

A SafeGuard Enterprise Database.

■

A Master Security Officer account to log on to SafeGuard Management Center.

■

All necessary certificates to restore a corrupt database configuration or SafeGuard Management

Center installation.

SafeGuard Management Center is launched once the configuration wizard has closed.

2.5.4 Create further database configurations (Multi Tenancy)

Prerequisite: The feature Multi Tenancy must have been installed with an installation of type

Complete. SafeGuard Management initial configuration must have been carried out, see Start initial SafeGuard Management Center configuration (page 35).

Note: You need to set up a separate SafeGuard Enterprise Server instance per database.

To create a further SafeGuard Enterprise Database configuration after initial configuration:

1. Start the SafeGuard Management Center. The Select Configuration dialog is displayed.

2. Click New. The SafeGuard Management Center Configuration Wizard starts automatically.

3. The Wizard guides you through the necessary steps of creating a new database configuration.

Select the options as required. The new database configuration is generated.

4. To authenticate at the SafeGuard Management Center you are prompted to select the security officer name for this configuration and to enter their certificate store password. Click OK.

The SafeGuard Management Center is launched and connected to the new database configuration.

The next time the SafeGuard Management Center is started, the new database configuration can be selected from the list.

Note: For further tasks concerning Multi Tenancy, see Working with multiple database configurations (Multi Tenancy) (page 235).

2.5.5 Configure additional instances of the SafeGuard Management Center

You can configure additional instances of the SafeGuard Management Center to give security officers access for carrying out administrative tasks on different computers. SafeGuard

Management Center can be installed on any computer on the network from which the databases can be accessed.

SafeGuard Enterprise manages the access rights to the SafeGuard Management Center in its own certificate directory. This directory must contain all certificates for all security officers authorized

39

SafeGuard Enterprise to log on to the SafeGuard Management Center. Logging on to the SafeGuard Management

Center then requires only the password to the certificate store.

1. Install SGNManagementCenter.msi on a further computer with the required features.

2. Start SafeGuard Management Center on the computer. The Configuration Wizard is launched and guides you through the necessary steps.

3. On the Welcome page, click Next.

4. On the Database Server Connection page, under Database Server, select the required SQL database instance from the list. All database servers available on your computer or network are displayed. Under Authentication, activate the type of authentication to be used to access this database server instance. If you select Use SQL Server Authentication with the following

credentials, enter the SQL user account credentials that your SQL administrator has created.

Click Next.

5. On the Database Settings page, click Select an available database and select the relevant database from the list. Click Next.

6. In SafeGuard Management Center Authentication, select an authorized person from the list. If Multi Tenancy is enabled, the dialog shows the configuration the user will log on to. Enter and confirm the password for the certificate store.

A certificate store is created for the current user account and is protected by this password.

You only need this password for any subsequent logon.

7. Click OK.

You see a message that the certificate and private key have not been found or cannot be accessed.

8. To import the data, click Yes, and then click OK. This starts the import process.

9. In Import authentication key file, click [...] and select the key file. Enter the password for

key file. Enter the password for the certificate store previously defined in Cert. store password

or token PIN. Select Import to certificate store, or select Copy to token to store the certificate on a token.

10. Enter the password once more to initialize the certificate store.

Certificates and private keys are now contained in the certificate store. Logging on to the SafeGuard

Management Center then requires the password to the certificate store.

2.5.6 Logging on to SafeGuard Management Center

Logon to SafeGuard Management Center depends on whether you run it in Single Tenancy or in

Multi Tenancy mode.

2.5.6.1 Log on in Single Tenancy mode

1. Start SafeGuard Management Center from the Start menu. A logon dialog is displayed.

2. Log on as an MSO (Master Security Officer) and enter the certificate store password specified during initial configuration. Click OK.

SafeGuard Management Center is launched.

40

administrator help

Note: If you enter an incorrect password, an error message is displayed and a delay is imposed for the next logon attempt. The delay period is increased with each failed logon attempt. Failed attempts are logged.

2.5.6.2 Log on in Multi Tenancy mode

1. Start SafeGuard Management Center from the Start menu. The Select Configuration dialog is displayed.

2. Select the database configuration you want to use and click OK. The selected database configuration is connected to SafeGuard Management Center and becomes active.

3. You are prompted to select the Security Officer name for this configuration and to enter their certificate store password. Click OK.

SafeGuard Management Center is launched and connected to the selected database configuration.

Note: If you enter an incorrect password, an error message is displayed and a delay is imposed for the next logon attempt. The delay period is increased with each failed logon attempt. Failed attempts are logged.

2.5.7 Setting up the organizational structure in the SafeGuard Management

Center

There are two ways of mapping your organization in SafeGuard Enterprise:

■

Importing a directory service, for example an Active Directory.

During the synchronization with the Active Directory, objects such as computers, users, and groups are imported into the SafeGuard Management Center and stored in the SafeGuard

Enterprise Database.

■

Creating the company structure manually.

If there is no directory service available or if there are only few organizational units so that no directory service is needed, you can create new domains/workgroups which the user/computer can log on to.

You can use either one of these two options or combine them. For example, you can import an

Active Directory (AD) either partially or entirely, and create other organizational units (OUs) manually.

Note: When combining the two methods, the organizational units created manually are not mapped in the AD. If you want organizational units created in SafeGuard Enterprise to be mapped in the AD, you must add them to the AD separately.

For information on how to import or create an organization structure, see

Managing the organizational structure (page 266).

2.5.7.1 Importing an Active Directory structure

Note: An initial import is triggered by the SafeGuard Management Center Configuration Wizard, see

Define Active Directory authentication

(page 36).

41

SafeGuard Enterprise

42

SafeGuard Enterprise allows you to import an Active Directory structure into the SafeGuard

Management Center. During the synchronization with the Active Directory, objects such as computers, users, and groups are imported to the SafeGuard Management Center. All data is stored within the SafeGuard Database.

To configure the Active Directory, do the following:

1. Open the SafeGuard Management Center.

2. Authenticate using the password which was defined for the certificate store.

3. In the lower left-hand pane, select Users and Computers.

4. In the top left window, select Root [Filter is active].

5. In the right-hand pane, select the Synchronize tab. The LDAP Authentication wizard starts automatically.

6. In the LDAP Authentication wizard, enter the logon credentials you want to use for the synchronization and specify the server name or the IP address of the Domain controller. The user name must be in the format User@Domain to avoid issues resolving the domain NetBIOS name.

7. As soon as the directory connection is successfully established, the Directory DSN field shows the domain information. Click the magnifier symbol in order to read the Active Directory.

8. When the reading process is complete, the domain structure is displayed in the center pane.

Select the organizational units you want to import into SafeGuard Enterprise. It is not possible to select individual machines, groups, or user objects. However, it is possible to select organizational units.

9. Decide whether Active Directory group memberships should be synchronized with the

SafeGuard Management Center. The import of group memberships can be skipped by un-checking the Synchronize memberships box. Not importing and synchronizing group memberships has a positive impact on the performance of the Management Center (especially in large AD structures).

By default, SafeGuard Enterprise creates a key for every container, organizational unit (OU), and domain object that is imported. The creation of keys can be quite time consuming.

Therefore, especially when importing large environments, we recommend that you do not enable the key creation for groups if not required.

10. Start the synchronization by clicking Synchronize. The detailed information from the Active

Directory will now be read. At the end of the synchronization, a summary of all changes is displayed.

11. Click OK to write all changes into the SafeGuard Enterprise Database.

As soon as this is completed, the domain structure is displayed in the left-hand pane. The import of the Active Directory into the SafeGuard Management Center is now complete.

2.5.8 Importing the license file

SafeGuard Enterprise has an integrated license counter. When you download the product you can download a test license. This evaluation license includes five licenses for each module and needs to be imported into the SafeGuard Management Center. This enables the evaluation of other SafeGuard Enterprise components easily without any side effects. When purchasing

SafeGuard Enterprise, every customer receives a personalized license file for their company which needs to be imported into the SafeGuard Management Center.

For further information, see

Licenses (page 285).

administrator help

2.5.9 Repair a corrupted Management Center installation

A corrupted SafeGuard Management Center installation can easily be repaired, if the database is still intact. In this case, reinstall the SafeGuard Management Center and use the existing database as well as the backed up Master Security Officer certificate.

■

The company and Master Security Officer certificates of the relevant database configuration must have been exported to .p12 files. The data must be available and valid.

■

The passwords for the .p12 file as well as for the certificate store must be known to you.

To repair a corrupted SafeGuard Management Center installation:

1. Reinstall the SafeGuard Management Center installation package. Open the SafeGuard

Management Center. The Configuration Wizard is started automatically.

2. In Database Connection, select the relevant database server and configure the connection to the database if required. Click Next.

3. In Database Settings click Select an available database and select the relevant database from the list.

4. In Security Officer Data, do either of the following:

■

If the backed up certificate file can be found on the computer, it is displayed. Enter the password you use for authenticating at SafeGuard Management Center.

■

If the backed up certificate file cannot be found on the computer, select Import. Browse for the backed up certificate file and click Open. Enter the password for the selected certificate file. Click Yes. Enter and confirm the password for authenticating at the SafeGuard

Management Center.

5. Click Next, and then Finish to complete the SafeGuard Management Center configuration.

The corrupted SafeGuard Management Center installation is repaired.

2.5.10 Repair a corrupted database configuration

A corrupted database configuration can be repaired by installing SafeGuard Management Center afresh to create a new instance of the database based upon the backed up certificate files. This guarantees that all existing SafeGuard Enterprise endpoints still accept policies from the new installation.

■

The company and Master Security Officer certificates of the relevant database configuration must have been exported to .p12 files. The data must be available and valid.

■

The passwords for the two .p12 files as well as for the certificate store must be known to you.

Note: We only recommend this procedure if there is no valid database backup available. All computers that connect to a repaired backend lose their user-machine-assignment. As a consequence, Power-on Authentication is temporarily switched off. Challenge/Response mechanisms will not be available until the corresponding endpoint has successfully sent its key information again.

43

SafeGuard Enterprise

To repair a corrupted database configuration:

1. Reinstall the SafeGuard Management Center installation package. Open the SafeGuard

Management Center. The Configuration Wizard is started automatically.

2. In Database Connection, check Create a new database. Under Database settings, configure the connection to the database. Click Next.

3. In Security Officer Data, select the relevant MSO and click Import.

4. In Import Authentication Certificate browse for the backed up certificate file. Under Key file enter and confirm the password specified for this file. Click OK.

5. The MSO certificate is imported. Click Next.

6. In Company Certificate, check Restore using an existing company certificate. Click Import to browse for the backed up certificate file that contains the valid company certificate. You are prompted to enter the password specified for the certificate store. Enter the password and click OK. Click Yes in the message displayed.

The company certificate is imported.

7. Click Next and then Finish.

The database configuration is repaired.

2.6 Testing communication

When the SafeGuard Enterprise Server, the database, and the Management Center have been set up, we recommend running a connection test. This section contains the prerequisites and required settings for the connection test.

2.6.1 Ports/connections

The endpoints must create the following connections:

SafeGuard endpoint connection to

Port

SafeGuard Enterprise Server

Port 443 when using SSL transport connection

Port 80/TCP

The SafeGuard Management Center must create the following connections:

SafeGuard Management Center connection to

Port

SQL database

SQL Server 2012 dynamic port: Port 1433/TCP and Port 1434/TCP

44

administrator help

SafeGuard Management Center connection to

Port

Active Directory

SLDAP

Port 389/TCP

Port 636 for the Active Directory import

The SafeGuard Enterprise Server must create the following connections:

SafeGuard Enterprise Server connection to

Port

SQL database

Port 1433/TCP and Port 1434/TCP for SQL 2012 (Express) dynamic port

Active Directory Port 389/TCP

2.6.2 Authentication method

1. On the computer with SafeGuard Enterprise Server installed, open Internet Information

Services (IIS) Manager.

2. In the tree structure, select the relevant server and click Sites > Default Web Site > SGNSRV.

3. Under IIS, double-click the Authentication icon and check the following settings:

■

■

Set Anonymous Authentication to Enabled.

Set Windows Authentication to Disabled.

2.6.3 Set proxy server settings

Set the proxy server settings for web server and endpoint as follows:

1. In Internet Explorer, on the Tools menu, click Internet options. Then click Connections and click LAN settings.

2. In LAN Settings, under Proxy servers, clear Use a proxy server for your LAN.

If a proxy server is required, click Bypass proxy server for local addresses.

2.6.4 Check connection

1. On the computer with SafeGuard Enterprise Server installed, open Internet Information

Services (IIS) Manager.

2. In the tree structure, select the relevant server and click Sites > Default Web Site > SGNSRV.

45

SafeGuard Enterprise

3. Right-click SGNSRV, select Manage Application and click Browse to open the Sophos

SafeGuard Web Service page.

4. On the Sophos SafeGuard Web Service page, a list of possible actions is displayed. On this list, click CheckConnection and then click Invoke.

The following output indicates a successful connection test:

<Dataroot><WebService>OK</WebService><DBAuth>OK</DBAuth>

If communication between the SafeGuard Enterprise client and server is not working properly, see Sophos knowledgebase article 109662 .

2.7 Securing transport connections with SSL

SafeGuard Enterprise supports encrypting the transport connections between its components with SSL. You can use SSL to encrypt transport between the following components:

■

■

Database Server <-> SafeGuard Enterprise Server with IIS

Database Server <-> SafeGuard Management Center

■

SafeGuard Enterprise Server with IIS <-> managed endpoints

Note: Alternatively, the connection between the SafeGuard Enterprise Server and the SafeGuard

Enterprise managed endpoints can be secured by SafeGuard specific encryption. However, this is recommended for demo or test setups only. For ideal security and performance, we strongly recommend that you use SSL encrypted communication. If, for some reason, this is not possible and SafeGuard-specific encryption is used, there is an upper limit of 1000 clients that connect to a single server instance.

Note: Mac OS X clients can only use SSL.

Before activating SSL in SafeGuard Enterprise, a working SSL environment needs to be set up.

2.7.1 Prerequisites

For securing the communication between the SafeGuard Enterprise Server and the SafeGuard

Enterprise protected endpoint with SSL, a valid certificate is required. You can use the following certificate types:

■

■

A self-signed certificate, see

Using a self-signed certificate

(page 47).

A certificate issued by a PKI with a private or a public root certificate, see Using a PKI-generated certificate (page 47).

Technically it makes no difference whether you use a certificate with a public or a private root certificate.

Note: If a certificate created by a public PKI is available but not the PKI infrastructure, you cannot use this certificate to secure communication with SSL. In this case you need to set up a PKI infrastructure or create a self-signed certificate.

46

administrator help

2.7.1.1 Using a self-signed certificate

To create a self-signed certificate with SafeGuard Enterprise:

1. Open the Internet Information Services (IIS) Manager on the machine that hosts the SafeGuard

Enterprise Server and check the name of the server displayed at the top node.

2. On the machine with the SafeGuard Management Center installed, select Programs followed by Sophos, SafeGuard and SafeGuard Certificate Manager.

3. Open the SafeGuard Certificate Store.

4. To authenticate, use the same password that is used to log on to the SafeGuard Management

Center.

5. Click the Create new certificate button.

6. Enter a certificate name that corresponds to the machine identified at the top node in the

Internet Information Services (IIS) Manager.

7. Leave the key length at the default value.

8. Define a password and click OK.

9. Save the .cert and .p12 files in a location that can be reached by the machine that hosts the

IIS.

2.7.1.2 Using a PKI-generated certificate

If you want to use a PKI-generated certificate for SSL communication, create a certificate for the machine that is running the SafeGuard Enterprise Server. The following requirements apply:

■

■

The certificate name must correspond to the machine that is shown at the top node in the

Internet Information Services (IIS) Manager.

The certificate must be issued to the machine using its FQDN name. Make sure that the client is capable of resolving the FQDN per DNS.

Note: If only a certificate created by a public PKI, but no PKI infrastructure is available, you cannot use this certificate to secure communication with SSL. In this case you need to set up a

PKI infrastructure or create a self-signed certificate.

2.7.2 Set up SSL

The following general tasks must be carried out for setting up the web server with SSL:

■

Certificate Authority must be installed for issuing certificates used by SSL encryption.

■

A certificate must be issued and the IIS server configured to use SSL and point to the certificate.

■

The server name specified when configuring the SafeGuard Enterprise Server must be the same as the one specified in the SSL certificate. Otherwise client and server cannot communicate. For each SafeGuard Enterprise Server a separate certificate is needed.

■

If you use Network Load Balancer make sure that the port range includes the SSL port.

For further information, contact our technical support or see:

■ support.microsoft.com/en-us/kb/324069

47

SafeGuard Enterprise

48

■ support.microsoft.com/en-us/kb/316898

2.7.3 Activate SSL encryption in SafeGuard Enterprise

You may activate SSL encryption in SafeGuard Enterprise as follows:

■

Connection between web server and database server:

Activate SSL encryption when registering the SafeGuard Enterprise Server in the SafeGuard

Management Center Configuration Package Tool. For more information, see Configure the database server connection

(page 35) or see Sophos knowledgebase article 109012 .

■

Connection between the database server and SafeGuard Management Center:

Activate SSL encryption in the SafeGuard Management Center Configuration Wizard, see

Configure the database server connection

(page 35).

■

Connection between SafeGuard Enterprise Server and the SafeGuard Enterprise protected endpoint:

Activate SSL encryption when creating the configuration package for the managed endpoints

in the SafeGuard Management Center Configuration Package Tool, see Create configuration package for managed computers

(page 53). For information on how to configure the SafeGuard

Enterprise Server and the SafeGuard Enterprise protected endpoint to use SSL for securing

communication, see Set up the SafeGuard Enterprise Server (page 48).

You can set SSL encryption for SafeGuard Enterprise during first-time configuration of the

SafeGuard Enterprise components or later at any time. Create a new configuration package afterwards and deploy it on the relevant server or managed computer.

2.7.4 Set up the SafeGuard Enterprise Server

To configure the SafeGuard Enterprise Server to use SSL for securing communication between the server and the SafeGuard Enterprise protected endpoint, carry out the following general tasks:

1. Install the SafeGuard Management Center, see

Install SafeGuard Management Center (page

34).

2. Install the SafeGuard Enterprise Server, see

Install SafeGuard Enterprise Server (page 20).

3. Check the communication between the SafeGuard Enterprise Server and the SQL database using the invoke test.

After you have completed these configuration steps successfully, you import the certificate to use for SSL communication. You can use either a self-signed certificate or an existing one. If you have a PKI infrastructure in place, you can use a PKI-generated certificate.

2.7.5 Configure the endpoint to use SSL

To use SSL on the SafeGuard Enterprise protected endpoint, carry out the following steps:

1.

Assign a certificate

(page 49) to the client.

2. Create a client configuration package that includes SSL, see

Create configuration package for managed computers (page 53).

administrator help

2.7.6 Configure the SGNSRV web page to use SSL transport encryption

As soon as a valid certificate is available, follow the steps below to configure the SGNSRV web page for a certificate-secured connection.

Note: The following description refers to Microsoft Windows Server 2012.

1. Open Internet Information Services (IIS) Manager.

2. In the navigation pane, select the server that hosts the SGNSRV web page.

3. In the right-hand pane, select Server certificates from the IIS section.

4. From the Actions menu (on the right), select Import. The Import Certificate wizard is opened.

5. In the open dialog change the file extension to *.* and browse to the location where the .p12

and the .cer file are stored.

6. Select the .p12 file that was created before. If file extensions are disabled, please select the file with the description "Personal information Exchange”.

7. Enter the password and click OK.

The certificate is installed.

8. From the Connections pane on the left in the Internet Information Services (IIS) Manager, select the name of the server on which the certificate was installed.

9. Under Sites, select the site to be secured with SSL.

10. From the Actions menu on the right, select Bindings.

11. In the Site Bindings dialog, click Add binding.

12. Under Type:, select https and under SSL certificate:, select the certificate you installed before.

13. Click OK and close the Site Bindings dialog box.

14. In the navigation pane select the server and click Restart in the Actions pane.

2.7.7 Assign a certificate

There are several ways of assigning a certificate to an endpoint. One way is to assign it by using a Microsoft Group Policy, which is described in this section. If you want to use a different method, make sure that the certificate is stored in the local machine certificate store.

To assign a certificate by using Group Policy:

1. Open Group Policy Management console (

gpeditmc.msc

).

2. Create a new group policy object (GPO) to contain the certificate settings. Ensure that the

GPO is associated with the domain, site, or organizational unit which contains the users you want to manage with the policy.

3. Right-click the GPO, and then select Edit.

Group Policy Management Editor opens, and displays the current contents of the policy object.

4. In the navigation pane, open Computer Configuration > Windows Settings > Security

Settings > Public Key Policies > Trusted Publishers.

5. Click the Action menu, and then click Import.

6. Follow the instructions in the Certificate Import Wizard to find and import the certificate.

49

SafeGuard Enterprise

7. If the certificate is self-signed, and cannot be traced back to a certificate that is in the Trusted

Root Certification Authorities certificate store, then you must also copy the certificate to that store. In the navigation pane, click Trusted Root Certification Authorities, and then repeat steps 5 and 6 to install a copy of the certificate to that store.

2.8 Registering and configuring SafeGuard Enterprise Server

The SafeGuard Enterprise Server needs to be registered and configured to implement the communication information between IIS server, database, and SafeGuard protected endpoint.

The information is stored in a server configuration package.

You carry out this task in the SafeGuard Management Center. The workflow depends on whether

SafeGuard Enterprise Server is installed on the same computer as the SafeGuard Management

Center or on a different one.

You may set further properties such as add additional security officers for the selected server, or configure the connection to the database.

2.8.1 Register and configure SafeGuard Enterprise Server for the current computer

When SafeGuard Management Center and SafeGuard Enterprise Server are installed on the computer you are currently working on, register and configure SafeGuard Enterprise Server.

Note: This option is not available if Multi Tenancy is installed.

1. Start SafeGuard Management Center.

2. On the Tools menu, click Configuration Package Tool.

3. Select the Servers tab and then select Make this computer an SGN Server.

The Setup Wizard is started automatically.

4. Accept the defaults in all subsequent dialogs.

The SafeGuard Enterprise Server is registered. A server configuration package called

<Server>.msi

is created and directly installed on the current computer. The server information is displayed on the Servers tab. You may carry out additional configuration.

Note: If you want to install a new server configuration package (MSI) on the SafeGuard Enterprise

Server, make sure that you uninstall the old one first. Additionally, manually delete the local cache so that it can be updated correctly with new configuration data, such as SSL settings. Then install the new configuration package on the server.

2.8.2 Register and configure SafeGuard Enterprise Server for a different computer

When the SafeGuard Enterprise Server is installed on a computer other than the one where the

SafeGuard Management Center is installed, register and configure SafeGuard Enterprise Server:

1. Start SafeGuard Management Center.

2. On the Tools menu, click Configuration Package Tool.

50

administrator help

3. Select Servers tab and then click Add....

4. In Server Registration click [...] to select the server's machine certificate which can be found under

C:\Program Files (x86)\Sophos\SafeGuard Enterprise\MachCert

on the

IIS server that runs the SafeGuard Enterprise Server. Its file name is

<Computername>.cer

.

When the SafeGuard Enterprise Server is installed on a computer other than the one where the SafeGuard Management Center is installed, this .cer file must be accessible as a copy or by using a network permission.

Do not select the MSO certificate.

The fully qualified name (FQDN), for example

server.mycompany.com

and certificate information are displayed.

Note: When using SSL as transport encryption between an endpoint and the server, the server name specified here must be identical to the one specified in the SSL certificate.

Otherwise they cannot communicate.

5. Click OK.

The server information is displayed on the Servers tab.

6. Click the Server packages tab. The available servers are displayed. Select the required server.

Specify the output path for the server configuration package. Click Create Configuration

Package.

A server configuration package (MSI) called

<Server>.msi

is created in the specified location.

7. Click OK to confirm the success message.

8. On the Servers tab, click Close.

You have finished registering and configuring SafeGuard Enterprise Server. Install the server configuration package (MSI) on the computer running the SafeGuard Enterprise Server. You may change the server configuration on the Servers tab any time.

Note: If you want to install a new server configuration package (MSI) on the SafeGuard Enterprise

Server, make sure that you uninstall the old one first. Additionally, manually delete the local cache so that it can be updated correctly with new configuration data, such as SSL settings. Then install the new configuration package on the server.

2.8.3 Edit SafeGuard Enterprise Server properties

You can edit the properties and settings for any registered server and its database connection at any time.

1. On the Tools menu, click Configuration Package Tool.

2. Select Servers tab and then select the required server.

51

SafeGuard Enterprise

3. Carry out any of the following:

Element

Scripting allowed

Description

Click to enable the use of the SafeGuard Enterprise Management API.

This allows scripting of administrative tasks.

Win. Auth. WHD

Click to enable Windows Authentication for Web Helpdesk. By default, the option is disabled.

Server roles

Add server role...

Database connection

Click to select/deselect an available security officer role for the selected server.

Click to add further specific security officer roles for the selected server if required. You are prompted to select the server certificate. The security officer role is added and can be displayed under Server roles.

Click [...] to configure a specific database connection for any registered web server, including database credentials and transport encryption between the web server and the database server. For further information, see

Configure the database server connection (page 35).

Even if the database connection check has not been successful, a new server configuration package can be created.

Note:

You do not have to rerun the SafeGuard Management Center

Configuration Wizard to update the database configuration. Simply make sure that you create a new server configuration package afterwards and distribute it to the respective server. When the updated server package is installed on the server, the new database connection can be used.

4. Create a new server configuration package on the Server packages tab.

5. Uninstall the old server configuration package, then install the new one on the respective server.

The new server configuration becomes active.

2.8.4 Register SafeGuard Enterprise Server with Sophos firewall enabled

A SafeGuard Enterprise protected endpoint is unable to connect to SafeGuard Enterprise Server when a Sophos firewall with default settings is installed on the endpoint. By default, the Sophos firewall blocks NetBIOS connections which are needed for resolving the SafeGuard Enterprise

Server network name.

1. As a workaround, do one of the following:

■

Unblock NetBIOS connections in the firewall.

52

administrator help

■

Include the fully qualified name of the SafeGuard Enterprise Server in the server configuration package. For further information, see

Register and configure SafeGuard

Enterprise Server for a different computer (page 50).

2.9 Creating configuration packages

Depending on the required configuration, create the appropriate configuration packages for the endpoints in the SafeGuard Management Center:

■

For managed endpoints (Windows and Mac OS X) - Managed client packages

■

For unmanaged endpoints (Windows only) - Standalone client packages

Whenever you create a managed client package, the system produces both a package for Windows and a package (ZIP format) for Mac. The ZIP package is also used for the Sophos Mobile Control server to connect to the SafeGuard Enterprise backend.

The initial configuration package has to be installed on the endpoints with the encryption software.

2.9.1 Create configuration package for managed computers

1. In the SafeGuard Management Center, on the Tools menu, click Configuration Package

Tool.

2. Select Managed client packages.

3. In the Primary Server drop-down box, switch to the server which was registered.

4. If required, specify a policy group which must have been created beforehand in the SafeGuard

Management Center to be applied to the computers. If you want to use service accounts for post-installation tasks on the computer, make sure that you include the respective policy setting

in this first policy group, see Creating service account lists (page 54).

5. Select the Transport Encryption mode defining how the connection between SafeGuard

Enterprise Client and SafeGuard Enterprise Server is to be encrypted. For further information,

see Securing transport connections with SSL (page 46).

6. Specify an output path for the configuration package (MSI).

7. Click Create Configuration Package.

If you have selected SSL encryption as the Transport Encryption mode, the server connection is validated. If the connection fails, a warning message is displayed. You can ignore the message and create the client configuration package anyway. However, you have to ensure that the communication between the SafeGuard Client and the SafeGuard Server is possible using SSL.

The configuration package (MSI) has now been created in the specified directory. You now need to distribute and deploy this package to the endpoints.

2.9.2 Create configuration package for unmanaged computers

1. In the SafeGuard Management Center, on the Tools menu, click Configuration Package

Tool.

53

SafeGuard Enterprise

2. Select Standalone client packages.

3. Click Add Configuration Package.

4. Enter a name of your choice for the configuration package.

5. Specify a Policy Group which must have been created beforehand in the SafeGuard

Management Center to be applied to the computers.

6. Under Key Backup Location, specify or select a shared network path for storing the key recovery file. Enter the share path in the following form:

\\network computer\

, for example

\\mycompany.edu\

. If you do not specify a path here, the end user is prompted to name a storage location for this file when first logging on to the endpoint after installation.

The key recovery file (XML) is needed to enable recovery of SafeGuard Enterprise protected computers and is generated on each SafeGuard Enterprise protected computer.

Note: Make sure that you save this key recovery file at a file location accessible to the helpdesk.

Alternatively, the files can be provided to the helpdesk in a different way. This file is encrypted by the company certificate. It can therefore be saved to any external media or to the network to provide it to the helpdesk for recovery purposes. It can also be sent by e-mail.

7. Under POA Group, you can select a POA user group to be assigned to the endpoint. POA users can access the endpoint for administrative tasks after the Power-on Authentication has been activated. To assign POA users, the POA group must have been created beforehand in the Users and Computers area of the SafeGuard Management Center.

8. Specify an output path for the configuration package (MSI).

9. Click Create Configuration Package.

The configuration package (MSI) has now been created in the specified directory. You now need to distribute and deploy this package to the endpoints.

2.9.3 Creating service account lists

Note: This section is only relevant for endpoints with Power-on Authentication.

If you would like to install SafeGuard Enterprise with a central rollout, we recommend that you configure a service account list. Once an IT administrator is added to the service account list, they can log on to endpoints after the installation of SafeGuard Enterprise without activating the

Power-on Authentication (POA). This is advisable because normally the first user who logs on to an endpoint after installation is added to the POA as the primary account. Users included in a service account list, however, are treated as SafeGuard Enterprise guest users.

With service accounts the workflow is as follows:

■

SafeGuard Enterprise is installed on an endpoint.

■

After restarting the endpoint, a rollout operator included on a service account list logs on to the endpoint using the Windows logon prompt.

■

According to the service account list applied to the endpoint, the user is identified as a service account and is treated as a guest user.

■

The rollout operator is not added to the POA and the POA does not become active. The end user can log on and activate the POA.

54

administrator help

Note: You need to create service account lists in a policy and assign them to the first policy group of the first configuration package you install on the endpoint after the encryption software is

installed. For further information, see Service Account Lists for Windows logon

(page 187) .

2.10 Setting up SafeGuard Enterprise on endpoints

As soon as the back-end is running, the deployment and installation of the SafeGuard Enterprise

Clients can begin. We recommend following the preliminary steps described in this section to ensure a smooth implementation.

The SafeGuard Enterprise Client can be installed on different kinds of hardware and on different operating systems. A list of all supported operating systems and the minimum system requirements can be found in the Release Notes in Sophos knowledgebase article 112776 .

General recommendations for the preparation of your system for the installation of SafeGuard

Enterprise can be found in Sophos knowledgebase article 108088 .

2.10.1 About managed and unmanaged endpoints

SafeGuard Enterprise endpoints can be configured as follows:

■

Managed

Central server-based management in SafeGuard Management Center.

For managed endpoints, a connection to the SafeGuard Enterprise Server exists. They receive their policies through the SafeGuard Enterprise Server.

■

Unmanaged

Local management through configuration packages created in SafeGuard Management Center.

Note: Local management is not possible with Mac OS X.

Note: Synchronized Encryption is not available on unmanaged endpoints.

Unmanaged endpoints are not connected to the SafeGuard Enterprise Server and thus operate in standalone mode. They receive SafeGuard Enterprise policies by way of configuration packages instead.

SafeGuard Enterprise policies are created in the SafeGuard Management Center and exported to configuration packages. The configuration packages then need to be deployed by company software distribution mechanisms or installed manually on the endpoints.

Different installation packages and modules are provided for each type of endpoint.

2.10.2 Restrictions

Note the following restrictions for managed endpoints:

■

Restrictions for initial encryption:

Initial configuration of managed endpoints may involve the creation of encryption policies that may be distributed inside a configuration package to the SafeGuard Enterprise protected endpoints. However, when the endpoint is not connected to a SafeGuard Enterprise Server

55

SafeGuard Enterprise immediately after the configuration package is installed, but is temporarily offline, only encryption policies with the following specific settings become immediately active:

Volume-based full disk encryption that uses the Defined Machine Key as encryption key.

For all other policies involving encryption with user-defined keys to become active on the

SafeGuard Enterprise protected endpoint, the respective configuration package has to be reassigned to the endpoint's organizational unit as well. The user-defined keys are then only created after the endpoint is connected to SafeGuard Enterprise Server again.

This is because the Defined Machine Key is created directly on the SafeGuard Enterprise protected endpoint at the first restart after installation, whereas user-defined keys can only be created after the endpoint has been registered at the SafeGuard Enterprise Server.

■

Restrictions for BitLocker Drive Encryption support:

Either SafeGuard Enterprise volume-based encryption or BitLocker Drive Encryption can be used, but not both simultaneously. If you want to change the encryption type, you must first decrypt all encrypted drives, uninstall the SafeGuard Enterprise encryption software and then reinstall it with the features you want to use. The installer prevents the deployment of both features at the same time. Uninstallation and reinstallation is necessary even if no configuration package intended to trigger encryption has been installed.

2.10.3 Check the availability of the SSL certificate on the client

The certificate must be assigned to the computer and not to the user. The certificate file must be available in the Microsoft Certificate Store under Trusted Root Certification Authorities.

1. Log on to the endpoint as an administrator.

2. Click Run >

mmc

.

3. In the Console1 window, click the File menu and then click the Add/Remove Snap-in command.

4. In the Add/Remove Snap-in dialog box, select Certificates in the left pane and click Add.

5. On the Certificates snap-in page, select the Computer account option.

6. On the Select Computer page, select Local computer: (the computer this console is

running on) and click Finish.

7. Click OK in the Add/Remove Snap-in dialog box.

8. In the left pane, click Console Root > Certificates (Local Computer) > Trusted Root

Certification Authorities > Certificates.

9. In the right pane, check if the certificate which was created before is available in the store. If the certificate appears in the list, this step is completed. If not, do the following:

10. Click Run >

gpupdate /force

.

A Windows command box is displayed.

11. Wait until the box has closed and perform the above steps again starting at step 1.

56

administrator help

2.10.4 Prepare for BitLocker Drive Encryption support

If you want to use SafeGuard Enterprise to manage BitLocker endpoints, carry out the following specific preparations on the endpoint:

■

Windows 7 or higher must be installed on the endpoint.

■

BitLocker Drive Encryption must be installed and activated.

■

BitLocker Drive Encryption Service must be running.

Note: Run services.mcs

and check the status of BitLocker Drive Encryption Service.

■

If TPM is to be used for authentication, TPM must be initialized, owned and activated.

Note: Before you start the installation, decide if you want to use

BitLocker Drive Encryption (page

139) or SafeGuard Full Disk Encryption (page 174). You cannot install both at the same time.

2.10.5 Prepare for Cloud Storage

The SafeGuard Enterprise Cloud Storage module offers file-based encryption of data stored in the cloud.

Cloud Storage makes sure that local copies of cloud data are encrypted transparently and remain encrypted when stored in the cloud.

The way users work with data stored in the cloud is not changed. The vendor-specific cloud software remains unaffected and can be used in the same way as before to send data to or receive data from the cloud.

To prepare endpoints for Cloud Storage:

■

The cloud storage software provided by the vendor must be installed on the endpoints where you want to install Cloud Storage.

■

The cloud storage software provided by the vendor must have an application or system service stored on the local file system that synchronizes data between the cloud and the local system.

■

The cloud storage software provided by the vendor must store the synchronized data on the local file system.

Note: Cloud Storage only encrypts new data stored in the cloud. If data was already stored in the cloud before installing Cloud Storage, this data is not automatically encrypted. If it is to be encrypted, users first have to remove it from the cloud and then enter it again after Cloud Storage has been installed.

2.10.6 Prepare for SafeGuard Full Disk Encryption with POA

Before you deploy SafeGuard Enterprise, we recommend that you prepare as follows.

■

A user account must be set up and active on the endpoints.

57

SafeGuard Enterprise

■

Ensure that you have Windows administrator rights.

■

Create a full backup of the data on the endpoint.

■

■

Drives to be encrypted must be completely formatted and have a drive letter assigned to them.

Sophos provides a hardware configuration file to minimize the risk of conflicts between the

POA and your endpoint hardware. The file is contained in the encryption software package.

We recommend that you install an updated version of this file before any significant deployment of SafeGuard Enterprise. For more information, see Sophos knowledgebase article 65700 .

You can help us improve hardware compatibility by executing a tool that we provide to collect hardware relevant information only. The tool is very easy to use. The collected information is added to the hardware configuration file. For more information, see Sophos knowledgebase article 110285 .

■

Check the hard disk(s) for errors with this command:

chkdsk %drive% /F /V /X

After that, you need to reboot your system.

Important: Do not start the SafeGuard Enterprise installation without completing this reboot!

For more information, see Sophos knowledgebase article 107799 .

■

Use the Windows built-in defrag tool to locate and consolidate fragmented boot files, data files, and folders on local volumes. For more information, see Sophos knowledgebase article 109226 .

■

Uninstall third party boot managers, such as PROnetworks Boot Pro and Boot-US.

■

If an imaging tool was used to install the operating system, we recommend you to "re-write" the master boot record (MBR).

■

If the boot partition on the endpoint has been converted from FAT to NTFS and the endpoint has not been restarted since, restart the endpoint once. Otherwise the installation might not be completed successfully.

■

For SafeGuard Enterprise Clients (managed) only: Check whether there is a connection to the SafeGuard Enterprise Server. Select this web address in Internet Explorer on the endpoints: http://<ServerIPAddress>/sgnsrv. If the Trans page shows Check Connection, connection to SafeGuard Enterprise Server has been successfully established.

2.11 Installing the encryption software on Windows

Setting up SafeGuard Enterprise encryption software on endpoints can be done in two ways:

■

Install encryption software locally (attended). This is advisable for a trial installation, for example.

■

Install encryption software centrally (unattended). This ensures a standardized installation on multiple endpoints.

Before you start, check the available installation packages and features for managed and unmanaged endpoints. Installation steps for both variants are identical except that you assign a different configuration package for each of them.

58

administrator help

The behavior of the endpoints when first logging on after installing SafeGuard Enterprise and the activation of the Power-on Authentication is described in the SafeGuard Enterprise user help.

2.11.1 Installing packages and features

The following table shows the installation packages and features of the SafeGuard Enterprise encryption software on endpoints. You find the installation packages in the Installers folder of your product delivery.

The default installation (Complete or Typical) consists of BitLocker and Synchronized Encryption.

If you are not using any file encryption module, we recommend that you select a Custom installation and only install BitLocker full disk encryption.

Note that you can only install either Synchronized Encryption or location-based File Encryption, not both.

Note: When the operating system of the endpoint is Windows 64-bit, install the 64-bit variant of the installation packages (<package name>_x64.msi).

Package Content Available for managed endpoints

SGxClientPreinstall.msi

(Windows 7 only)

Pre-installation package

The package must be installed before installing any encryption installation package. Provides endpoints with necessary requirements for successful installation of the current encryption software.

mandatory

SGNClient.msi

SGNClient_x64.msi

SafeGuard client installation package

Provides endpoints with necessary requirements for successful installation of the current encryption software. For full disk encryption for internal and external hard disks, SafeGuard Enterprise offers the alternatives SafeGuard Full Disk

Encryption or BitLocker.

BitLocker or BitLocker C/R

SafeGuard Enterprise manages the

Microsoft BitLocker encryption engine. On

UEFI platforms, BitLocker pre-boot authentication comes with a SafeGuard

Challenge/Response mechanism whereas the BIOS version allows the retrieval of the recovery key from the SafeGuard

Management Center.

Select installation type Custom.

Available for unmanaged endpoints mandatory

59

SafeGuard Enterprise

Package Content

SafeGuard Full Disk Encryption (only

Windows 7 BIOS)

SafeGuard Full Disk Encryption includes

SafeGuard Power-on Authentication.

Select installation type Complete,

Typical, Custom.

Synchronized Encryption

Includes application-based file encryption and self-encrypting HTML functionality for automatically encrypting email attachments using Microsoft Outlook.

Cloud Storage

File-based encryption of data stored in the cloud. Local copies of data stored in the cloud are always encrypted transparently.

To send data to or receive data from the cloud, vendor-specific software must be used.

Select installation type Complete or

Custom.

File Encryption

File-based encryption of data on local hard disks and network shares, especially for workgroups.

Select installation type Complete or

Custom.

Data Exchange

SafeGuard Data Exchange: file-based encryption of data on removable media on all platforms without re-encryption.

Select installation type Complete or

Custom.

Available for managed endpoints

Available for unmanaged endpoints

60

administrator help

2.11.2 Install the encryption software locally

Prerequisites:

■

Endpoints must have been prepared for encryption, see

Setting up SafeGuard Enterprise on endpoints (page 55).

■

Decide which encryption package and features you need to install. For example, the

SGxClientPreinstall.msi

package is no longer required for Windows 8 or later. The steps related to the POACFG file are only relevant for Device Encryption with POA and BitLocker with Challenge/Response.

To install the encryption software locally:

1. Log on to the endpoint as an administrator.

2. Copy the

SGNClient_x64.msi

package and the

SGxClientPreinstall.msi

package to the client.

3. Install the

SGxClientPreinstall.msi

package to provide the endpoint with the necessary requirements for a successful installation of the current encryption software.

As an alternative to the

SGxClientPreinstall.msi

, you can install the Microsoft vcredist_x86.exe

package that is also available in the product delivery.

4. Install the vcredist14_x86.exe

from the product delivery.

5. Download the current POACFG file as described in Sophos knowledgebase article 65700 .

6. Save the latest version of the POACFG file centrally so that it is accessible from every endpoint.

7. Open a new administrative command line box on the client.

8. Change to the folder containing the SafeGuard installation files.

9. Start the installation using this command:

MSIEXEC /i <client.msi> POACFG=<path of the POA configuration file>

The SafeGuard Enterprise Client installation wizard starts.

10. In the wizard, accept the defaults on all subsequent dialogs.

In a first-time installation, we recommend that you select a Complete installation from the start. To only install a subset of features, choose a Custom installation.

11. Go to the location where you saved the relevant configuration package (MSI) created beforehand in the SafeGuard Management Center. Specific configuration packages need to be installed for managed and unmanaged endpoints, see

Creating configuration packages

(page 53).

12. Install the relevant configuration package (MSI) on the computer.

13. To activate Power-on Authentication, restart the endpoint twice.

14. Restart once more to perform a backup of the kernel data on every Windows boot. Make sure that the computer is not put into hibernation, sleep or hybrid sleep mode before the third restart to successfully complete the kernel backup.

SafeGuard Enterprise is set up on the endpoint. For more information on the computer's logon behavior after SafeGuard Enterprise installation, see the SafeGuard Enterprise user help .

61

SafeGuard Enterprise

2.11.3 Installing the encryption software centrally

Installing encryption software centrally ensures a standardized installation on multiple endpoints.

Note: Within central software distribution, the installation and configuration packages can only be assigned to an endpoint, they cannot be assigned to a user.

For a central installation, do the following:

■

Check the available encryption packages and features for managed and unmanaged endpoints,

see Installing packages and features (page 59).

■

■

■

■

Check the command-line options.

Check the list of feature parameters for the ADDLOCAL command-line option.

Check the sample commands.

Prepare the installation script.

2.11.3.1 Installing the encryption software centrally through Active Directory

Make sure that you do the following when installing the encryption software centrally using group policy objects (GPO) in an Active Directory:

Note: Within central software distribution, the installation and configuration packages can only be assigned to an endpoint, they cannot be assigned to a user.

■

Use a separate group policy object (GPO) for each installation package and sort them in the following order:

1. pre-installation package

2. encryption software package

3. endpoint configuration package

For further information on the packages, see

Prepare the installation script

(page 62).

■

When the endpoint language is not set to German, additionally do the following: in the Group

Policy Editor, select the respective group object and then Computer Configuration > Software

Settings> Advanced. In the Advanced Deployment Options dialog, select Ignore language

when deploying this package and click OK.

2.11.3.2 Prepare the installation script

Prerequisites:

■

Endpoints must have been prepared for encryption.

■

Decide which encryption package and features you want to install.

To install the encryption software centrally:

1. Create a folder called

Software

to use as a central store for all applications.

62

administrator help

2. Use your own tools to create a package to be installed on the endpoints. The package must include the following in the order mentioned:

Description Package

Pre-installation package

SGxClientPreinstall.msi

(Windows 7 only)

The mandatory package provides the endpoints with the necessary requirements for a successful installation of the current encryption software, for example the required DLL

MSVCR100.dll

.

Note: If this package is not installed, installation of the encryption software is aborted.

Encryption software package

For a list of available packages see

Installing packages and features

(page 59).

Configuration package for endpoints

Use the configuration packages created before in SafeGuard

Management Center. Different configuration packages need to be installed for managed and unmanaged endpoints, see

Creating configuration packages (page 53). Make sure that

you delete any old ones first.

3. Create a script with the commands for the pre-configured installation. The script must list which features of the encryption software you want to install, see

Feature parameters for ADDLOCAL option (page 65). Open a command prompt, and then type the scripting commands. For the

command-line syntax, see Command line options for central installation (page 64).

4. Distribute this package to the endpoints using company software distribution mechanisms.

The installation is executed on the endpoints. The endpoints are then ready to be used with

SafeGuard Enterprise.

5. To activate Power-on Authentication, restart the endpoint twice. Restart once more to perform a backup of the kernel data on every Windows boot. Make sure that the computer is not put into hibernation, sleep or hybrid sleep mode before the third restart to successfully complete the kernel backup.

Additional configuration may be required to ensure that Power-on Authentication (POA) functions correctly on each hardware platform. Most hardware conflicts can be resolved using the Hotkeys built into the POA. Hotkeys can be configured in the POA after installation or by an additional configuration setting passed to the Windows Installer command msiexec. For further information, see Sophos knowledgebase articles 107781 and 107785 .

2.11.3.3 Prepare for Synchronized Encryption

For the Synchronized Encryption module to work properly, the Microsoft runtime

vstor-redist.exe

must be installed. The file installs Microsoft Visual Studio 2010 Tools for

Office Runtime and is included in the installation package.

We recommend installing the components in the following order:

1.

vstor-redist.exe

2.

SGNClient.msi

63

SafeGuard Enterprise

3. configuration package

Note: You cannot deploy the configuration package before the installation of

vstor-redist.exe

is finished.

2.11.3.4 Command line options for central installation

For a central installation, we recommend that you prepare a script using the Windows Installer component msiexec

, which automatically carries out a pre-configured SafeGuard Enterprise installation.

Msiexec

is included in Windows. For further information, see https://msdn.microsoft.com/en-us/library/aa372024(v=vs.85).aspx

.

Command line syntax

msiexec /i <path+msi package name> / <SGN Features> <SGN parameter>

The command line syntax consists of:

■

Windows Installer parameters, which, for example, log warnings and error messages to a file during the installation.

■

SafeGuard Enterprise features to be installed, for example, full disk encryption.

■

SafeGuard Enterprise parameters, to specify the installation directory, for example.

Command line options

You can select all available options using msiexec.exe in the prompt. The main options are described below.

Option

/i

/qn

ADDLOCAL=

ADDLOCAL=ALL

Description

Specifies the fact that this is an installation.

Installs with no user interaction and does not display a user interface.

Lists the SafeGuard Enterprise features that are to be installed. If the option is not specified, all features intended for a standard installation are installed.

For a list of SafeGuard Enterprise features in each installation package and

availability according to endpoint configuration, see Installing packages and features

(page 59). For list of feature parameters for the ADDLOCAL option, see

Feature parameters for ADDLOCAL option (page 65).

Under Windows 7 (BIOS)

ADDLOCAL=ALL

installs the SafeGuard volume-based encryption and all other available features. Under Windows

64

administrator help

Option

REBOOT=Force |

ReallySuppress

/L*

<path + filename>

Description

8 or higher,

ADDLOCAL=ALL

installs BitLocker support and Synchronized

Encryption.

Forces or suppresses a restart after installation. If nothing is specified, the restart is forced after installation.

Logs all warnings and error messages in the specified log file. The parameter

/Le <path + filename>

only logs error messages.

Installdir=

<directory> Specifies the directory in which the SafeGuard Enterprise encryption software is to be installed. If no value is specified, the default installation directory is <SYSTEM>:\PROGRAM FILES\SOPHOS.

2.11.3.5 Feature parameters for ADDLOCAL option

You need to define in advance which features are to be installed on the endpoints. The feature names are added as parameters to the command-line option ADDLOCAL. List the features after typing the option

ADDLOCAL

in the command prompt:

■

Separate the features with a comma.

■

Observe uppercase and lowercase.

■

If you select a feature, you also need to add all feature parents to the command line.

■

■

Please note that the names of the features may differ from the corresponding module names.

You find them in the table below in brackets.

You must always list the features Client and CredentialProvider.

The following tables list the features that can be installed on the endpoints. For further information, see:

Installing packages and features (page 59).

Feature Parents

Client

Client, BaseEncryption

Feature

CredentialProvider

Mandatory. The feature enables logon with the Credential

Provider.

SectorBasedEncryption (SafeGuard volume-based encryption)

BitLockerSupport

Win 7 only: SectorBasedEncryption

65

SafeGuard Enterprise

Feature Parents Feature

Client, BaseEncryption BitLockerSupport (BitLocker)

Client, BaseEncryption, BitLockerSupport BitLockerSupportCR (BitLocker C/R)

NextGenDataProtection (Synchronized Encryption) Client, NextGenDataProtection

Client, LocationBasedEncryption

SecureDataExchange (Data Exchange)

Client, LocationBasedEncryption

Client, LocationBasedEncryption

FileShare (File Encryption)

CloudStorage (Cloud Storage)

2.11.3.6 Sample command: SafeGuard volume-based encryption with File Encryption

The command line does the following:

■

The endpoints are provided with the necessary requirements for successful installation of the current encryption software.

■

Logon to endpoints with Windows Credential Provider.

■

SafeGuard Enterprise Power-on Authentication (POA).

■

SafeGuard Enterprise volume-based encryption.

■

SafeGuard File Encryption with file-based encryption of data on local hard disk and network shares.

■

Configuration package that configures the endpoint as a managed endpoint and enables connection to the SafeGuard Enterprise Server.

■

Log files are created.

Sample command:

msiexec /i F:\Software\SGxClientPreinstall.msi /qn /log

I:\Temp\SGxClientPreinstall.log

msiexec /i F:\Software\SGNClient.msi /qn /log I:\Temp\SGNClient.log

66

administrator help

ADDLOCAL=Client,CredentialProvider,LocationBasedEncryption,FileShare

Installdir=C:\Program Files\Sophos\SafeGuard Enterprise msiexec /i F:\Software\SGNConfig_managed.msi /qn /log

I:\Temp\SGNConfig_managed.log

2.11.3.7 Sample command: SafeGuard BitLocker Support with Challenge/Response

The command line does the following:

■

The endpoints are provided with the necessary requirements for successful installation of the current encryption software.

■

Logon to endpoints with Windows Credential Provider.

■

SafeGuard BitLocker Support.

■

SafeGuard Challenge/Response for BitLocker recovery.

■

Configuration package that configures the endpoint as a managed endpoint and enables connection to the SafeGuard Enterprise Server.

■

Log files are created.

Sample command:

msiexec /i F:\Software\SGxClientPreinstall.msi /qn /log

I:\Temp\SGxClientPreinstall.log

msiexec /i F:\Software\SGNClient_x64.msi /qn /log

I:\Temp\SGNClient_x64.log

ADDLOCAL=Client,CredentialProvider,BitLockerSupport,BitLockerSupportCR

Installdir=C:\Program Files\Sophos\SafeGuard Enterprise msiexec /i F:\Software\SGNConfig_managed.msi /qn /log

I:\Temp\SGNConfig_managed.log

2.11.3.8 Sample command: SafeGuard BitLocker Support with Challenge/Response and File

Encryption

The command line does the following:

■

The endpoints are provided with the necessary requirements for successful installation of the current encryption software.

■

Logon to endpoints with Windows Credential Provider.

67

SafeGuard Enterprise

■

SafeGuard BitLocker Support.

■

SafeGuard Challenge/Response for BitLocker recovery.

■

SafeGuard File Encryption with file-based encryption of data on local hard disk and network shares.

■

Configuration package that configures the endpoint as a managed endpoint and enables connection to the SafeGuard Enterprise Server.

■

Log files are created.

Sample command:

msiexec /i F:\Software\SGxClientPreinstall.msi /qn /log

I:\Temp\SGxClientPreinstall.log

msiexec /i F:\Software\SGNClient_x64.msi /qn /log

I:\Temp\SGNClient_x64.log

ADDLOCAL=Client,CredentialProvider,BitLockerSupport,BitLockerSupportCR,FileShare

Installdir=C:\Program Files\Sophos\SafeGuard Enterprise msiexec /i F:\Software\SGNConfig_managed.msi /qn /log

I:\Temp\SGNConfig_managed.log

2.11.3.9 Sample command: Switch kernel loader

The POA kernel that is used with new installations is optimized for the use with NVMe drives.

When you boot a newly installed POA endpoint, the version number includes "RM" indicating that you are using the current "RM" kernel. You can, however, switch to the old "v86" kernel by using the following command:

Sample command:

msiexec.exe /i SGNClient.msi KERNELLOADER=v86

To switch back to the "RM" kernel, use the following:

Sample command:

msiexec.exe /i SGNClient.msi KERNELLOADER=RM

68

administrator help

2.11.4 FIPS-compliant installations

The FIPS certification describes security requirements for encryption modules. For example government bodies in the USA and in Canada require FIPS 140-2-certified software for particularly security-critical information.

SafeGuard Enterprise uses FIPS-certified AES algorithms, but by default, a new, faster implementation of the AES algorithms is installed that is not yet FIPS certified.

To use the FIPS certified variant of the AES algorithm, set the FIPS property to 1 (one) when installing the SafeGuard Enterprise encryption software.

You can do so by adding the property to the command line script: msiexec /i F:\Software\SGNClient.msi FIPS=1

Note: This only applies to SafeGuard Enterprise Device Encryption and Windows 7.

Note: If you want to upgrade an FIPS-compliant installation, please note that the new versions will be installed in FIPS-compliant mode as well, independently from the setting you select.

2.11.5 Installations on self-encrypting, Opal-compliant hard drives

SafeGuard Enterprise supports the vendor-independent Opal standard for self-encrypting hard drives and offers management of endpoints with hard drives of this type.

To ensure that the support of self-encrypting, Opal-compliant hard drives follows the standard closely, two types of check are carried out at the installation of SafeGuard Enterprise on the endpoint:

■

Functional checks

These include, among others, checking whether the drive identifies itself as an "OPAL" hard drive, whether communication properties are correct, and whether all Opal features required for SafeGuard Enterprise are supported by the drive.

■

Security checks

Security checks ensure that only SafeGuard Enterprise users are registered on the drive and that only SafeGuard Enterprise users own the keys used to software-encrypt non-self-encrypting drives. If other users are found to be registered at installation, SafeGuard Enterprise automatically tries to disable these users. This is a functionality required by the Opal standard with the exception of a few default "authorities" which are required to run an Opal system.

Note: The security checks are repeated when an encryption policy for the drive is applied after successful Opal-mode installation. If they fail, drive management must have been manipulated outside of SafeGuard Enterprise since the first check at installation. In this case,

SafeGuard Enterprise does not lock the Opal hard drive. A corresponding message will be displayed.

If any of these checks fail in an unrecoverable way, the installation does not fall back to software-based encryption. Instead all volumes on the Opal drive remain unencrypted.

69

SafeGuard Enterprise

From SafeGuard Enterprise version 7 onwards, no Opal checks are performed by default. This means that, although an Opal drive is present, SafeGuard Enterprise will encrypt volumes on this drive using software-based encryption.

If you want to force Opal checks, use the following command line syntax:

MSIEXEC /i <name_of_selected_client_msi>.msi OPALMODE=0

Note: An upgrade from SafeGuard Enterprise 6.x to SafeGuard Enterprise 7.0 on a system with an Opal HDD used in Opal HW-encryption mode will preserve the Opal HW-encryption mode.

Some Opal hard drives may have potential security issues. There is no way to automatically determine which privileges have been assigned to an unknown user/authority that has already been registered on the drive when SafeGuard Enterprise installation/encryption is carried out. If the drive refuses the command to disable such users, SafeGuard Enterprise falls back to software encryption to ensure maximum security for the SafeGuard Enterprise user. As we cannot give any security guarantees for the hard drives themselves, we have implemented a special installation switch to enable you to use drives which may have potential security risks at your own discretion.

For a list of hard drives for which this installation switch is necessary and for further information on supported hard drives, refer to the SafeGuard Enterprise Release Notes.

To apply the installation switch, use the following command line syntax:

MSIEXEC /i <name_of_selected_client_msi>.msi

IGNORE_OPAL_AUTHORITYCHECK_RESULTS=1

The internal property of the .msi has the same name, if you want to install it using a transform.

2.12 Installing the encryption software on Mac OS X

The following chapter describes the installation of Sophos encryption software for Mac OS X clients. The following products are available:

■

■

Sophos SafeGuard Native Device Encryption

Sophos SafeGuard File Encryption

For both products, two installation types are possible:

■ automated (unattended) installation

■ manual (attended) installation

If you want to use SafeGuard File Encryption and SafeGuard Native Device Encryption, both need to be version 8.

70

administrator help

2.12.1 Installation prerequisites

Before starting the installation, make sure the SafeGuard Enterprise-SSL server certificate has been imported into the system keychain and is set to Always Trust for SSL.

1. Ask your SafeGuard Server Administrator to provide you with the SafeGuard Enterprise server certificate for SSL (file <certificate name>.cer).

2. Import the <certificate name>.cer file into your keychain. To do so, go to Applications - Utilities and double-click the Keychain Access.app.

3. In the left pane, select System.

4. Open a Finder window and select the <certificate name>.cer file.

5. Drag and drop the certificate file into the System Keychain Access window.

6. Enter your Mac OS X password when prompted.

7. Click Modify Keychain to confirm your action.

8. In the Keychain Access.app, double-click the <certificate name>.cer.

9. Click on the arrow next to Trust to display the trust settings.

10. For Secure Sockets Layer (SSL), select the option Always Trust.

11. Close the dialog.

12. Enter your Mac OS X password and confirm by clicking Update Settings.

A blue plus symbol in the lower right corner of the certificate icon indicates that this certificate is marked as trusted for all users.

13. Open a web browser and enter

https://<servername>/SGNSRV

to verify that your

SafeGuard Enterprise Server is available.

Now you can start the installation.

Note:

Certificate import can also be done by running the command

sudo /usr/bin/security add-trusted-cert -d -k /Library/Keychains/System.keychain -r trustAsRoot

-p ssl "/<folder>/<certificate name>.cer"

. This can also be used for automated deployment via script. Change folder and certificate names according to your settings.

2.12.2 Automated installation of SafeGuard Native Device Encryption

An automated (unattended) installation does not require any user interaction during the installation process.

This section describes the basic steps for an automated installation of SafeGuard Native Device

Encryption for Mac. Use the management software installed on your system. Depending on the management solution you are using, the actual steps may vary.

To install SafeGuard Native Device Encryption for Mac on client computers, perform the following steps:

1. Download the installer file Sophos SafeGuard DE.dmg.

2. Copy the file to the target machines.

71

SafeGuard Enterprise

3. Install the file on the target machines. If you use Apple Remote Desktop, steps 2 and 3 are one single step.

4. Select the configuration zip file and copy it to the target machines (see Create configuration package for Macs

(page 94)).

5. Run the following command on the target machines:

/usr/bin/sgdeadmin --import-config /full/path/to/file.zip

6. Change /full/path/to/file according to your settings. This command needs to be run with administrator privileges. If you are using Apple Remote Desktop, then enter

root

in the field

user name to specify which user issues the above stated command.

Note:

For more information, see Sophos knowledgebase article 120507 .

2.12.3 Manual installation of SafeGuard Native Device Encryption

A manual (or attended) installation allows you to control and test the installation while proceeding step by step. It is performed on a single Mac.

1. Open Sophos SafeGuard DE.dmg.

2. After reading through the readme file, double-click Sophos SafeGuard DE.pkg and follow the installation wizard. You will be prompted for your password to allow the installation of new software. The product will be installed to the folder /Library/Sophos SafeGuard DE/.

3. Click Close to complete the installation.

4. After a restart, log on with your Mac password.

5. Open the System Preferences and click the Sophos Encryption icon to show the product settings.

6. Click the Server tab.

7. If server and certificate details are shown, skip the next steps go to step 11. If no information is shown, continue with the next step.

8. Select the configuration zip file (see

Create configuration package for Macs

(page 94)) and copy it to the target machines.

9. Drag the zip file to the Server dialog and drop it into the drop zone.

10. You will be prompted to enter a Mac administrator password. Enter the password and click

OK to confirm.

11. Check the connection to the SafeGuard Enterprise server: Company certificate details are shown in the lower part of the Server dialog. Then click Synchronize. A successful connection will result in an updated "Last Contacted" time stamp (Tab Server, Server Info area, Last

Contacted:). An unsuccessful connection will display the following icon:

For further information, refer to the system log file.

72

administrator help

2.12.4 Automated installation of SafeGuard File Encryption

An automated (unattended) installation does not require any user interaction during the installation process.

This section describes the basic steps for an automated installation of SafeGuard File Encryption for Mac. Use the management software installed on your system. Depending on the management solution you are using, the actual steps may vary.

To install SafeGuard File Encryption for Mac on client computers, perform the following steps:

1. Download the installer file Sophos SafeGuard FE.pkg.

2. Copy the file to the target machines.

3. Install the file on the target machines. If you use Apple Remote Desktop, steps 2 and 3 are one single step.

4. Select the configuration zip file and copy it to the target machines (see

Creating configuration packages (page 53)).

5. Run the following command on the target machines:

/usr/bin/sgdeadmin --import-config /full/path/to/file.zip

6. Change /full/path/to/file according to your settings. This command needs to be run with administrator privileges. If you are using Apple Remote Desktop, then enter

root

in the field

user name to specify which user issues the above stated command.

7. You can add additional steps to your workflow, based on your specific settings, for example shutting down the target machines.

Note: For more information, see Sophos knowledgebase article 120507 .

2.12.5 Manual installation of SafeGuard File Encryption

A manual (or attended) installation allows you to control and test the installation while proceeding step by step. It is performed on a single Mac.

1. Open Sophos SafeGuard FE.dmg.

2. After reading through the readme file, double-click Sophos SafeGuard FE.pkg and follow the installation wizard. You will be prompted for your password to allow the installation of new software. The product will be installed to the folder /Library/Sophos SafeGuard FS/.

3. Click Close to complete the installation.

4. Open the System Preferences and click the Sophos Encryption icon to show the product settings.

5. Click the Server tab.

6. If server and certificate details are shown, skip the next steps go to step 11. If no information is shown, continue with the next step.

7. Select the configuration zip file (see

Creating configuration packages

(page 53)) and copy it to the target machines.

8. Drag the zip file to the Server dialog and drop it into the drop zone.

73

SafeGuard Enterprise

9. You will be prompted to enter a Mac administrator password. Enter the password and click

OK to confirm.

10. Enter your Mac password to request your SafeGuard user certificate.

11. Check the connection to the SafeGuard Enterprise server: Company certificate details are shown in the lower part of the Server dialog. Then click Synchronize. A successful connection will result in an updated "Last Contacted" time stamp (Tab Server, Server Info area, Last

Contacted:). An unsuccessful connection will display the following icon:

Refer to the system log file for further information.

2.13 About upgrading

SafeGuard Enterprise 6.10 or newer can be directly upgraded to the latest version of SafeGuard

Enterprise. If you want to upgrade from older versions, you must first upgrade to version 6.10.

During an upgrade, you cannot make changes to the installed features or modules. If changes are required, run the installer of the version already in place again and modify the installation (see

About migrating

(page 77)).

For successful operation, version numbers of SafeGuard Enterprise Database, SafeGuard

Enterprise Server and SafeGuard Management Center must match. The following components are upgraded during an upgrade to the latest version of SafeGuard Enterprise. Carry out the upgrade in the order shown below:

1. SafeGuard Enterprise Server

2. SafeGuard Management Center

3. SafeGuard Enterprise Web Helpdesk

4. SafeGuard Enterprise protected endpoints

5. SafeGuard Enterprise configuration packages

By default, all File Encryption policies are converted to or treated as policies with Encryption

type set to Location-based.

Note: Once all SafeGuard Enterprise components and endpoints have been upgraded to version

8.0, we recommend that you switch to the more secure algorithm SHA-256 to sign SafeGuard

Enterprise-generated certificates.

2.13.1 Upgrade SafeGuard Enterprise Server

Prerequisites

■

SafeGuard Enterprise Server 6.10 or later must be installed. Versions below 6.10 must first be upgraded to SafeGuard Enterprise Server 6.10.

■

.NET Framework 4.5 and ASP.NET 4.5 (provided in the SafeGuard Enterprise product delivery) must be installed.

■

Make sure that you have Windows administrator rights.

74

administrator help

To upgrade SafeGuard Enterprise Server:

1. Install the latest version of the SafeGuard Enterprise Server installation package using

SGNServer.msi

.

As soon as all SafeGuard Enterprise components (Server, Management Center, Web Helpdesk) have been upgraded, you must restart the SafeGuard Enterprise Server.

2.13.2 Upgrade SafeGuard Management Center

Prerequisites:

■

SafeGuard Management Center 6.10 or later must be installed. Versions below 6.10 must first be upgraded to SafeGuard Management Center 6.10.

■

For successful operation, version numbers of SafeGuard Enterprise Database, SafeGuard

Enterprise Server and SafeGuard Management Center must match.

■

■

SafeGuard Management Center 8.0 can manage SafeGuard Enterprise-protected endpoints

6.0 and later.

.NET Framework 4.5 is required. It must be installed before the upgrade. It is provided in the

SafeGuard Enterprise product delivery.

■

Make sure that you have Windows administrator rights.

■

When upgrading from SafeGuard Enterprise 5.x to SafeGuard Enterprise 8.0, you need to manually import the default evaluation license for SafeGuard Cloud Storage and SafeGuard

File Encryption. This license file is provided in your product delivery.

To upgrade SafeGuard Management Center:

1. Install the latest version of the SafeGuard Management Center installation package with the

required features, see About migrating

(page 77).

2. Start the SafeGuard Management Center.

3. The system checks the version of the SafeGuard Enterprise database and upgrades to the new version automatically.

4. The system prompts you to back up your database prior to the update.

The SafeGuard Management Center and database are upgraded to the latest version.

After upgrading, do not transfer existing POA users to SafeGuard Enterprise-protected endpoints.

They would be interpreted as normal users in this case and registered as users on the respective endpoints.

If you have exported policies for backup reasons, export them again after upgrading SafeGuard

Management Center. Policies exported using older versions cannot be imported.

2.13.3 Upgrade SafeGuard Web Helpdesk

To upgrade the Web Helpdesk:

1. Make sure you have upgraded the SafeGuard Enterprise Server (

SGNServer.msi

).

75

SafeGuard Enterprise

2. Install the latest version of the

SGNWebHelpDesk.msi

.

As soon as all SafeGuard Enterprise components (Server, Management Center, Web Helpdesk) have been upgraded, you must restart the SafeGuard Enterprise Server.

2.13.4 Upgrade endpoints

This section applies to both managed and unmanaged endpoints.

Prerequisites

■

SafeGuard Enterprise encryption software version 6.10 or later must be installed. Older versions must first be upgraded to version 6.10.

■

SafeGuard Enterprise Database, SafeGuard Enterprise Server, and SafeGuard Management

Center must have been upgraded to the latest version. For successful operation, version numbers of SafeGuard Enterprise Database, SafeGuard Enterprise Server and SafeGuard

Management Center must match.

■

SafeGuard Management Center 8.0 and SafeGuard Enterprise Server 8.0 can manage

SafeGuard Enterprise protected endpoints version 6.0 or later. However, we recommend that you use the same version of encryption software on every endpoint.

■

Make sure that you have Windows administrator rights.

To upgrade SafeGuard Enterprise-protected endpoints:

1. Log on to the computer as an administrator.

2. Install the latest pre-installation package

SGxClientPreinstall.msi

that provides the endpoint with the necessary requirements for a successful installation of the new encryption software.

Do not uninstall previous pre-installation packages as they are updated automatically.

3. Install the latest version of the SafeGuard Enterprise encryption software. Depending on your installed version, a direct upgrade might not be supported. Older versions must be upgraded version by version until version 6.10 is reached.

Windows Installer recognizes the features that are already installed and only upgrades these.

If Power-on Authentication is installed, an updated POA kernel is also available after a successful update (policies, keys, etc.). SafeGuard Enterprise is automatically restarted on the computer.

4. To remove configuration protection completely, it is also necessary to uninstall SGNCPClient.msi

(or SGNCPClient_x64.msi).

5. After installation is completed, restart the endpoint when prompted.

The latest version of the SafeGuard Enterprise encryption software is installed on the endpoints.

Next, upgrade the endpoint configuration.

Note: You cannot make changes to your installed modules during an upgrade. If changes are

required, see About migrating

(page 77).

76

administrator help

2.13.5 Upgrade endpoint configuration packages

After upgrading the SafeGuard backend software, we strongly recommend to delete all old configuration packages for security reasons. New installations of the SafeGuard Client have to be done with an endpoint configuration package that was created using SafeGuard Management

Center version 8.0. Configuration packages generated with a previous version of the SafeGuard

Management Center are not supported.

Endpoint configuration packages on existing (already configured) endpoints need to be upgraded in the following cases:

■

At least one of the configured SafeGuard Servers has changed (applies to managed endpoints only).

■

■

The policies need to be changed (applies to standalone endpoints only).

To apply Certificate Change Orders (CCO).

■

When the hash algorithm that is used to sign the self-signed certificates is changed from

SHA-128 to SHA-256.

Note: For further information, see section Change algorithm for self-signed certificates.

Note: You cannot downgrade an endpoint from the managed to standalone mode by uninstalling the managed configuration package and installing an unmanaged configuration package.

2.14 About migrating

Migration means a change of installed products, modules, or features within the same version.

Therefore, it might be necessary to either migrate your product within your old version or to upgrade the installation first and do the migration afterwards.

Note: If you do not find your currently installed product or version in this guide, direct upgrade or migration is not supported. Please refer to the documentation for your product or version for possible upgrade or migration paths.

Note: If your migration scenario involves a change in your Sophos encryption software license, make sure that your new license is available for the migration.

2.14.1 Migrating from SafeGuard Easy

You can migrate the standalone solution SafeGuard Easy to the SafeGuard Enterprise suite with central management to make use of comprehensive management features, for example, user and computer management or extensive logging functionality.

■

Set up the latest version of SafeGuard Enterprise Server.

■

Migrate the management console.

■

Migrate the endpoints to a managed configuration.

77

SafeGuard Enterprise

2.14.1.1 Migrate the management console

Prerequisites

■

You do not have to uninstall SafeGuard Policy Editor.

■

■

.NET Framework 4.5 and ASP.NET 4.5 (provided in the SafeGuard Enterprise product delivery) must be installed.

Make sure that you have Windows administrator rights.

To migrate the management console:

1. On the computer on which SafeGuard Policy Editor is installed, start

SGNManagementCenter.msi

. A wizard guides you through installation. Accept the default options.

2. If prompted, restart the computer.

3. Start SafeGuard Management Center to carry out initial configuration.

4. Configure the SafeGuard Enterprise policies to your needs.

SafeGuard Policy Editor has been migrated to SafeGuard Management Center.

2.14.1.2 Migrate endpoints to a managed configuration

You can migrate unmanaged endpoints to a managed configuration. They can thus be managed in the SafeGuard Management Center and have a connection to the SafeGuard Enterprise Server.

Note: If you have already upgraded an endpoint to the latest version and just want to change the configuration, start with step 6.

Prerequisites

■

Back up the endpoint.

■

Make sure that you have Windows administrator rights.

■

Sophos SafeGuard encryption software on the endpoints does not have to be uninstalled.

Sophos SafeGuard version 6.10 or later must be installed on the endpoints. Older versions must be upgraded version by version until version 6.10 is reached.

To migrate endpoints locally:

1. Log on to the endpoint as an administrator.

2. Install the latest pre-installation package

SGxClientPreinstall.msi

that provides the endpoint with the necessary requirements for a successful installation of the new encryption software.

Do not uninstall previous pre-installation packages.

3. Install the latest version of the respective Sophos SafeGuard encryption software.

Windows Installer recognizes the features that are already installed and only upgrades these.

If Power-on Authentication is installed, an updated POA kernel is also available after a successful update (policies, keys etc.). Sophos SafeGuard is automatically restarted on the endpoint.

78

administrator help

4. After installation is completed, restart the endpoint when prompted.

5. In SafeGuard Management Center, on the Tools menu, click Configuration Package Tool.

Click Managed client packages and create a configuration package for managed endpoints.

6. Assign this package to the endpoint using a group policy.

Important: The Power-on Authentication is disabled as the User Machine Assignment is not upgraded. After upgrading, the endpoints are therefore unprotected.

7. The user needs to restart the endpoint. The first logon is still achieved with Autologon. New keys and certificates are assigned to the user.

8. The user needs to restart the endpoint for a second time and log on at the Power-on

Authentication. The endpoints are protected again only after the second restart.

9. Delete old and unused configuration packages.

The endpoint is now connected to the SafeGuard Enterprise Server.

2.14.2 Migrating from Sophos Disk Encryption

Sophos Disk Encryption is no longer supported. You must migrate to SafeGuard Enterprise. For more information, see Sophos knowledgebase article 121160 .

2.14.3 Modify the SafeGuard installation on endpoints

If changes to the installed modules are required, run the installer of the version already in place again and modify the installation. The following restrictions apply:

■

Synchronized Encryption cannot be installed on endpoints with location-based file encryption already in place.

■

■

A change from SafeGuard volume-based encryption to BitLocker Encryption or the other way round requires the product to be uninstalled and reinstalled (data needs to be decrypted).

A change from BitLocker support to BitLocker with Challenge/Response or the other way round requires the product to be uninstalled and reinstalled (data needs to be decrypted).

See the Release Notes for the system requirements for each module.

For information on migration of the operating system see

Migrate endpoints to a different operating system

(page 79).

2.14.4 Migrate endpoints to a different operating system

Endpoints with SafeGuard Enterprise can be migrated from Windows 7/8 to Windows 10. Only for endpoints running Windows 7 and SafeGuard Full Disk Encryption, the latter has to be uninstalled before migrating to Windows 10. SafeGuard Full Disk Encryption is not supported on

Windows 10. For information on uninstallation, see About uninstallation (page 80). For information

on using BitLocker, see Prepare for BitLocker Drive Encryption support

(page 57).

It is not possible to migrate endpoints from Windows 7 to Windows 8 when SafeGuard Enterprise is installed. If you are using operating systems older than Windows 10, it is only possible to update the Service Pack version of the operating system series installed.

79

SafeGuard Enterprise

2.15 About uninstallation

Uninstalling the SafeGuard Enterprise encryption software from endpoints involves the following steps:

■

■

Decrypt encrypted data.

Uninstall the configuration package.

■

Uninstall the encryption software.

The appropriate policies must be effective on the endpoints to allow for decryption and uninstallation.

When a user with admin rights logs on to the endpoint after the uninstallation, a cleanup tool is started in the background. A message informs the user that the cleanup requires a final reboot.

You can find the cleanup tool here:

C:\Program Files (x86)\Sophos\SafeGuard

Enterprise\SGNCleanUp.exe

2.15.1 Decrypt encrypted data

The following prerequisite must be met:

To decrypt encrypted volumes, all volume-based encrypted volumes must have a drive letter assigned to them.

1. In SafeGuard Management Center, edit the current policy of the type Device Protection that is assigned to the computers you want to decrypt. Select the targets and set User may decrypt

volume to Yes. Assign the policy to the respective endpoints.

2. Create a decryption policy of the type Device Protection, select the targets that are to be decrypted and set the Media encryption mode to No encryption.

3. In Users and Computers, create a group for the computers you want to decrypt: Right-click the domain node where you want to create the group. Then select New > Create new group.

4. Select the domain node of this group and assign the decryption policy to it by dragging the policy from the Available Policies list into the Policies tab. Activate the policy by dragging the group from the Available Groups list into the Activation area. On the Policies tab of the domain node, check that Priority is set to 1 and that No Override is activated. In the Activation area of the domain node, make sure that only members of the group are affected by this policy.

5. In the Users and Computers navigation area, select the group, right-click on the Members tab shown in the action area and click Add to add the computers you want to decrypt to the group.

6. On the endpoint that is to be decrypted, synchronize with the SafeGuard Enterprise Server to make sure that the policy update has been received and is active.

7. Open Windows Explorer. Right-click the volume that should be decrypted and click Encryption

> Decryption.

Make sure that the decryption is completed successfully.

Note: Endpoints can be shut down and restarted during encryption/decryption. If decryption is followed by an uninstallation, we recommend that the endpoint is not suspended or hibernated during decryption.

80

administrator help

2.15.2 Start uninstallation

The following prerequisites must be met:

■

Encrypted data has to be decrypted properly to allow access afterwards. The decryption process must be completed. Proper decryption is particularly important when uninstallation is triggered by Active Directory.

Also, all encrypted removable media must be decrypted before uninstalling the last accessible SafeGuard Enterprise protected endpoint. Otherwise users may not be able to access their data any more. As long as the SafeGuard Enterprise Database is available, data on removable media can be recovered.

■

■

To uninstall SafeGuard full disk encryption, all volume-based encrypted volumes must have a drive letter assigned to them.

Make sure that you always uninstall the complete package with all features installed.

1. In SafeGuard Management Center, edit the policy of the type Specific Machine Settings.

Set Uninstallation allowed to Yes.

2. In Users and Computers, create a group for the computers you want to decrypt: Right-click the domain node where you want to create the group. Then select New > Create new group.

3. Select the domain node of this group and assign the uninstallation policy to it by dragging the policy from the Available Policies list into the Policies tab. Activate the policy by dragging the group from the Available Groups list into the Activation area. On the Policies tab of the domain node, check that Priority is set to 1 and that No Override is activated. In the Activation area of the domain node, make sure that only members of the group are affected by this policy.

4. Add the endpoints you want to uninstall to the group.

5. To start uninstallation, use one of the following methods:

■

■

To uninstall locally on the endpoint, synchronize with the SafeGuard Enterprise Server to make sure that the policy update has been received and is active. Then select Start >

Control Panel > Add or Remove Programs > Sophos SafeGuard Client > Remove.

To uninstall centrally use the software distribution mechanism of your choice. Make sure that all required data has been decrypted properly before uninstallation starts.

2.15.3 Preventing uninstallation on the endpoints

To provide extra protection for endpoints, we recommend that you prevent local uninstallation of

SafeGuard Enterprise on endpoints. In a Specific Machine Settings policy, set Uninstallation

allowed to No and deploy the policy on the endpoints. Uninstallation attempts are then cancelled and the unauthorized attempts are logged.

2.15.4 Uninstall Native Device Encryption from Mac endpoints

If you need to uninstall the software from a client computer, proceed as follows:

1. On the Mac client go to /Library.

2. Select the folder /Sophos SafeGuard DE.

81

SafeGuard Enterprise

3. Select and double-click the file Sophos SafeGuard DE Uninstaller.pkg

4. A wizard guides you through uninstallation.

As soon as the last Sophos SafeGuard product is removed, the client configuration is deleted as well.

Note: It is not necessary to decrypt the disk before uninstalling the software.

Note: A user with administrative rights cannot be prevented from uninstalling the software. (A policy that prevents this on Windows clients has no effect on Mac clients.)

Note: The uninstaller package is signed, and OS X will try to validate this signature. This procedure may take several minutes.

2.15.5 Uninstall File Encryption from Mac endpoints

If you need to uninstall the software from a client computer, proceed as follows:

1. On the Mac client go to /Library.

2. Open the folder Sophos SafeGuard FS.

3. Select and double-click the file Sophos SafeGuard FS Uninstaller.pkg

4. A wizard guides you through uninstallation.

5. Restart the system before continuing to work with your Mac.

As soon as the last Sophos SafeGuard product is removed, the client configuration is deleted as well.

Note: The uninstaller package is signed, and OS X will try to validate this signature. This procedure may take several minutes.

82

administrator help

3 SafeGuard Management Center

The SafeGuard Management Center is the console for managing computers encrypted with

SafeGuard Enterprise. With SafeGuard Management Center you can implement a company-wide security strategy and apply it to the endpoints. SafeGuard Management Center enables you to:

■

Create or import the organizational structure.

■

Create security officers.

■

Define policies.

■

Export and import configurations.

■

Monitor computers through comprehensive logging functionality.

■

Recover passwords and access to encrypted endpoints.

With the SafeGuard Management Center you have Multi Tenancy support for managing multiple domains and databases.You can manage different SafeGuard Enterprise Databases and maintain different configurations.

Only privileged users - security officers - can access the SafeGuard Management Center. Several security officers can work with the data simultaneously. The various security officers can perform actions in accordance with the roles and rights assigned to them.

You can customize SafeGuard Enterprise policies and settings to your needs. After new settings have been saved to the database, they can be transferred to the endpoints where they become active.

Note: Some features are not included in all licenses. For information on what is included in your license, contact your sales partner.

3.1 Logging on to the SafeGuard Management Center

During SafeGuard Enterprise initial configuration, an account is created for a Master Security

Officer. This account is required the first time you log on to SafeGuard Management Center. To start SafeGuard Management Center, the user must know the password for the certificate store and have the certificate's private key.

For further information see

Create the Master Security Officer (MSO) (page 37).

The logon procedure varies depending on whether you run the SafeGuard Management Center as connected to one database (Single Tenancy) or to multiple databases (Multi Tenancy).

Note: Two security officers must not use the same Windows account on the same computer.

Otherwise it is not possible to separate their access rights properly.

83

SafeGuard Enterprise

3.2 SafeGuard Management Center user interface

84

1. Navigation area

2. Navigation window with administrative objects.

3. Buttons for all administrative tasks

4. Toolbar

5. Tabs to select different tasks or to display information.

6. Action area displays depends on the selection in the navigation area.

7. Associated views can contain essential elements or information for administration of the object currently being processed.

Navigation area

The navigation area contains buttons for all administrative actions:

■

Users and Computers

To import groups and users from an active directory, from the domain or from an individual computer.

■

Policies

administrator help

To create policies.

■

Keys and Certificates

To manage keys and certificates.

■

Tokens

To manage tokens and smartcards.

■

Security Officers

To create new security officers or roles and define actions which require additional authorization.

■

Reports

To create and manage records of all security-related events.

Navigation window

Objects which are to be processed or can be created are displayed in the navigation window

(Active Directory objects such as OUs, users and computers, policy items etc.). The objects displayed depend on the selected task.

Note: In Users and Computers, the objects shown in the navigation window directory tree depend on the security officer's access rights for directory objects. The directory tree only shows objects the logged on security officer has access to. Objects that are denied are not shown, except if there are nodes lower in the tree that the security officer has access rights for. In this case the denied objects are greyed out. If the security officer has Full access rights, the object is displayed in black. Objects with Read only access are displayed in blue.

Action area

In the action area, you define settings for the objects selected in the navigation window. The action area contains various tabs for processing objects and specifying settings.

The action area also includes information about the selected objects.

Associated views

In these views, additional objects and information are displayed. They provide useful information for system administration and make use of the system easier. You can for example assign keys to objects by using drag-and-drop.

Toolbar

Contains symbols for the different SafeGuard Management Center actions. Symbols are displayed as and when they are available for the selected object.

After logon, the SafeGuard Management Center always opens with the view in which it was closed.

85

SafeGuard Enterprise

86

3.3 Language settings

The language settings for the SafeGuard Management Center and SafeGuard Enterprise encryption software on the endpoints are as follows:

SafeGuard Management Center language

You can set the language of the SafeGuard Management Center as follows:

■

In the SafeGuard Management Center menu bar, click Tools > Options > General. Select

Use user defined language and select an available language. English, German, French and

Japanese are supported.

■

Restart the SafeGuard Management Center. It is displayed in the selected language.

SafeGuard Enterprise language on endpoints

You set the language of SafeGuard Enterprise on the endpoint in a policy of type General Settings in the SafeGuard Management Center, setting Customization > Language used on client:

■

If the language of the operating system is selected, SafeGuard Enterprise uses the language setting of the operating system. If the operating system language is not available in SafeGuard

Enterprise, the SafeGuard Enterprise language defaults to English.

■

If one of the available languages is selected, SafeGuard Enterprise functions are displayed in the selected language on the endpoint.

3.4 Check database integrity

When you log on to the database, database integrity is automatically verified. If this check results in any errors, the Verify Database Integrity dialog is displayed.

You can also start the database integrity check manually any time after logon and display the

Verify Database Integrity dialog:

1. In the SafeGuard Management Center, select Tools > Database integrity from the menu bar.

2. Check the tables by clicking Check all or Check selected.

Erroneous tables are marked in the dialog. To repair them, click Repair.

Note: After a SafeGuard Enterprise backend update (SQL) the database integrity check will always be started.The check only needs to be performed once per SafeGuard Enterprise Database to finish the update.

3.5 Working with policies

The following sections describe the administrative tasks concerning policies, for example creating, grouping and backing up policies.

administrator help

Note: For assigning, removing or editing policies, you need Full access rights to the relevant objects as well as to any group that is activated for the policies involved.

For a description of all policy settings available with SafeGuard Enterprise, see Policy types and their fields of applications (page 346).

3.5.1 Create policies

1. Log on to the SafeGuard Management Center with the password set during initial configuration.

2. In the navigation area, click Policies.

3. In the navigation window, right-click Policy Items and select New.

4. Select the policy type.

A dialog for naming the new policy is displayed.

5. Enter a name and optionally a description for the new policy.

Policies for Device Protection:

If you create a policy for device protection, you must also specify the target for device protection.

Possible targets are:

■

■

■

■

Mass storage (boot volumes/other volumes)

Removable media

Optical drives

Storage device models

■

■

Distinct storage devices

Cloud storage

For each target, a separate policy has to be created. Later on you can combine the individual policies in a policy group named Encryption, for example.

6. Click OK.

The new policy is displayed in the navigation window below Policy Items. In the action area, all settings for the selected policy type are displayed and can be changed.

3.5.2 Edit policy settings

When you select a policy in the navigation window, you can edit the policy settings in the action area.

Note:

A red icon in front of a not configured setting indicates that for this policy setting a value has to be defined. To be able to save the policy, you first have to select a setting other than not configured.

87

SafeGuard Enterprise

Setting policy settings to default values

In the toolbar the following icons are available for setting policy settings:

Icon Policy setting

Displays default values for policy settings that have not been configured (setting not

configured). The default values for policy settings are displayed by default. Click the icon to hide the default values.

Sets the marked policy setting to not configured.

Sets all policy settings in an area to not configured.

Sets the default value for the marked policy.

Sets all policy settings in an area to the default value.

88

Differentiating between machine- and user-specific policies

Policy displayed in blue

Policy displayed in black

Policy is applied to machines only, not users.

Policy is applied to machines and users

3.5.3 Policy groups

SafeGuard Enterprise policies can be combined in policy groups. A policy group may contain different policy types. In the SafeGuard Management Center, a Default policy group is available that is assigned to Root under Users and Computers by default.

administrator help

If you put policies of the same type in a group, the settings are merged automatically. In this case, you can define priorities for using the settings. The settings of a policy with a higher priority overwrite the settings of a policy with a lower priority.

A defined policy setting will overwrite settings from other policies, if

■ the policy with that setting has a higher priority.

■ the policy setting has not been defined yet (not configured).

Note: Overlapping policies assigned to a group might result in incorrect calculation of the priorities.

Ensure that you use disjunctive policy settings.

Exception concerning device protection:

Policies for device protection are only merged, if they were defined for the same target (for example boot volume). If they are for different targets, the settings will be added.

3.5.3.1 Combine policies into groups

Prerequisite: The individual policies of different types must have been created beforehand.

1. In the navigation area, click Policies.

2. In the navigation window, right-click Policy Groups and select New.

3. Click New Policy Group. A dialog for naming the policy group is displayed.

4. Enter a name and optionally a description for the policy group. Click OK.

5. The new policy group is displayed in the navigation window under Policy Groups.

6. Select the policy group. The action area shows all elements required for grouping the policies.

7. To add the policies to the group, drag them from the list of available policies to the policy area.

8. You can define a priority for each policy by arranging the policies in order using the context menu.

If you put policies of the same type in a group, the settings are merged automatically. In this case, you can define priorities for using the settings. The settings of a policy with a higher priority overwrite the settings of a policy with a lower priority. If an option is set to not

configured, the setting is not overwritten in a policy of a lower priority.

Exception concerning device protection:

Policies for device protection are only merged, if they were defined for the same target (for example boot volume). If they are for different targets, the settings are added.

9. Save the policy with File > Save.

The policy group now contains the settings of all the individual policies.

3.5.3.2 Policy grouping results

The result of policy grouping is displayed separately.

To display the result, click the Resulting tab.

■

For each policy type a separate tab is shown.

The settings resulting from combining the individual policies into a group are displayed.

89

SafeGuard Enterprise

■

For policies for device protection, a tab is shown for each policy target (for example boot volumes, drive X etc.).

3.5.4 Back up policies and policy groups

You can create backups of policies and policy groups as XML files. If necessary, the relevant policies/policy groups can then be restored from these XML files.

1. In the navigation window, select the policy/policy group under Policy Items or Policy Groups.

2. Right-click to display the context menu and select Backup Policy.

Note: The Backup Policy command is also available in the Actions menu.

3. In the Save As dialog, enter a file name for the XML file and select the a storage location for the file. Click Save.

The backup of the policy/policy group is stored as an XML file in the specified directory.

3.5.5 Restore policies and policy groups

To restore a policy/policy group from an XML file:

1. In the navigation window, select Policy Items/Policy Groups.

2. Right-click to display the context menu and select Restore Policy.

Note: The Restore Policy command is also available in the Actions menu.

3. Select the XML file from which the policy/policy group is to be restored and click Open.

The policy/policy group is restored.

3.5.6 Assign policies

To assign policies, you need Full access rights to the objects involved.

1. Click Users and Computers.

2. In the navigation window, select the required container object (for example OU or domain).

3. Switch to the Policies tab.

All items required for policy assignment are displayed in the action area.

4. To assign a policy, drag the policy from the list into the Policies tab.

5. You can define a Priority for each policy by arranging the policies in order using the context menu. The settings of higher-ranked policies override those below. If you select No Override for a policy, its settings will not be overridden by those from other policies.

Note: If you select No Override for a low-priority policy, this policy will take higher priority than a higher-ranking policy.

To change the Priority or the No Override setting for policies in Users and Computers, you need Full Access rights for all objects the policies are assigned to. If you do not have Full

Access rights for all objects, the settings are not editable. If you try to edit these fields, an info message is displayed.

90

administrator help

6. The .Authenticated users and .Authenticated computers are displayed in the activation area.

The policy applies to all groups within the OU and/or domain.

3.5.6.1 Activate policies for individual groups

Policies are always assigned to an OU, a domain or a workgroup. They apply by default to all groups in those container objects (.Authenticated users and .Authenticated computers groups are displayed in the activation area).

However, you can also define policies and activate them for one or more groups. These policies then apply exclusively to these groups.

Note: To activate policies for individual groups, you need Full access rights for the relevant group.

1. Assign the policy to the OU the group is contained in.

2. .Authenticated Users and .Authenticated Computers are displayed in the activation area.

3. Drag these two groups from the activation area to Available Groups list. In this constellation, the policy is neither effective for users nor computers.

4. Now drag the required group (or multiple groups) from the Available Groups list into the activation area.

This policy now applies exclusively to this group.

If policies have also been assigned to the higher-ranking OU, this policy applies to this group in addition to those defined for the whole OU.

3.5.7 Manage policies in Users and Computers

Apart from the Policies area in the SafeGuard Management Center, you can also view and modify the contents of a policy where policy assignment is done, in Users and Computers.

1. Click Users and Computers.

2. In the navigation area, select the required container object.

3. You can open policies for viewing/modifying them from two locations.

■

■

Switch to the Policies tab, or switch to the RSOP tab.

4. Right-click the required assigned or available policy and select Open from the context menu.

The policy dialog is displayed and you can view and edit the policy settings.

5. Click OK to save your changes.

6. To display the policy properties, right-click the required policy and select Properties from the context menu.

The Properties dialog for the policy is displayed. Here you can view General and Assignment information.

91

SafeGuard Enterprise

3.6 Working with configuration packages

In the SafeGuard Management Center, you can create the following types of configuration packages:

■

Configuration package for managed endpoints

Endpoints that have a connection to the SafeGuard Enterprise Server receive their policies through this server. For successful operation after installation of the SafeGuard Enterprise

Client software, you need to create a configuration package for managed computers and deploy it to them.

After the first configuration of the endpoint by the configuration package, the endpoint receives policies through the SafeGuard Enterprise Server after you have assigned them in the Users

and Computers area of the SafeGuard Management Center.

■

Configuration package for unmanaged endpoints

Unmanaged endpoints are never connected to the SafeGuard Enterprise Server at any point in time, they operate in standalone mode. They receive their policies by configuration packages.

For successful operation, you need to create a configuration package containing the relevant policy groups and distribute it to the endpoints by company distribution mechanisms. Whenever you change any policy settings, you have to create new configuration packages and distribute them to the endpoints.

Note: Configuration packages for unmanaged endpoints can only be used on Windows endpoints.

■

Configuration package for the SafeGuard Enterprise Server

For successful operation, you need to create a configuration package for the SafeGuard

Enterprise Server, defining the database and SSL connection, enabling the scripting API and so on.

■

Configuration package for Macs

Macs receive the server address and the company certificate through this package. They report their status information which is displayed in the SafeGuard Management Center. For

information on how to create configuration packages for Macs, see Create configuration package for Macs

(page 94).

Note: Check your network and computers in regular intervals for old or unused configuration packages and make sure that you delete them for security reasons. Always make sure that you uninstall the old configuration packages before installing the new one on the computer/server.

3.6.1 Create configuration package for managed endpoints

Prerequisites

■

In the Users and Computers navigation area, under the Inventory tab, check if a company certificate change is required for the endpoints that should receive the new configuration package. If the field Current Company Certificate is not checked, the currently active company

92

administrator help certificates in the SafeGuard Enterprise Database and on the computer differ and a company certificate change is therefore required.

1. In the SafeGuard Management Center, on the Tools menu, click Configuration Package

Tool.

2. Select Managed client packages.

3. Click Add Configuration Package.

4. Enter a name of your choice for the configuration package.

5. Assign a primary SafeGuard Enterprise Server (the secondary server is not necessary).

6. If required, specify a policy group which must have been created beforehand in the SafeGuard

Management Center to be applied to the endpoints. If you want to use service accounts for post-installation tasks on the endpoint, make sure that you include the respective policy setting

in this first policy group, see Service Account Lists for Windows logon (page 187).

7. If the currently active company certificate in the SafeGuard Enterprise Database differs from the one on the endpoints that should receive the new configuration package, select the appropriate CCO (Company Certificate Change Order). In Users and Computers, in the

Inventory tab of the relevant domain, OU or computer a missing check mark under Current

Company Certificate indicates that a company certificate change is required. You can find information on the required CCO in the CCOs tab of the Configuration Package Tool in the

Tools menu.

Note: Deployment of the new configuration package on the endpoint will fail, if the currently active company certificates in the SafeGuard Enterprise Database and on the endpoint do not match and no appropriate CCO is included.

8. Select the Transport Encryption mode defining how the connection between SafeGuard

Enterprise Client and SafeGuard Enterprise Server is to be encrypted, either Sophos encryption or SSL encryption.

The advantage of SSL is that it is a standard protocol and that a faster connection can be achieved as when using SafeGuard transport encryption. SSL encryption is selected by default.

For further information on how to secure transport connections with SSL, see the SafeGuard

Enterprise Installation guide.

9. Specify an output path for the configuration package (MSI).

10. Click Create Configuration Package.

If you have selected SSL encryption as the Transport Encryption mode, the server connection is validated. If the connection fails, a warning message is displayed.

The configuration package (MSI) has now been created in the specified directory. You now need to distribute and deploy this package to the endpoints.

3.6.2 Create configuration package for unmanaged endpoints

1. In the SafeGuard Management Center, on the Tools menu, click Configuration Package

Tool.

2. Select Standalone client packages.

3. Click Add Configuration Package.

4. Enter a name of your choice for the configuration package.

93

SafeGuard Enterprise

94

5. Specify a Policy Group which must have been created beforehand in the SafeGuard

Management Center to be applied to the endpoints.

6. Under POA Group, you can select a POA user group to be assigned to the endpoint. POA users can access the endpoint for administrative tasks after the SafeGuard Power-on

Authentication has been activated. To assign POA users, the POA group must have been created beforehand in the Users and Computers area of the SafeGuard Management Center.

7. If the currently active company certificate in the SafeGuard Enterprise Database differs from the one on the endpoints that should receive the new configuration package, select the appropriate CCO (Company Certificate Change Order).

Note: Deployment of the new configuration package on the endpoint will fail, if the currently active company certificates in the SafeGuard Enterprise Database and on the endpoint do not match and no appropriate CCO is included.

8. Under Key Backup Location, specify or select a shared network path for storing the key recovery file. Enter the share path in the following form:

\\network computer\

, for example

\\mycompany.edu\

. If you do not specify a path here, the end user is prompted to name a storage location for this file when first logging on to the endpoint after installation.

The key recovery file (XML) is needed to enable recovery of Sophos SafeGuard protected endpoints and is generated on each Sophos SafeGuard protected endpoint.

Note: Make sure to save this key recovery file at a file location accessible to the helpdesk.

Alternatively, the files can be provided to the helpdesk by different mechanisms. This file is encrypted by the company certificate. It can therefore be saved to any external media or to the network to provide it to the helpdesk for recovery purposes. It can also be sent by e-mail.

9. Specify an output path for the configuration package (MSI).

10. Click Create Configuration Package.

The configuration package (MSI) has now been created in the specified directory. You now need to distribute and deploy this package to the endpoints.

3.6.3 Create configuration package for Macs

A configuration package for a Mac contains the server information and the company certificate.

The Mac uses this information to report status information (SafeGuard POA on/off, encryption state and so on). The status information is displayed in the SafeGuard Management Center.

1. In the SafeGuard Management Center, on the Tools menu, click Configuration Package

Tool.

2. Select Managed client packages.

3. Click Add Configuration Package.

4. Enter a name of your choice for the configuration package.

5. Assign a primary SafeGuard Enterprise Server (the secondary server is not necessary).

6. Select SSL as Transport Encryption for the connection between the endpoint and SafeGuard

Enterprise Server. Sophos as Transport Encryption is not supported for Mac.

7. Specify an output path for the configuration package (ZIP).

8. Click Create Configuration Package.

The server connection for the SSL Transport Encryption mode is validated. If the connection fails, a warning message is displayed.

administrator help

The configuration package (ZIP) has now been created in the specified directory. You now need to distribute and deploy this package to your Macs.

95

SafeGuard Enterprise

4 Managing Mac endpoints

Macs that have the following Sophos products installed can be managed by SafeGuard Enterprise and/or report status information. The status information is displayed in the SafeGuard Management

Center:

■

Sophos SafeGuard File Encryption for Mac 6.1 and later

■

Sophos SafeGuard Disk Encryption for Mac 6.1 / Sophos SafeGuard Native Device Encryption

7.0

■

Sophos SafeGuard Disk Encryption for Mac 6 - only reporting

4.1 Create configuration package for Macs

A configuration package for a Mac contains the server information and the company certificate.

The Mac uses this information to report status information (SafeGuard POA on/off, encryption state and so on). The status information is displayed in the SafeGuard Management Center.

1. In the SafeGuard Management Center, on the Tools menu, click Configuration Package

Tool.

2. Select Managed client packages.

3. Click Add Configuration Package.

4. Enter a name of your choice for the configuration package.

5. Assign a primary SafeGuard Enterprise Server (the secondary server is not necessary).

6. Select SSL as Transport Encryption for the connection between the endpoint and SafeGuard

Enterprise Server. Sophos as Transport Encryption is not supported for Mac.

7. Specify an output path for the configuration package (ZIP).

8. Click Create Configuration Package.

The server connection for the SSL Transport Encryption mode is validated. If the connection fails, a warning message is displayed.

The configuration package (ZIP) has now been created in the specified directory. You now need to distribute and deploy this package to your Macs.

4.2 About SafeGuard Native Device Encryption for Mac

Sophos SafeGuard Native Device Encryption for Mac offers Mac OS X users the same data protection that the disk encryption feature of SafeGuard Enterprise already offers to Windows users.

SafeGuard Native Device Encryption for Mac builds on Mac OS X's integrated FileVault 2 encryption technology. It uses FileVault 2 to encrypt the entire hard disk, so that your data is safe even if the

96

administrator help computer is lost or stolen. However, it also enables you to provide and manage disk encryption for entire networks.

The encryption works transparently. The user will not see any prompts for encryption or decryption when opening, editing, and saving files.

In the SafeGuard Enterprise Management Center, you can select which computers (Windows as well as Macs) to encrypt, monitor their encryption status, and provide recovery for users who forget their passwords.

4.2.1 Configuration

Sophos SafeGuard Native Device Encryption for Mac OS X is administered in the SafeGuard

Management Center. The following chapter focuses on the Mac-specific configuration.

SafeGuard Native Device Encryption for Mac only makes use of policies of the type Device

Protection and General Settings and ignores all policy settings except Target, Media encryption

mode and Connection interval to server (min).

4.2.1.1 Centrally administered configuration options

Policies are configured centrally in the SafeGuard Management Center. In order to initiate full disk encryption, the settings must be chosen as follows:

1. Create a new policy of type Device Protection. For Device protection target, choose Local

Storage Devices, Internal Storage, or Boot Volumes. Type a name for the policy and click

OK.

2. For Media encryption mode, select Volume based.

A new policy for device protection has been created and configured for full disk encryption for

Macs.

Note: Make sure that the policy is assigned to the endpoints you want encrypted.You can assign the policy to the top level of your domain or workgroup. If IT staff take care of the installation, do not assign the policy before the endpoint computers are issued to the end users. There is the risk that the endpoint is encrypted too early and IT staff are registered for FileVault 2 instead of the end users.

4.2.2 How does encryption work?

FileVault 2 keeps all data on the hard drive secure with XTS-AES-128 data encryption at the disk level. The algorithm has been optimized for 512-byte blocks. The conversion from plaintext to ciphertext and back is performed on the fly with low impact on the user experience since it is given a lower priority.

One traditional obstacle to usability with full disk encryption is that it was necessary for the end user to authenticate twice: once to unlock the encrypted boot volume (POA), and the second time to log on to the user desktop.

However, this is no longer necessary. Users enter their password at the pre-boot logon and the system initiates password-forwarding when the operating system is up and requiring logon credentials. Password-forwarding eliminates the need for users to log on twice after a cold boot.

97

SafeGuard Enterprise

Users are able to reset their passwords at any time without the need to re-encrypt the volume.

The reason is that a multi-level key system is employed. The keys shown to the users (for example logon keys and recovery keys) are derived encryption keys and therefore can be replaced. The true volume encryption key will never be given to a user.

For further information on FileVault 2 see Apple Technical White Paper - Best Practices for

Deploying FileVault 2 (Aug. 2012), which can be downloaded from the Apple website.

4.2.3 Initial encryption

When you define a volume-based encryption of the system disk via policy, disk encryption starts automatically as soon as the user restarts the endpoint. The user needs to do the following:

1. Enter the Mac OS X password.

2. Wait for the Mac to restart.

Note: If activation of the encryption fails, an error message is displayed. More information can be found in the log files. The default location is

/var/log/system.log

3. Disk encryption starts and is done in the background. The user can continue working.

The user is added as the first FileVault 2 user of the endpoint.

4.2.4 Decryption

Usually it is not necessary to decrypt. If you set a policy that specifies No encryption for Mac clients that are already encrypted, they will remain encrypted. However, in this case, users have the choice to decrypt. They will find the corresponding button in the Disk Encryption tab of the preference pane.

Users with local administrator rights cannot be prevented from attempting to manually decrypt their hard disk using built-in FileVault 2 functionality. However, they will be prompted for a restart to complete the decryption. As soon as the Mac has completed the restart, SafeGuard Native

Device Encryption for Mac will enforce encryption if a corresponding policy has been set.

4.2.5 Add FileVault 2 user

Only users that are already registered for FileVault 2 at the endpoint will be able to log on to the system after a restart. In order to add a user to FileVault 2 proceed as follows:

1. While the Mac is still running, log on with the user you want to register for FileVault 2.

2. Provide the credentials of that user in the dialog Enable Your Account.

Users will be able to log on as easily as if there was no disk encryption enforced.

Note: You cannot assign users to endpoints in the Management Center to allow them to use

FileVault 2.

4.2.6 Remove FileVault 2 user

A user can be removed from the list of users assigned to a Mac in the SafeGuard Management

Center. After the next synchronization, the user will be removed from the list of FileVault 2 users

98

administrator help of the endpoint as well. But this does not mean that the user will not be able to log on to that Mac anymore. Like any new user, the user just needs to log on to a running Mac in order to become authorized again.

If you really want to prevent a user from booting a Mac, mark the user as blocked in the

Management Center. The user will then be removed from the list of FileVault 2 users of the client and no new authorization will be possible.

It is possible to remove all FileVault 2 users but the last one. If the owner is removed, then the next user in the list will be marked as owner. In SafeGuard Native Device Encryption for Mac it does not make a difference if a user is owner or not.

4.2.7 Synchronization with backend

In the process of synchronization, the states of the clients are reported to the SafeGuard Enterprise backend, policies are updated and the user-machine assignment is checked.

Therefore, the following information is sent from the clients and appears in the SafeGuard

Management Center:

■

■

As soon as an endpoint is encrypted, "POA" is checked. Other information that is displayed includes drive name, label, type, state, algorithm and operating system.

New FileVault 2 users are added also in the Management Center.

Note: If the SafeGuard Enterprise client software is removed from an endpoint, the endpoint and its users are still visible in the SafeGuard Management Center. But the timestamp of the last server contact does not change any more.

On the client side, the following things are changed:

■

Policies that were changed in the Management Center are changed on the client.

■

Users that have been deleted or blocked in the Management Center are also removed from the list of FileVault 2 users on the client.

4.2.8 Command line options

The Terminal application allows you to enter commands and command line options. The following command line options are available:

Command name

sgdeadmin sgdeadmin --version

Definition Additional parameters (optional)

Lists available commands including short help hints.

--help

Displays version and copyright information of the installed product.

99

SafeGuard Enterprise

Command name

sgdeadmin --status

Definition

Returns system status information such as version, server and certificate information.

Additional parameters (optional)

sgdeadmin

--list-user-details

Returns information on the user currently logged on.

--all

displays information for all users (sudo required)

--xml

returns output in xml format.

sgdeadmin --list-policies

Displays policy-specific information.

Key GUIDs are resolved to key names if possible. Bold print indicates a personal key.

--all

displays information for all users (sudo required)

--xml

returns output in xml format

sgdeadmin --synchronize

Forces immediate contact with the server (needs working server connection).

sgdeadmin

--import-recoverykey

["recoverykey"]

Imports the FileVault 2 recovery key, overwrites existing recovery key.

--force

existing recovery key will be overwritten without any additional confirmation

"recoverykey"

if it is not entered, the user will be asked for it

sgdeadmin --import-config

"/path/to/target/file"

Imports the specified configuration zip file. The command needs administrative rights (sudo).

Note:

Use the drag and drop functionality to drag a complete path from, for example, the Finder into the

Terminal application.

sgdeadmin

--enable-server-verify

Turns on SSL server verification for communication with the SafeGuard

Enterprise server. After installation, the SSL server verification is activated. The command needs administrative rights (sudo).

sgdeadmin

--disable-server-verify

Turns off SSL server verification for communication with the SafeGuard

100

administrator help

Command name Definition

Enterprise server. The command needs administrative rights (sudo).

Note:

We do not recommend this option as it may create a security vulnerability.

Additional parameters (optional)

sgdeadmin

--update-machine-info

[--domain "domain"]

--domain "domain"

Updates the currently stored machine information which is used to register this client on the

SafeGuard Enterprise server. The command needs administrative rights (sudo).

Note:

Use this command only after changing the domain or workgroup the computer belongs to. If the computer is a member of multiple domains or workgroups and you execute this command, this might result in a change of the domain registration and removal of personal keys and/or FileVault 2 users.

The domain the client should use to register on the SafeGuard

Enterprise server. This parameter is only required if the computer is a member of multiple domains. The computer must be joined to this domain, otherwise the command will fail.

sgdeadmin

--enable-systemmenu sgdeadmin

--disable-systemmenu

Activates the system menu on the endpoint.

Deactivates the system menu on the endpoint.

sgdeadmin --synchronize

Starts synchronizing database information from the SafeGuard

Enterprise backend such as policies and keys.

4.3 About SafeGuard File Encryption for Mac

Sophos SafeGuard File Encryption for Mac extends the data protection offered by Sophos

SafeGuard Enterprise from Windows to the Mac world. It offers file-based encryption on local drives, network shares, removable drives, and in the cloud.

With SafeGuard File Encryption for Mac, you can safely encrypt and decrypt files and exchange these files with other users on Macs or Windows PCs.

To read files encrypted by SafeGuard Enterprise on mobile devices, use Sophos Secure Workspace for iOS or Android.

101

SafeGuard Enterprise

In the SafeGuard Management Center, you define rules for file-based encryption in File Encryption policies. In these file encryption policies, you specify the folders that are to be handled by File

Encryption, the encryption mode and the key to be used for encryption. This central management guarantees that identical folders and encryption keys are processed on different platforms.

4.3.1 Recommendations

Reduce administration effort

■

Keep the number of mount points (or Secured Folders) as low as possible.

■

Deactivate the option Require confirmation before creating a mobile account.

If you create or use mobile accounts for Mac endpoints, make sure the option Require

confirmation before creating a mobile account is deactivated. With the option activated, the user could select Don’t Create. This would result in the creation of an incomplete OS X user, for example, a user that does not have a local home directory.

To deactivate the option, perform the following steps:

1. Open the System Preferences and click on Users & Groups.

2. Click the lock icon, then enter your password.

3. Select the User.

4. Click Login Options.

5. Go to Network Account Server and click Edit...

6. Select the Active Directory Domain.

7. Click Open Directory Utility...

8. Click the lock icon, then enter your password and click Modify Configuration.

9. Select Active Directory and click the edit icon.

10. Click the arrow next to Show Advanced Options.

11. Select Create mobile account at login and deselect the option Require confirmation

before creating a mobile account.

12. Confirm with Ok.

4.3.2 Limitations

■

Maximum number of Secured Folders (mount points) on a client

On each Mac OS X client you can have a maximum of 24 Secured Folders (mount points). If more than one user is logged in on a single machine, you need to add up the mount points from all logged-in users.

■

Excluded folders

The following folders are excluded from encryption:

■

Folders are excluded, but not their subfolders:

■

<Root>/

■

■

<Root>/Volumes/

<User Profile>/

102

administrator help

■

Folders as well as their subfolders are excluded:

■

<Root>/bin/

■

■

<Root>/sbin/

<Root>/usr/

■

■

■

■

<Root>/private/

<Root>/dev/

<Root>/Applications/

<Root>/System/

■

■

■

■

<Root>/Library/

<User Profile>/Library/

/<Removables>/SGPortable/

/<Removables>/System Volume Information/

This means that for example an encryption rule for the root of an additional partition

(<Root>/Volumes/) has no effect, although it will be shown as received policy.

An encryption rule on <Root>/abc will have an effect, while an encryption rule on

<Root>/private/abc will not.

■

Searching for files

■

Spotlight search

Spotlight search does not work in encrypted files.

■

Labeled files

Searching for labeled files does not work in Secured Folders.

■

Moving encrypted files from Secured Folders

When you move an encrypted file from a Secured Folder to non-Secured Folder, the file will still be encrypted, but you will not be able to access its content. You need to decrypt it first manually.

When you open an encrypted file in a Secured Folder and save it in a non-Secured Folder, the file will be decrypted automatically.

■

Permanent version storage is not available in Secured Folders

For files in Secured Folders, the standard functionality Browse All Versions... is not available.

■

Sharing Secured Folders

A Secured Folder cannot be shared over the network.

■

Burning CDs

It is not possible to burn an encrypted CD.

103

SafeGuard Enterprise

■

Deleting files

When deleting files from a Secured Folder (mount point), a message prompts you to confirm the delete process. Deleted files are not moved to the Trash folder and thus cannot be restored.

■

SafeGuard Portable

SafeGuard Portable is not available for Mac OS X.

■

Use of AirDrop

Encrypted files can be transferred with AirDrop. Ensure that the target device can handle encrypted files. If it cannot, applications may behave unpredictably.

■

Handoff

Using Handoff for encrypted files is not supported.

■

Mounting network file shares with autofs

Network file shares which have a policy applied and are automatically mounted at startup will not be detected by Sophos SafeGuard File Encryption. It is not possible to handle such mount points because the original mount point cannot be replaced.

4.3.3 Configuration

Sophos SafeGuard File Encryption for Mac OS X is administered in the SafeGuard Management

Center. The following chapter focuses on the Mac-specific configuration.

SafeGuard File Encryption for Mac only uses policies of the type File Encryption and General

Settings. This means that you only need to use a File Encryption policy for managing encryption of data on the local file system, removable media, network shares and cloud storage. Device

Protection policies (including Cloud Storage and Removable Media Encryption policies) will be ignored for SafeGuard File Encryption for Mac OS X. Always assign File Encryption policies to the user objects. File Encryption policies assigned to endpoints will not have any effect on

OS X endpoints.

Note:

In the SafeGuard Management Center, paths have to be entered using backslashes. They are automatically converted to forward slashes on the Mac client side.

4.3.3.1 Centrally administered configuration options

The following options are configured centrally in the Management Center:

■

■

■

Policies

Keys

Certificates

The SafeGuard Enterprise backend provides the X.509 certificate for the user. When logging in for the first time, a certificate is generated. The certificate secures the user's key ring.

■

Connection interval to server

104

administrator help

4.3.4 How does encryption work?

Each encrypted file is encrypted with a randomly generated key called Data Encryption Key (DEK) using algorithm AES-256. This randomly generated and unique DEK is encrypted and stored as a file header together with the encrypted file, increasing the original file size by 4 KB.

The DEK is encrypted with a Key Encryption Key (KEK). This KEK is stored in the central

SafeGuard Enterprise database. It will be assigned by the security officer to a single user, to groups or to organizational units.

To decrypt an encrypted file, the user must have the KEK specific to this file in their key ring.

4.3.5 Initial encryption

Initial file encryption can be started from the preference pane or from the command line tool. Both administrators and end users can trigger initial encryption for files on local drives and removable media. Network shares can only be encrypted by administrators.

A policy defines, whether initial encryption is started automatically and whether local folders, removables, or cloud storage providers are encrypted.

To manually start encryption on the endpoint:

1. Open the System Preferences.

2. Click the Sophos Encryption icon:

3. Select the Policies tab.

4. Switch to Locally Translated Path view if not already opened. You can either a) enforce all policies by clicking the Enforce all policies button in the lower part of the window or b) select a single policy and click the button Enforce policy.

Note: Do not disconnect devices while the initial encryption is running.

Note: If you want to see details and contents of the locally translated path, select the path from the table and click Show in Finder.

4.3.6 Password handling

The Sophos SafeGuard key ring is secured with a user certificate. The corresponding private key is protected by the OS X password.

The password is required to allow the certificate to be generated if the user has not been created in SafeGuard Enterprise.

105

SafeGuard Enterprise

Changing password locally

Users can change their passwords locally in System Preferences > Users & Groups, and no further steps are required.

Password has been changed on a different endpoint

Note: Passwords can be changed on Windows as well as Mac endpoints.

Since the password is no longer known on this endpoint the following steps need to be completed:

1. Log in to OS X with your new password.

2. The system was unable to unlock your keychain is displayed.

3. Select Update Keychain Password.

4. Enter the old password.

For details of how to reset a forgotten password, see Reset forgotten password

(page 110).

4.3.7 Recovery key handling

If all FileVault-enabled users on a particular system forget their passwords, other credentials are not available and there is no recovery key available, then the encrypted volume cannot be unlocked and the data is inaccessible. Data may be lost permanently, so proper recovery planning is essential.

A new recovery key is generated during each activation of disk encryption. Without Sophos

SafeGuard Native Device Encryption being installed at the time of the encryption, it is displayed to the user who consequently is responsible for its protection against loss. With Sophos SafeGuard

Native Device Encryption, it is securely sent to the SafeGuard Enterprise backend and stored centrally. The security officer can retrieve it whenever needed. See

Reset forgotten password

(page 110).

But even if SafeGuard Native Device Encryption was not installed when the disk was encrypted, the recovery key can be managed centrally. Therefore it is necessary to import it. The relevant command line option is

sgdeadmin --import-recoverykey

, see also Command line options

(page 99). The recovery key will be sent in upper case.

If there is an institutional recovery key present, it can be used for recovery as well. For more information see OS X: How to create and deploy a recovery key for FileVault 2 at support.apple.com/kb/HT5077

4.3.8 Fast user switching

SafeGuard File Encryption for Mac also works with fast user switching. It allows you to switch between user accounts on a single endpoint without quitting applications or logging out from the machine.

4.3.9 Local keys

Note: Local keys cannot be used with SafeGuard Synchronized Encryption.

106

administrator help

Local keys can be used for encrypting files in specified directories on a removable device or a cloud storage provider. These drives must be included in an encryption policy already.

To create a local key:

1. Open the system menu and select Create Local Keys.

2. Choose a name and a passphrase for your key and click OK.

The key name will be prefixed with "Local_" and postfixed with date and time.

The local key is created and displayed in the preference pane. The user can now apply the local key to a removable device or a cloud directory.

4.3.10 Command line options

The Terminal application allows you to enter commands and command line options. The following command line options are available:

Command name

sgfsadmin

Definition Additional parameters (optional)

Lists available commands including short help hints.

--help sgfsadmin --version

Displays version and copyright information of the installed product.

sgfsadmin --status

Returns system status information such as version, server and certificate information.

sgfsadmin

--list-user-details sgfsadmin --list-keys

Lists existing GUIDS and names of all keys in the keystore.

--all

displays information for all users (sudo required)

--xml

returns output in xml format

sgfsadmin

--list-policies

Returns information on the user currently logged on.

--all

displays information for all users (sudo required)

--xml

returns output in xml format.

Displays policy-specific information.

Key GUIDs are resolved to key names if possible. Bold print indicates a personal key.

--all

displays information for all users (sudo required)

--xml

returns output in xml format

--raw

displays raw policies, i.e.

policies as set on the SafeGuard

Management Center server side

107

SafeGuard Enterprise

Command name

sgfsadmin

--enforce-policies

Definition

Applies the encryption policy.

Additional parameters (optional)

--all

applies the policy to all directories where policies apply

"directoryname"

applies the policy to the directory specified.

sgfsadmin --file-status

"filename1"

["filename2"..."filenameN"]

Returns encryption information for a file or a list of files. Wildcards are accepted.

--xml

returns output in xml format

sgfsadmin

--import-config

"/path/to/target/file"

Imports the specified configuration zip file. The command needs administrative rights (sudo).

Note:

Use the drag and drop functionality to drag a complete path from, for example, the Finder into the

Terminal application.

sgfsadmin

--enable-server-verify

Turns on SSL server verification for communication with the SafeGuard

Enterprise server. After installation, the SSL server verification is activated. The command needs administrative rights (sudo).

sgfsadmin

--disable-server-verify

Turns off server verification for communication with the SafeGuard

Enterprise server. The command needs administrative rights (sudo).

Note:

We do not recommend this option as it may create a security vulnerability.

sgfsadmin

--update-machine-info

[--domain "domain"]

Updates the currently stored machine information which is used to register this client on the

SafeGuard Enterprise server. The command needs administrative rights (sudo).

Note:

Use this command only after changing the domain or workgroup

--domain "domain"

The domain the client should use to register on the SafeGuard

Enterprise server. This parameter is only required if the machine is a member of multiple domains. The computer must be joined to this domain, otherwise the command will fail.

108

administrator help

Command name Definition the computer belongs to. If the computer is a member of multiple domains or workgroups and you execute this command, this might result in a change of the domain registration and removal of personal keys and/or FileVault 2 users.

Additional parameters (optional)

sgfsadmin

--dump-unprivileged-applications

[path]

Collects application paths that are not authorized to access encrypted files. You can use the information to add applications to the applications list. You can restrict the results to a specific path.

Note: This function is only relevant for Synchronized Encryption.

sgfsadmin --synchronize

Starts synchronizing database information from the SafeGuard

Enterprise backend such as policies, keys, and certificates.

4.3.11 Using Time Machine

Note: This section is only relevant if an encryption rule is configured for <Removables>.

If you want to use a new disk for a Time Machine backup and the operating system does not automatically suggest using it, use the following command in the Terminal application:

sudo tmutil setdestination -a "/Volumes/.sophos_safeguard_{DISK NAME}/"

If you use Time Machine with an encrypted folder, no old versions are displayed. However, the backups are stored in a hidden location. You are not able to read the contents of the files located in the hidden path. The backups contain only encrypted data and your contents are kept secure.

To restore files, proceed as follows:

1. Open Time Machine (for example by typing "Time Machine" in the Spotlight search).

The content of your root folder is displayed.

2. Press Shift - Command - G (for "Go to the folder:") and enter the hidden path of the encrypted folder you want to restore.

If the encrypted folder you usually work with is named /Users/admin/Documents, then enter

/Users/admin/.sophos_safeguard_Documents/

.

3. Browse to the file you want to restore, click the wheel icon from the Time Machine menu bar and select Restore <file name> to....

After returning from Time Machine to your desktop, your file will be restored and can be decrypted.

109

SafeGuard Enterprise

Note: The first Time Machine backup after a new installation of SafeGuard File Encryption takes longer and requires more disk space than usual. This is because OS X does not allow stacked files systems and thus all local directories for which secure mount points have been created

(Documents, Music, Movies, etc.), the contents will be duplicated on the backup disk. However, after the first backup in the hidden location is complete, older backups are deleted and disk space is freed up again.

4.3.12 Working with removable devices

Before working with removable devices, make sure you have been assigned a policy and key that allow you to encrypt files on removable media.

1. Connect the removable device.

2. A dialog, asking if you want to encrypt plain files on the device, appears. Click Yes to start encryption. If you click NO these files stay plain but you have access to files on the device that are already encrypted. Regardless of your selection, new files on the device will always be encrypted according to the policy.

3. The files on your device will be encrypted automatically. This is indicated by the system menu icon wheel rotating.

4. As soon as all files on your device are encrypted, the wheel rotation stops.

5. Eject the removable device. The corresponding Secured Folder icon disappears automatically.

Note:

To be able to exchange and modify data on removable devices between two parties, both parties must have the corresponding policy and key assigned. No personal keys can be used.

For the exchange between Windows and Mac OS X clients, the device must be formatted using FAT32. Since the file format cannot be displayed in the Finder, you have to use Disk

Utility to check the file system. For the Windows client, a data exchange policy is necessary.

The media passphrase functionality is only available for Windows. From a Mac OS X client, the data can be accessed only if corresponding policies of type File Encryption are defined.

4.4 Troubleshooting

4.4.1 Reset forgotten password

Note: This instruction assumes that the user has both SafeGuard Disk Encryption and SafeGuard

File Encryption or Synchronized Encryption installed on their Mac. If they are using only one of the above, steps may vary.

If a user forgets the Mac OS X logon password, do the following:

1. Tell the user to open the logon dialog and click ?.

The password hint is displayed and the user is prompted to reset the password using the recovery key.

110

administrator help

2. Tell the user to click on the triangle next to the message in order to get to the next step (to enter the recovery key):

3. In the SafeGuard Management Center, select Tools > Recovery and display the recovery key for the specific machine.

4. Tell the user the recovery key to be entered in the logon dialog.

The recovery key is replaced as soon as it has been used once to start the system. The new recovery key is generated automatically and sent to the SafeGuard Enterprise backend where it is stored to be available for the next recovery.

5. In the SafeGuard Management Center, select Users and Computers and remove the user's certificate.

6. For local users, do the following: a) Tell the user to define a new password and a password hint.

b) In the SafeGuard Management Center, select Users and Computers > .Unconfirmed

Users and confirm the user.

c) Tell the user to open the Server tab in the Preference Pane and click Synchronize.

7. For Active Directory users, do the following: a) Reset the existing password in your user administration environment and generate a preliminary password. Select the corresponding option to force the user to modify the password after the first login.

b) Contact the user, and hand over the preliminary password.

c) Tell the user to click Cancel in the Reset Password dialog and enter the preliminary password instead.

d) Tell the user to define a new password and a password hint and click Reset Password.

8. Tell the user to click Create New Keychain in the following dialog.

9. Tell the user to enter the new password to create the SafeGuard user certificate.

The user's keys will be loaded into the new keychain automatically, so all documents will be accessible as before.

Note: Be careful to whom you give a recovery key. As a recovery key is always machine specific and not user specific. Make sure that the recovery key is not used to get unauthorized access to another user's sensitive data on the same machine.

4.4.2 Problems with accessing data

If a user experiences problems when trying to access data, possible reasons are the following:

■

The user has not yet been confirmed.

For information on unconfirmed users, see Enhanced authentication - the .Unconfirmed Users group

(page 8).

Note: Local users always are unconfirmed users.

111

SafeGuard Enterprise

■

The user does not have the required key in their key ring.

For information on assigning keys to users, see

Assign keys in Users and Computers

(page

276).

■

The keys have been temporarily revoked for security reasons. The endpoint is considered unsafe (compromised).

4.4.3 Problems with using virtual machines

Virtualization applications such as VMware Fusion or Parallels cannot be used with a SafeGuard

Enterprise mount point. We recommend that you start the virtual machine from a hidden folder instead.

Example:

Instead of starting the virtual machine from

~/Documents/Virtual Machines/

, use the path

~/.sophos_safeguard_documents/Virtual Machines

.

4.4.4 SafeGuard recovered files

Under certain circumstances a folder named Sophos SafeGuard Recovered Files can be found in a folder. This happens if SafeGuard File Encryption tries to create a new Secured Folder (mount point), but the hidden folder that needs to be created for storing the encrypted contents (for example /Users/admin/.sophos_safeguard_Documents/) exists already and is not empty. Then the content of the original folder (for example /Users/admin/Documents) will be moved to Sophos

SafeGuard Recovered Files and only the content of the hidden folder will be displayed as usual.

4.5 Inventory and status data of Macs

For Macs the Inventory provides the following data about each machine. The data displayed can differ, depending on the installed Sophos product:

■

The name of the Mac

■

■

The operating system

The POA type

■

The POA status

■

The number of encrypted drives

■

The number of unencrypted drives

■

The last server contact

■

The modification date

■

Whether the current company certificate is used or not

112

administrator help

5 Modules

5.1 Synchronized Encryption

Synchronized Encryption is built on two assertions – that all data is important and must be protected

(encrypted) and that encryption should be persistent wherever the data is located. In addition, important data should be encrypted automatically and transparently so that a user need not be bothered with having to decide whether or not to encrypt a file based on its perceived importance.

This very basic premise, that all data is important and must be protected, ensures that all data is encrypted seamless without user intervention. This allows the user to remain productive, have their data secure and follow their existing workflows.

Note: This section applies to both Windows and Mac OS X. Where the information is relevant to one of them, this will be mentioned explicitly.

Modules

■

Application-based file encryption

SafeGuard Enterprise Synchronized Encryption can encrypt any file created with an application specified in a policy, regardless of its file location. For example, if you specify Microsoft Word as an application for which file encryption is active, every file you create or save with Microsoft

Word is automatically encrypted with the Synchronized Encryption key. Anyone whose key ring includes this key can access the file. A policy defines a list of applications for which file encryption is executed automatically

■

Outlook add-in

To make life easier for an end user, Synchronized Encryption provides an Outlook add-in that can automatically detect an email being sent outside the organization with a file attachment.

It will then ask which option (Password protected, Unprotected) the user wishes to choose.

If required, the user can set a password in the dialog displayed. Alternatively, you can use a policy to define a default action that is performed automatically without any user intervention.

Note: The Outlook add-in is only available on Windows endpoints.

■

Integration with Sophos Central Endpoint Protection - remove keys on compromised machines

In combination with Sophos Central Endpoint Protection, keys can be removed automatically if malicious activity is detected on endpoints.

Note: This feature is only available if you use web-based Sophos Central Endpoint Protection together with SafeGuard Enterprise.

■

Share key ring between SafeGuard Enterprise and Sophos Mobile Control

Encryption keys from the SafeGuard Enterprise key ring can be made available in the Sophos

Secure Workspace (SSW) app managed by Sophos Mobile Control. Users of the app can

113

SafeGuard Enterprise then use the keys to decrypt and view documents, or to encrypt documents. These files can then be securely shared between all SafeGuard Enterprise and SSW users.

5.1.1 Requirements

In order to use the Synchronized Encryption features, the following requirements must be met:

■

SafeGuard Enterprise Server, Database and Management Center are set up properly.

■

The Synchronized Encryption module must be installed on the endpoints.

Note:

■

Synchronized Encryption replaces all other SafeGuard Enterprise File Encryption modules.

It cannot be installed in addition to Data Exchange, File Encryption, or Cloud Storage. File encryption policies that are used by these location-based modules are incompatible with the new application-based Synchronized Encryption policies. If you migrate from the

SafeGuard Enterprise File Encryption module to the Synchronized Encryption module and keep the location-based policies, the RSOP in the SafeGuard Management Center will still show both, but only the application-based policy is valid. The reason for this is that the calculation of the RSOP does not consider the installed modules on an endpoint.

■

The Synchronized Encryption module is not compatible with SafeGuard LAN Crypt.

■

In order to activate the features you need to do the following:

■

Create application-based file encryption policies (Synchronized Encryption)

■

■

■

Create policies for activating the Outlook add-in (encrypts email attachments according to policy settings)

Create policies for activating the integration with Sophos Endpoint Protection (removing keys if malicious activity is detected on endpoints)

Configure the sharing of the SafeGuard Enterprise key ring with mobile devices managed by Sophos Mobile Control

Note: On Macs only user policies apply. Machine policies are ignored.

5.1.1.1 Install endpoints

Run the client installer for your platform. On Windows endpoints, select the Synchronized

Encryption module in the following dialog. Follow the on-screen instructions.

5.1.1.2 Upgrade endpoints

■

Windows: To upgrade your endpoints from SafeGuard Enterprise 6.1 or later and install the

Synchronized Encryption module, run the client installer for your platform and follow the on-screen instructions. This upgrades the installed modules to version 8. In order to install the

Synchronized Encryption module, start the installation again, select Change in the Change,

repair, or remove installation dialog and select Synchronized Encryption. If installed, remove any location-based file encryption.

■

Mac OS X: Run the client installer and follow the on-screen instructions.

114

administrator help

5.1.1.3 Migration from existing File Encryption module on Windows

Users can migrate from the SafeGuard Enterprise File Encryption module to the Synchronized

Encryption module. Files that were encrypted before remain encrypted and accessible. Files that are modified and saved after the migration are re-encrypted with the Synchronized Encryption key. By specifying an initial encryption in a policy, files can be re-encrypted with the Synchronized

Encryption key.

Prerequisites

You have to ensure that all required keys ("old keys" used for encrypting files with the legacy File

Encryption module, and "new" Synchronized Encryption key ) are available in the users' key rings.

■

■

If necessary, you can assign keys to users in the Management Center.

If needed, users have to import user-defined local keys to their key ring on endpoints, see chapter Import keys from a file in the SafeGuard Enterprise user help. Then the local keys will become available in the SafeGuard Management Center as well. They can be assigned to users as requested.

Run migration

Follow these steps:

1. Install the Synchronized Encryption module on endpoints. The module replaces the existing

File Encryption module.

2. Make sure that all keys the users had in their key rings when they used File Encryption remain part of their key rings. This ensures that users can access files that are already encrypted using Synchronized Encryption.

3. In the Management Center, create new Synchronized Encryption policies.

■

■

■

All applications that should be able to access encrypted files must be part of the Application

List used in the Synchronized Encryption policies.

Synchronized Encryption policies should cover the same Encryption scope as previous location-based File Encryption policies.

Specify settings for initial encryption. Initial encryption will start immediately after the policy has been applied on the endpoint and encrypt or re-encrypt all files with the Synchronized

Encryption key. This ensures that all files are encrypted according to policies.

Note: Initial encryption can also be started from the Windows Explorer context menu

(SafeGuard File Encryption > Encrypt according to policy).

4. Deploy the policies.

Result

■

Encrypted files covered by the Synchronized Encryption policies are re-encrypted with the

Synchronized Encryption key.

■

Files created or modified by applications on the Synchronized Encryption Application list will be encrypted with the Synchronized Encryption key.

115

SafeGuard Enterprise

■

Encrypted files not covered by the Synchronized Encryption policies stay encrypted with the previous File Encryption key. Users who have the required key in their key ring can always decrypt files manually, even if files are no longer covered by encryption policies.

5.1.1.4 Migration from existing File Encryption module on OS X

The Sophos SafeGuard Enterprise OS X endpoints can handle both Synchronized Encryption policies of type Application-based and File Encryption policies of type Location-based.

Depending on which policies they receive, endpoints act either as a Synchronized Encryption endpoint or a File Encryption endpoint.

If you upgrade from version 6.1, the endpoints keep on working in the File Encryption location-based mode as in the previous version.

To switch to the Synchronized Encryption application-based mode, do the following:

Run migration

1. In the Management Center, create new Synchronized Encryption policies.

■

All applications that should be able to access encrypted files must be part of the Application

List used in the Synchronized Encryption policies.

■

■

Synchronized Encryption policies should cover the same Encryption scope as previous location-based File Encryption policies.

Specify settings for initial encryption. Initial encryption will start immediately after the policy has been applied on the endpoint and encrypt or re-encrypt all files with the Synchronized

Encryption key. This ensures that all files are encrypted according to policies.

Note: Users can also start initial encryption from the Policies tab in the preference pane

(Enforce all policies).

2. Deploy the policies.

3. When users receive the policies they will be prompted to log off and log on again.

Result

■

Encrypted files covered by the Synchronized Encryption policies are re-encrypted with the

Synchronized Encryption key.

■

Files created or modified by applications on the Synchronized Encryption Application list will be encrypted with the Synchronized Encryption key.

■

Encrypted files not covered by the Synchronized Encryption policies stay encrypted with the

File Encryption key. Users who have the required key in their key ring can always decrypt files manually, even if files are no longer covered by encryption policies.

5.1.1.5 Partial rollout of Synchronized Encryption

In case of a partial-rollout of SafeGuard Enterprise Synchronized Encryption, you have to make sure that all of your users can access shared encrypted data.

116

administrator help

If you want to activate encryption in your company step by step, you can start by deploying

Synchronized Encryption policies with activated encryption for example to the endpoints of the

Marketing department only. These endpoints will encrypt files according to the Synchronized

Encryption policies. Users on endpoints of other departments will not be able to access these files since they do not have the Synchronized Encryption policies applied. To avoid this situation, you can deploy read-only policies that enable read access to encrypted files. These endpoints do not encrypt any data but can read encrypted files.

Prerequisite:

■

SafeGuard Enterprise Server, Database, and Management Center are set up properly.

■

■

The Synchronized Encryption module is installed on all endpoints and can connect to the

Management Center (configuration package is installed).

You have created an application list and a Synchronized Encryption policy for the endpoints which should encrypt data.

To roll out SafeGuard Enterprise Synchronized Encryption, follow these steps:

1. Create a Synchronized Encryption policy (application-based) in the SafeGuard Management

Center.

2. Deploy the policy to users whose endpoints should encrypt data. In the example above, endpoints of the Marketing department.

3. Create read-only policies.

Note: You need to create separate policies for Windows and Mac endpoints.

4. Deploy the read-only policies to all of your other Windows and Mac endpoints. In the example above, all endpoints except those of the Marketing department.

5.1.1.5.1 Create read-only policy for Windows endpoints

1. In the Management Center, go to Policies.

2. Right-click Policy Items, then click New and then File Encryption.

3. Enter a name for the new policy and click OK.

4. On the File encryption tab, select Application-based (Synchronized Encryption) from the

Encryption type drop-down list.

Application list and Encryption scope options are displayed.

5. Select the Application list you have previously created from the drop-down list.

6. From the Encryption scope drop-down list, select Defined locations.

7. When you leave the File encryption tab, the system prompts you to save your changes.

8. Click Yes.

9. Go to Users and Computers and assign and activate the new policy for Windows endpoints users who should be able to read encrypted data but not encrypt data.

Note: This policy must not be assigned to Mac OS X endpoints. This can be easily achieved by activating the policy only for .Authenticated Computers since Mac OS X endpoints only interpret user settings. To do so, drag the .Authenticated Users group from the policies activation area to the Available Groups list.

5.1.1.5.2 Create read-only policy for Mac endpoints

1. In the Management Center, go to Policies.

117

SafeGuard Enterprise

2. Right-click Policy Items, then click New and then File Encryption.

3. Enter a name for the new policy and click OK.

4. On the File encryption tab, select Location-based from the Encryption type drop-down list.

The list to specify the paths for location-based encryption is displayed.

5. Specify the following paths and exclude them from encryption.

a) Network shares: Use the

<Network Shares>

placeholder to point to the root folders of all Mac OS X network shares.

b) Removable media: Use the

<Removables>

placeholder to point to the root folders of all

Mac OS X removable media.

c) Cloud provider synchronization folder(s): Enter the folder(s) that will be synchronized with a cloud service. Only local paths are supported.

d) Note: The following path is only needed if Microsoft Outlook for Mac 2011 is used.

<User Profile>\Library\Caches\TemporaryItems\Outlook Temp\

e) Note: The following path is only needed if Microsoft Outlook for Mac 2016 is used.

<%TMPDIR%>\com.microsoft.Outlook\Outlook Temp\

f) Note: The following paths are only needed if Apple Mail is used:

<User Profile>\Library\Containers\com.apple.mail\Data\Library\Mail

Downloads\

<%TMPDIR%>\com.apple.mail\com.apple.mail\

6. Make sure all paths are excluded from encryption: Exclude is selected in the Mode column for each path.

7. When you leave the File encryption tab, the system prompts you to save your changes.

8. Click Yes.

9. Go to Users and Computers and assign the new policy to the Mac endpoints users who should be able to read encrypted data but not encrypt data.

5.1.2 Encrypt data

SafeGuard Enterprise Synchronized Encryption comes with a versatile file encryption module.

Synchronized Encryption allows you to encrypt sensitive data based on the application it was created or modified with. This encryption is persistent, so your data is secure even if moved to another location, uploaded to a cloud storage provider, or sent via email. Depending on the policy definitions, certain file types are usually encrypted automatically. However, in some cases it might be necessary to decrypt or encrypt single files manually. In Windows Explorer and OS X Finder, encrypted files are marked with a green lock symbol.

118

administrator help

Persistent encryption

Windows

■

When you move an encrypted file from an encrypted folder to a plain folder, the file will still be encrypted. You can open the file and edit it. When you modify and save it, it will still be encrypted.

Mac OS X

■

Moving encrypted files from Secured Folders

As a security officer you define which folders on your Macs are classified as Secured Folders.

If you are using Synchronized Encryption, all files in Secured Folders are encrypted automatically.

When you move an encrypted file from a Secured Folder to a non-Secured Folder, the file will still be encrypted.You can open it, but encrypted content will be displayed.You need to decrypt it manually first.

When you open an encrypted file in a Secured Folder and save it in a non-Secured Folder, the file will be decrypted automatically.

Policies

■

Synchronized Encryption policies are not merged. The policy closest to the target object

(user/computer) in a hierarchy chain is always applied. The policy currently in force for a user or computer is displayed on the RSOP tab under Users and Computers.

Backups

If you use backup software, like File History in Windows 8.x and Windows 10 or Time Machine in Mac OS X, you may have backup, older versions of files of the type you want to encrypt.

Synchronized Encryption cannot encrypt these files. You should remove or encrypt existing backups and deactivate automatic backups.

5.1.2.1 Synchronized Encryption key

SafeGuard Enterprise Synchronized Encryption uses a single key to encrypt files:

Root_Synchronized_Encryption@SGN

The key is assigned automatically and is available for all users in the domain but not for local users.

5.1.2.2 Application Lists

For application-based file encryption, you need to create Application Lists. These lists contain applications where files are encrypted as soon as they are created or saved. Only applications on Application Lists can access encrypted data. All other applications will display unreadable encrypted content. SafeGuard Enterprise provides an application list template you can easily customize to fit your needs. It contains common applications for which you can apply

119

SafeGuard Enterprise application-based file encryption. You can selectively activate or deactivate applications within a group or the whole group.

Note: Creating Application-based (Synchronized Encryption) policies is not possible without creating Application Lists beforehand.

Application lists for Macs

For some OS X applications, you need to exclude certain locations from encryption to ensure proper functionality. For example for Microsoft Office 2011

<Documents>\Microsoft User

Data

needs to be excluded. In the provided template this path is already specified.

5.1.2.2.1 Create Application List

1. In the Management Center, go to Policies.

2. Go to the Application Lists entry of the Policies list view.

3. Right-click Template and click Duplicate Application List.

Template_1 is displayed.

4. Right-click Template_1, click Properties and enter a new name.

5. Click OK.

6. Click on the new application list.

On the right-hand pane, the content of the template is displayed.

7. If you want to create Application Lists for Macs, change to the OS X tab.

8. Go through the list and deactivate applications for which you do not want to apply encryption.

Deactivating the Active option to the right of an Application Group Name will deactivate all applications in the group. Deactivating the Active option to the right of a particular application within the group will deactivate this application only.

9. Add further applications to existing groups.

a) Right-click the group to which you want to add an application, click New and then

Application.

b) In the Application Name edit field, enter a name of your choice for the application.

c) Under Process location, specify the path including the executable. You can enter the path manually or you can use the placeholders from the drop-down list.

You can specify all versions of an application under one Application name. For example

Acrobat Reader 11.0 and Acrobat Reader DC under Application Name: Reader d) File Extension: The file extensions you specify here do not have any implication for

Application-based (Synchronized Encryption) file encryption but for initial encryption of existing files. Existing files covered by encryption policies are not encrypted automatically.

To encrypt these files, initial encryption must be performed on endpoints. Files with the file extensions you specify here will be encrypted with the Synchronized Encryption key during initial encryption. You can enter file extensions with or without a leading dot (for example

".txt" or "txt"). Wildcards are not supported.

The location where initial encryption is to be applied has to be specified when creating a policy for the Application-based file encryption.

120

administrator help

If you deactivate an application group, the file extensions you specified for initial encryption within the group will be deactivated as well.

10. OS X only: If necessary, add locations to be excluded from encryption to the Excluded

location table to ensure proper functionality.

11. Add further application groups:

You can use application groups to collect for example all parts of a software suite under one node. This allows you to deactivate all parts by deactivating only the group.

a) Right-click the Template tree view, click New and then Application Group.

b) In the Application Group Name edit field, enter a name of your choice for the group.

c) Add further applications to the group.

12. When you leave the template view, the system prompts you to save your changes.

13. Click Yes.

The new application list is displayed under Application Lists in the Policies list view. You can create further application lists and use them in different policies for application-based file encryption.

We recommend that you add all applications that are able to handle the same file types (for example .docx) to the application list. You should not add applications that share data over the internet (for example email clients, browsers).

5.1.2.3 Initial encryption

Initial Encryption encrypts all files according to:

■

■

File extensions specified in Applications lists, see

Create Application List (page 120).

Settings specified in Synchronized Encryption policies, see

Create policies for application-based file encryption (page 123).

It can be automatically triggered by means of a policy setting or manually by users.

If automatically triggered, initial encryption runs in the background. When done, a log event is generated.

It starts each time endpoints receive new Synchronized Encryption policies and each time users log on to their endpoints. This ensures that files are always encrypted according to company policies and prevents them remaining unencrypted unintentionally.

Note: If a large amount of data has to be processed, initial encryption may lead to performance issues on the endpoints.

On Windows, users can manually start initial encryption from the context menu in Explorer extensions (SafeGuard File Encryption > Encrypt according to policy). The SafeGuard File

Encryption Wizard is displayed, showing information on the amount of data to be processed, the progress and the results of the task.

On Macs, users can go to the Policies tab of the Preference pane and click Enforce all Policies to start initial encryption.

If files encrypted with a key other than the Synchronized Encryption key are detected and users have this key in their key ring, these files are re-encrypted with the Synchronized Encryption key.

Files that are encrypted with a key that is not available in the user's key ring are left unchanged.

121

SafeGuard Enterprise

Initial encryption is applied in locations defined in policies.

5.1.2.3.1 Initial encryption on network shares

On network shares initial encryption cannot be automatically triggered by means of a policy setting.

As a security officer you can run initial encryption for network shares from a computer that has the SafeGuard Enterprise endpoint software installed and has access to these shares using the

SGFileEncWizard.exe

command line tool.

On a computer with SafeGuard Enterprise you can find the tool in

<SYSTEM>:\Program Files

(x86)\Sophos\SafeGuard Enterprise\Client\

Before you start initial encryption on network shares consider what follows:

■

This process can cause issues for users on endpoints that do not have the Synchronized

Encryption module installed or do not have a Synchronized Encryption policy applied. These users cannot decrypt files encrypted with Synchronized Encryption. Make sure that users on endpoints that should be able to access these files have the Synchronized Encryption module installed and a policy applied.

■

If you want to re-encrypt files on network shares that are already encrypted, you need to have all keys which have been used to encrypt these files in your key ring when starting initial encryption. Files for which you do not have the key remain encrypted with the "old" key.

Requirements for performing initial encryption on network shares

■

■

■

■

Initial encryption must be started on a computer with the SafeGuard Enterprise endpoint software installed.

The endpoint must have access to all network shares to be encrypted.

A Synchronized Encryption policy that covers all network shares to be encrypted has to be applied to the endpoint.

All keys used to encrypt existing files on the network shares need to be part of your key ring.

Perform initial encryption with SGFileEncWizard

You can call

SGFileEncWizard.exe

with the following parameters:

SGFileEncWizard.exe [<startpath>] [%POLICY] [/V0 | /V1 | /V2 | /V3] [/X]

[/L<logfile>]

■

■

<startpath>

: Process the specified paths and their subfolders. Several paths must be separated by blanks.

Note:

For initial encryption on network shares, you must explicitly specify every network share to be encrypted. Only these paths will be processed. Specify the paths in UNC notation to avoid issues with different drive letters for mapped network shares. Only absolute paths are allowed.

%POLICY: Apply Synchronized Encryption policy to the specified locations and re-encrypt files if necessary. The policy applied to the endpoint where

SGFileEncWizard.exe

is started is used.

122

administrator help

Note: This parameter can be omitted for initial encryption on network shares.

■

Parameter

/V0

: Do not report any messages.

■

Parameter

/V1

: Log errors only.

■

Parameter

/V2

: Log modified files.

■

Parameter

/V3

: Log all processed files.

■

Parameter

/L<path+logfile name>

: Write the output to the specified log file.

■

Parameter

/X

: Hide the wizard's window.

Example:

SGFileEncWizard.exe \\my-filer-1\data1\users \\my-filer-1\data2 %POLICY

/V3 /X /LC:\Logging\mylogfile.xml

Initial encryption is performed for files in \\my-filer-1\data1\users and \\my-filer-1\data2. The wizard will not be displayed and information on all processed files is written to mylogfile.xml.

5.1.2.4 Create policies for application-based file encryption

1. In the Policies navigation area, create a new policy of the type File Encryption.

The File Encryption tab is displayed.

2. Select Application-based (Synchronized Encryption) from the Encryption type drop-down list.

Application list and Encryption scope options are displayed.

Note: For encryption type No Encryption see

Policies of type No encryption (page 132).

3. From the drop-down list, select the Application list you created beforehand.

123

SafeGuard Enterprise

4. From the Encryption scope drop-down list, select one of the following:

■

Everywhere: Encryption is applied on local drives, removables, cloud storage and network drives. You can define exemptions where no application-based file encryption is applied.

Note: For OS X, Everywhere means that all files in some predefined locations will be encrypted and can therefore only be used by the applications in your application list. These locations are:

■ folder

<Desktop>

■ folder

<Documents>

■ folder

<Downloads>

■ folder

<Music>

■ folder

<Pictures>

■ folder

<Videos>

■ all network shares

■ all removable devices

■ all supported cloud storage providers

■ temporary folders where Microsoft Outlook and Apple Mail store mail attachments

Important: Applying Synchronized Encryption to network shares can cause issues for some users. If files on network shares have been encrypted by users who have the

Synchronized Encryption key in their key ring, users without such key will not be able to decrypt them. To avoid this, you can first exclude network shares from encryption and remove the exemption after you are sure that all users have the Synchronized Encryption key. Users receive their key when a Synchronized Encryption policy is applied to their endpoint or you can manually assign the keys in the Management Center.

■

Defined locations: Lets you specify paths where encryption is applied. Placeholders for path definitions are provided. You can select to include or to exclude a path in/from encryption.

5. Depending on your selection for the Encryption scope, you can define paths where application-based encryption is applied (Defined Locations) or exemptions to application-based encryption (Everywhere).

Note: You can define paths for Windows and Mac OS X in the same policy. Placeholders for the different systems are available from the Path drop-down list. The System column indicates for which operating system the path is valid (All systems, Windows, Mac OS X). By hovering your cursor over the Cloud Storage placeholders, you can display tooltips telling you for which operating system you can use the placeholder.

124

administrator help

6. In the Path column, set the path to be handled by Application-based (Synchronized

Encryption) file encryption:

■

Click the drop-down button and select a folder name placeholder from the list of available placeholders.

Note: By hovering your cursor over the list entries, you can display tooltips telling you how a placeholder is typically presented on an endpoint. You can only enter valid placeholders

for each operating system. For a description of all available placeholders, see Placeholders for paths in application-based File Encryption rules

(page 125).

Important: Encrypting the whole user profile with the placeholder

<User Profile>

may result in an unstable Windows desktop on the endpoint.

■

■

Click the Browse button to browse the file system and select the required folder.

Alternatively, just enter a path name.

7. Select the encryption Mode:

■

■

For Encryption scope - Defined Locations, select Encrypt to let applications from the applications list encrypt their files under this path or Exclude if these applications should not encrypt their files under this path. For example, you can specify to encrypt

D:\Documents

and exclude

D:\Documents\Plain

.

For Encryption scope - Everywhere, you can only Exclude paths from encryption.

8. Add further paths as required.

9. Specify settings for Initial encryption. Select where existing files are encrypted according to the specified paths (Stored on local disks, Stored on removable devices, Stored with

automatically detected cloud storage providers). Initial encryption starts when the policy is applied on the endpoint or when a removable device is connected.

10. Save your changes.

Note: When you leave the File encryption tab, the system prompts you to save your changes.

11. Go to Users and Computers and assign the new policy to your user groups.

5.1.2.4.1 Placeholders for paths in application-based File Encryption rules

The following placeholders can be used when specifying paths in encryption rules in File

Encryption policies. You can select these placeholders by clicking the drop-down button of the

Path field.

Note: Always use backslashes as path separators, even when creating File Encryption rules for

Mac OS X. This allows you to apply rules on both operating systems, Windows and Mac OS X.

On Mac OS X client side, backslashes will automatically be transformed to slashes in order to match the requirements of the Mac OS X operating system. Any errors in placeholders are logged.

Invalid File Encryption rules are logged and then discarded on the endpoint.

Example: The Windows path

<User Profile>\Dropbox\personal

is converted on Mac side into

/Users/<Username>/Dropbox/personal

.

125

SafeGuard Enterprise

Path placeholder Operating System

(All=Windows and

Mac OS X)

Results in the following value on the endpoint

<%environment_variable_name%>

All The value of environment variable. Example:

<%USERNAME%>.

Note: If environment variables contain several locations (for example the PATH environment variable), the paths will not be separated into multiple rules. This causes an error and the encryption rule is invalid.

<Desktop>

<Documents>

<Downloads>

<Music>

All

All

All

All

The virtual folder that represents the endpoint's desktop.

The virtual folder that represents the My

Documents desktop item (equivalent to

CSIDL_MYDOCUMENTS). Typical path:

C:\Documents and Settings\username\My

Documents.

The folder where downloads are stored by default. A typical path for Windows is

C:\Users\username\Downloads.

The file system directory that serves as a data repository for music files. Typical path:

C:\Documents and Settings\User\My

Documents\My Music.

<Network Shares>

<Pictures>

<Public>

<Removables>

<User Profile>

All

All

All

All

All

The file system directory that serves as a data repository for image files. Typical path:

C:\Documents and Settings\username\My

Documents\My Pictures.

The file system directory that serves as a common repository for document files for all users. Typical path:

C:\Users\<username>\Public.

Points to the root folders of all removable media.

The user's profile folder. Typical path:

C:\Users\username.

Note: Encrypting the whole user profile with this placeholder may result in an unstable

Windows desktop on the endpoint.

126

administrator help

Path placeholder

<Videos>

<Cookies>

<Favorites>

<Local Application Data>

<Program Data>

<Program Files>

<Public Music>

<Public Pictures>

<Public Videos>

<Roaming>

Operating System

(All=Windows and

Mac OS X)

Results in the following value on the endpoint

All

Windows

Windows

Windows

Windows

Windows

Windows

Windows

Windows

Windows

The file system directory that serves as a common repository for video files for users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Videos.

The file system directory that serves as a common repository for internet cookies. Typical path: C:\Documents and

Settings\username\Cookies.

The file system directory that serves as a common repository for the user's favorite items.

Typical path: \Documents and

Settings\username\Favorites.

The file system directory that serves as a data repository for local (non-roaming) applications.

Typical path: C:\Documents and

Settings\username\Local Settings\Application

Data.

The file system directory that contains application data for all users. Typical path:

C:\Documents and Settings\All

Users\Application Data.

The Program Files folder. Typical path:

\Program Files. For 64-bit systems, there will be two rules - one for 32-bit applications and one for 64-bit applications.

The file system directory that serves as a common repository for music files for all users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Music.

The file system directory that serves as a common repository for image files for all users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Pictures

The file system directory that serves as a common repository for video files for all users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Videos.

The file system directory that serves as a common repository for application-specific data.

127

SafeGuard Enterprise

Path placeholder

<System>

<Temporary Burn Folder>

Operating System

(All=Windows and

Mac OS X)

Results in the following value on the endpoint

Typical path: C:\Documents and

Settings\username\Application Data.

Windows

Windows

The Windows System folder. Typical path:

C:\Windows\System32. For 64-bit systems, there will be two rules - one for 32-bit and one for 64-bit.

The file system directory that is used as a staging area for files waiting to be written on a

CD. Typical Path: C:\Documents and

Settings\username\Local Settings\Application

Data\Microsoft\CD Burning.

<Temporary Internet Folder>

Windows

<Windows>

<Root>

Windows

Mac OS X

The file system directory that serves as a common repository for temporary internet files.

Typical path: C:\Documents and

Settings\username\Local Settings\Temporary

Internet Files.

The Windows directory or SYSROOT. This corresponds to the environment variables

%windir% or %SYSTEMROOT%. Typical path:

C:\Windows.

The Mac OS X root folder. We recommend that you do not specify policies for the root folder, even if it is technically possible.

Cloud Storage placeholders

Provider

Box

Cloud Storage placeholder

<!Box!>

Can be used in CSD (Cloud

Storage Definition) setting

Resolves to

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the Box software.

128

administrator help

Provider

Dropbox

Egnyte

Windows only

Cloud Storage placeholder

<!Dropbox!>

<!Egnyte!>

<!EgnytePrivate!>

Can be used in CSD (Cloud

Storage Definition) setting

Resolves to

For synchronization folders: The fully qualified path of the synchronization folder used by the Box software.

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the Dropbox software.

For synchronization folders: The fully qualified path of the synchronization folder used by the Dropbox software.

Synchronization Application

The fully qualified path of the synchronization application used by the Egnyte software.

Synchronization folders

All private folders in the Egnyte cloud storage.

For standard

Egnyte users this is usually a single folder. For

Egnyte administrators this placeholder typically resolves

129

SafeGuard Enterprise

Provider

Google Drive

OneDrive

Cloud Storage placeholder Can be used in CSD (Cloud

Storage Definition) setting

Resolves to

<!EgnyteShared!>

Synchronization folders

to multiple folders.

All shared folders in the Egnyte cloud storage.

Note:

Changes to the Egnyte folder structure (including adding or removing private and shared folders) are detected automatically.

Relevant policies are updated automatically.

Note: As Egnyte synchronization folders may reside on network locations you can enter network paths in the Synchronization

folders setting.The SafeGuard Enterprise Cloud Storage module therefore applies to network file systems by default. If this is not required, you can deactivate this behavior by defining a General

Settings policy and selecting Network under Ignored Devices.

<!GoogleDrive!>

<!OneDrive!>

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the Google

Drive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the Google Drive software.

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used

130

administrator help

Provider

OneDrive for

Business

Cloud Storage placeholder Can be used in CSD (Cloud

Storage Definition) setting

Resolves to by the OneDrive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the OneDrive software.

Note: SafeGuard Enterprise does not support Microsoft accounts. Under Windows 8.1, OneDrive can only be used if the

Windows user is a domain user. Under Windows 8.1 SafeGuard

Enterprise does not support OneDrive for local users.

<!OneDriveForBusiness!>

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the OneDrive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the OneDrive software.

Note: OneDrive for Business only supports storing encrypted files in local folders and synchronizing them with the cloud.

Storing encrypted files from Microsoft Office 2013 applications directly in the OneDrive for Business cloud or directly on the

SharePoint Server is not supported. These files are stored unencrypted in the cloud.

SafeGuard Enterprise encrypted files in the OneDrive for

Business cloud cannot be opened by Microsoft Office 365.

131

SafeGuard Enterprise

Provider

SkyDrive

Windows only

Cloud Storage placeholder

<!SkyDrive!>

Can be used in CSD (Cloud

Storage Definition) setting

Resolves to

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the OneDrive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the OneDrive software.

Microsoft renamed SkyDrive to OneDrive, but the

<!SkyDrive!>

placeholder is still available to use.

This way older policies using the placeholder and SafeGuard

Enterprise endpoints before version 7 which cannot handle the

<!OneDrive!>

placeholder can be used without any changes.

SafeGuard Enterprise endpoints starting with version 7 can handle both placeholders.

5.1.2.5 Policies of type No encryption

Where policies are assigned along a hierarchy chain, the policy closest to a target object

(user/computer) is the highest ranking. This means that as the distance to the target object increases a policy will be superseded by any policies that are closer. Policies of type No

Encryption can be used to interrupt the inheritance of encryption policies at certain locations in the hierarchy chain. For subordinate levels the No Encryption policy will be valid as well.

Depending on module and version, the behavior of the endpoints varies.

Endpoints with Synchronized Encryption

Policies of type Application-based (Synchronized Encryption) are NOT merged. The policy closest to the target object (user/computer) in a hierarchy chain is always applied. If it is the closest, a No encryption policy will become effective.

Endpoints with File Encryption version 8

132

administrator help

Policies of type Location-based are merged. If several policies are assigned, their content is evaluated according to certain rules, see

Rules for assigning and analyzing policies (page 241).

For the Resulting Set of Policies (RSOP) see, Location-based File Encryption policies in the RSOP

(page 159). Within an assignment, the policy with the highest priority (1) ranks above a policy with a lesser priority. If it has the highest priority, a No encryption policy will become effective.

Endpoints with File Encryption below version 8

A No encryption policy has no effect on these endpoints. Endpoints with File Encryption 7.0

and lower do not recognize the Encryption Type setting. Rules from all File Encryption policies of type Location-based apply.

Note: This is particularly important if you have to handle endpoints of version 8 and older versions simultaneously.

5.1.3 Outlook Add-in

Note: The Outlook add-in is only available on Windows endpoints.

When sending email attachments to recipients who are using Synchronized Encryption, the

Synchronized Encryption key is used automatically. You do not need to worry about encryption and decryption. When sending emails to recipients outside your corporate network, you may want to encrypt your attachments to protect sensitive data. SafeGuard Enterprise includes an add-in for Microsoft Outlook that makes encrypting email attachments easy. Whenever you send an email with one or more files attached, the system prompts you to choose how to send the attachments. The available options may vary according to the encryption state of the files you attached to your email.

5.1.3.1 Create policies for activating the SafeGuard Enterprise Outlook Add-in

To activate the SafeGuard Enterprise Synchronized Encryption Outlook Add-in:

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

The General Settings tab is displayed.

2. Go to the Email add-in settings section.

3. In the Enable email add-in drop-down list, select Yes.

The add-in is now activated. Users will be prompted to decide how to handle attachments each time they send emails with attachments.

In addition, you can list domains and specify how attachments are handled when they are sent to these domains.

4. To do so, select how to handle attachments from the Encryption method for white-listed

domains drop-down list:

■

■

Encrypted: All attachments in emails to the specified domain will be encrypted. Users will not be prompted.

No encryption: Attachments in emails to the specified domain will not be encrypted. Users will not be prompted.

133

SafeGuard Enterprise

■

■

Unchanged: Encrypted files will be sent encrypted, plain files will be sent in plaintext. Users will not be prompted.

Always ask: Users will be asked how to handle the attachments each time they send emails to the specified domain.

5. Enter one or more domains for which the encryption method should be applied. Enter several domains separated by commas. Wildcards and partially specified domains are not supported.

6. When you leave the General Settings tab, the system prompts you to save your changes.

7. Click Yes.

8. Go to Users and Computers and assign the new policy to your user groups.

5.1.4 Integration with Sophos Endpoint Protection

SafeGuard Enterprise Synchronized Encryption protects your data by removing keys when malicious activity is detected on an endpoint.

Important: This feature is only available if you use web-based Sophos Central Endpoint Protection together with SafeGuard Enterprise.

It ensures that Sophos SafeGuard communicates with Sophos Central Endpoint Protection.

SafeGuard Enterprise and Sophos Central Endpoint Protection will share the health status of your system. If your system becomes infected, SafeGuard Enterprise will protect your sensitive files.

When no keys are available, encrypted data cannot be accessed.

When that happens, users will be informed that they have an unhealthy system but SafeGuard has protected their encrypted files and they cannot open them for a while. Endpoints will remain in this state until they return to a healthy state. Then SafeGuard Enterprise will provide the keys again. Users will be informed that their endpoint is secure and that they can access encrypted files again.

In situations where you regard the unhealthy state of endpoints as no longer justified and the endpoints remain in an unhealthy state you can give users access to their key ring by setting the

Remove keys on compromised machines option to No and assign the modified policy to your

user groups, see Creating policies for removing keys on compromised machines (page 135).

Important: You must be aware that disabling Remove of keys on compromised machines represents a potential security risk. You have to analyze and assess the situation carefully before doing that.

The computer's security status is displayed on Sophos SafeGuard Client Status dialog on the endpoint.

Prerequisites

■

Sophos Central Endpoint Protection 1.0.3 or higher has to be installed on the endpoints.

Note: Under Programs and Features, check if Sophos System Protection is present.

■

A policy of type General Settings with activated Remove keys on compromised machines option has to be assigned.

134

administrator help

5.1.4.1 Creating policies for removing keys on compromised machines

To protect data when malicious activity is detected on endpoints:

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

The General Settings tab is displayed.

2. Go to the File encryption section.

3. From the Remove keys on compromised machines drop-down list, select Yes.

Now keys will be removed on the endpoints if malicious activity is detected. A message will be logged.

Note: Malicious behavior will always be logged to the SafeGuard Enterprise database, regardless of the settings for the Remove keys on compromised machines option.

4. When you leave the General Settings tab, the system prompts you to save your changes.

5. Click Yes.

6. Go to Users and Computers and assign the new policy to your user groups.

5.1.5 Share SafeGuard Enterprise key ring with mobile devices managed by

Sophos Mobile Control

Encryption keys in the SafeGuard Enterprise key ring can be made available in the Sophos Secure

Workspace app. Users of the app can then use the keys to decrypt and view documents, or to encrypt documents.

Key rings are synchronized between SafeGuard Enterprise and Sophos Mobile Control. No keys are stored on the Sophos Mobile Control server. Only the Sophos Secure Workspace app can decrypt the keys.

Requirements

These requirements must be met for key ring synchronization:

■

You have set up the integration in the SafeGuard Enterprise Management Center.

■

■

You use Sophos Mobile Control 6.1.

You have configured external user management for the Sophos Mobile Control 6.1 Self Service

Portal as described in the Sophos Mobile Control documentation, using the same Active

Directory user database that is configured in SafeGuard Enterprise.

■

■

■

Sophos Secure Workspace is managed by Sophos Mobile Control.

You have set up the integration in Sophos Mobile Control.

In order to have the key ring available in Sophos Mobile Control, users have to log on at least once to SafeGuard Enterprise.

135

SafeGuard Enterprise

Features on mobile devices

Key ring synchronization includes these features:

■

The keys from a user's SafeGuard Enterprise key ring are available in the Sophos Secure

Workspace key ring (SSW key ring).

■

■

■

Users can continue to use local keys that were available in their SSW key ring before you set up key ring synchronization.

After you set up key ring synchronization, users cannot create new local keys.

For security reasons, the keys from the SafeGuard Enterprise key ring are removed from a device when the Sophos container is locked.

5.1.5.1 Set up key ring synchronization

When you set up key ring synchronization, SafeGuard Enterprise users can use their key ring in the Sophos Secure Workspace app.

To set up a connection between Sophos Mobile Control and Sophos SafeGuard Enterprise:

Note: You are currently making user key rings available to mobile devices. If these mobiles comply with Sophos Mobile Control (SMC) rules, they can access encrypted files. You should work with the SMC administrator to set compliance rules that will prevent any unauthorized access.

1. In the Sophos Mobile Control console, download the certificate file of the Sophos Mobile Control server.

In the Sophos Mobile Control console, on the menu sidebar, under SETTINGS, click Setup >

System setup, and then click the SGN tab.

2. In the SafeGuard Management Center, on the Tools menu, click Configuration Package

Tool.

3. Select Servers.

4. Click Add.

The Server Registration dialog appears.

5. Click the Browse button and browse for the Sophos Mobile Control server certificate you downloaded.

Important: Do not change the name in the Server name: field.

6. Click OK.

The Sophos Mobile Control server is displayed on the Server tab of the Configuration Package

Tool.

136

administrator help

7. Optionally, select the Recovery via mobile check box.

This option will send the BitLocker and FileVault 2 recovery keys to the Sophos Mobile Control

Server. Users of Sophos Secure Workspace managed by Sophos Mobile Control can then display these keys on their mobile for recovery purposes, see

Synchronize full disk encryption keys with mobile devices

(page 225).

Note: Sophos Secure Workspace supports recovery via mobile from version 6.2.

Only compliant mobile devices will be able to receive recovery key information, so for maximum security, make sure you review these compliancy settings with your SMC administrator.

8. Select Managed client packages.

9. Click Add Configuration Package.

10. Enter a name of your choice for the configuration package.

11. In the Primary Server column, select the Sophos Mobile Control server from the drop-down list. A Secondary Server is not necessary.

12. In the Transport Encryption column, select SSL.

13. Specify an output path for the configuration package (MSI).

14. Click Create Configuration Package.

If you have selected SSL encryption as the Transport Encryption mode, the server connection is validated. If the connection fails, a warning message is displayed.

The configuration package (MSI) has now been created in the specified directory. You now need to upload the configuration package to Sophos Mobile Control.

5.1.6 Configuring File Encryption settings in General Settings policies

In addition to the encryption rules defined in File Encryption policies of Encryption type

Application-based, you can configure the following File Encryption settings in policies of the type General Settings:

■

■

Trusted Applications (usually antivirus software)

Ignored Devices

5.1.6.1 Configure trusted applications for Application-based File Encryption

You can define applications as trusted to grant them access to encrypted files. This is for example necessary to enable antivirus software to scan encrypted files.

Note: Child processes will not be trusted.

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

2. Under File Encryption, click the drop-down button of the Trusted Applications field.

137

SafeGuard Enterprise

3. In the editor list box, enter the applications to be defined as trusted.

■

■

You can define multiple trusted applications in one policy. Each line in the editor list box defines one application.

Application names must end with .exe.

■

■

Application names must be specified as fully qualified paths including drive/directory information, for example c:\dir\example.exe

. Entering the file name only (for example example.exe

) is not sufficient. For better usability, the single line view of the application list only shows the file names separated by semicolons.

OS X: entering the application bundle only (for example

/Applications/Scanner.app

) is not sufficient. The application has to be specified as

/Applications/Scanner.app/Contents/MacOS/Scanner

.

■

Application names can contain the same placeholder names for Windows shell folders and environment variables as encryption rules in File Encryption policies. For a description of

all available placeholders, see Placeholders for paths in location-based File Encryption rules (page 154).

4. Save your changes.

Note: The Trusted Applications policy settings are machine settings. The policy must therefore be assigned to machines, not to users. Otherwise the settings do not become active.

5.1.6.2 Configuring ignored devices

You can define devices as ignored to exclude them from the file encryption process. You can only exclude entire devices.

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

2. Under File Encryption, click the drop-down button of the Ignored Devices field.

3. In the editor list box: a) Select Network if you don't want to encrypt any data on the network.

b) Enter the required device names to exclude specific devices from encryption. This may be useful when you need to exclude systems from third party suppliers.

Note: You can display the names of the devices currently used in the system by using third party tools (for example OSR's Device Tree). SafeGuard Enterprise logs all devices it connects to and you can display a list of attached and ignored devices by using registry keys. For further information, see

Displaying ignored and attached devices on Windows

(page 138).

You can exclude individual (network) disk drives from encryption by creating a File Encryption rule in a File Encryption policy and set the encryption Mode to Ignore. You can apply this setting only to Windows administered drives and not to Mac OS X volumes.

5.1.6.2.1 Displaying ignored and attached devices on Windows

To help you when defining ignored devices, you can use registry keys to show which devices are being considered for encryption (attached devices) and which devices are currently being ignored.

The list of ignored devices shows only devices that are actually available on the computer and

138

administrator help are being ignored. If a device is set to be ignored in a policy and the device is not available on the computer, the device is not listed.

Use the following registry keys to display attached and ignored devices:

■

HKLM\System\CurrentControlSet\Control\Utimaco\SGLCENC\Log\AttachedDevices

■

HKLM\System\CurrentControlSet\Control\Utimaco\SGLCENC\Log\IgnoredDevices

5.1.7 Application-based File Encryption policies in the RSOP

Since Synchronized Encryption policies are not merged, always the content of the policy currently in force for a user or computer is displayed on the File Encryption sub-tab of the RSOP tab under

Users and Computers.

5.2 Manage full disk encryption

For the fastest, easiest and most reliable full disk encryption, SafeGuard Enterprise takes advantage of the technology built into the operating system. Seamlessly manage keys and recovery functions on BitLocker- and FileVault 2-encrypted drives from the SafeGuard Management Center.

5.2.1 BitLocker Drive Encryption

BitLocker Drive Encryption is a full disk encryption feature with pre-boot authentication included with Microsoft's Windows operating systems. It is designed to protect data by providing encryption for boot and data volumes. For Windows 8 and later, BitLocker Drive Encryption must be used for full disk encryption instead of SafeGuard Full Disk Encryption.

SafeGuard Enterprise can manage BitLocker encryption on a computer. BitLocker encryption can be activated and the management of drives already encrypted with BitLocker can be taken over.

During installation on the endpoint and the first reboot, SafeGuard Enterprise determines whether the hardware meets the requirements for BitLocker with SafeGuard Challenge/Response. If not,

SafeGuard Enterprise BitLocker management is run without Challenge/Response. In this case the BitLocker recovery key can be retrieved using the SafeGuard Management Center.

5.2.1.1 Authentication with BitLocker Drive Encryption

BitLocker Drive Encryption offers a range of authentication options, for boot volumes as well as for non-boot volumes.

The security officer can set the various logon modes in a policy in the SafeGuard Management

Center and distribute it to the BitLocker endpoints.

The following logon modes exist for SafeGuard Enterprise BitLocker users:

■

TPM: The key for logon is stored on the TPM (Trusted Platform Module) chip.

■

TPM + PIN: The key for logon is stored on the TPM chip and a PIN is also required for logon.

■

Startup Key: The key for logon is stored on a USB memory stick.

139

SafeGuard Enterprise

■

TPM + Startup Key: The key for logon is stored on the TPM chip and on a USB memory stick.

Both are needed for logon.

■

Password: The user will be required to enter a password.

■

Startup Key: The key for logon is stored on a USB memory stick.

■

■

Password or Startup Key: USB memory sticks will be used only if passwords are not supported on the client operating system.

Auto-Unlock: If the boot volume is encrypted, an external key is created and stored on the boot volume. The non-boot volume(s) will then be encrypted automatically. They will be unlocked automatically using the auto-unlock functionality provided by BitLocker.

For more information on setting logon modes in a policy, please see

Authentication (page 353).

5.2.1.1.1 Trusted Platform Module (TPM)

TPM is a smartcard-like module on the motherboard performing cryptographic functions and digital signature operations. It can create, store and manage user keys. It is protected against attacks.

5.2.1.1.2 PIN and passwords

Requirements for BitLocker PINs and passwords are defined by Windows Group Policies, not by

SafeGuard Enterprise settings.

Note: Passwords are only supported with Windows 8 or higher.

The relevant settings for passwords can be found in the Local Group Policy Editor (gpedit.msc):

Local Computer Policy > Computer Configuration > Administrative Templates > Windows

Components > BitLocker Drive Encryption > Operating System Drives > Configure use of

passwords for operating system drives and

Local Computer Policy > Computer Configuration > Administrative Templates > Windows

Components > BitLocker Drive Encryption > Fixed Data Drives > Configure use of passwords

for fixed data drives.

The settings can also be applied via Active Directory.

PINs usually consist of numbers only, but it is possible to allow the use of all keyboard characters

(numbers, letters as well as special characters/symbols). The setting to allow these enhanced

PINs can be found in the Local Group Policy Editor (gpedit.msc) under Local Computer Policy

> Computer Configuration > Administrative Templates > Windows Components > BitLocker

Drive Encryption > Operating System Drives:

If "Allow enhanced PINs for startup" is set to "enabled", enhanced PINs are allowed.

If "Allow enhanced PINs for startup" is set to "not configured", SafeGuard Enterprise will allow enhanced PINs.

If "Allow enhanced PINs for startup" is set to "disabled", enhanced PINs are not allowed.

Note: BitLocker supports the EN-US keyboard layout only. Therefore, users might have problems when entering enhanced PINs or complex passwords. Unless they changed their keyboard layout to EN-US before they specified their new BitLocker PIN or password, users may need to press a different key to what is displayed on their keyboard in order to enter the character they want.

Therefore, before encrypting the boot volume, a reboot is performed to ensure that the user can enter the PIN or password correctly at boot time.

140

administrator help

5.2.1.2 Best practice: Policy settings and user experience

The security officer configures encryption policies for the drives to be encrypted as well as an authentication policy. The TPM should be used whenever possible, but even without a TPM the boot volume should be encrypted. User interaction should be kept to a minimum.

According to these requirements, the security officer chooses the following authentication settings

(these are also the default settings):

■

■

BitLocker Logon Mode for Boot Volumes: TPM + PIN

BitLocker Fallback Logon Mode for Boot Volumes: Password or Startup Key

■

■

BitLocker Logon Mode for Non-Boot Volumes: Auto-Unlock

BitLocker Fallback Logon Mode for Non-Boot Volumes: Password or Startup Key

The security officer creates a device protection policy with the target Internal Storage and sets the encryption mode to Volume based. Afterwards both policies are applied to the endpoints to be encrypted.

For SafeGuard Enterprise BitLocker users the following scenarios exist:

Case 1: A user logs on to an endpoint with a TPM.

1. The user is asked to enter a PIN for the boot volume (for example drive C: ).

2. The user enters the PIN and clicks Restart and Encrypt.

3. The system tests the hardware and checks whether the user can enter the PIN correctly. It reboots and asks the user to enter the PIN.

■

■

■

If the user enters the PIN correctly, the endpoint starts.

If the user does not enter the PIN correctly (for example because of a wrong keyboard layout) the user can press the Esc key in the BitLocker pre-boot environment to cancel the test and the endpoint starts.

If there is any problem with the hardware (for example if the TPM is not working), the test aborts and the endpoint starts.

4. The user logs on again.

5. If the hardware test was passed successfully (the user could enter the PIN correctly and there was no problem with the TPM), the encryption of the boot volume starts. Otherwise (if the test failed), an error is shown and the volume is not encrypted. If the test failed because the user pressed Esc in the pre-boot environment, the user is asked to enter a PIN again and to do a restart (as in step 2; steps 3, 4, 5 will be repeated).

6. The encryption of the boot volume starts.

7. The encryption of the data volumes starts as well, without requiring any user interaction.

Case 2: A user logs on to a Windows 8 endpoint without a TPM.

1. The user is asked to enter a password for the boot volume.

2. The user enters the password and clicks Restart and Encrypt.

3. The system reboots, tests the hardware and the user logs on again as in the case above

(exactly as in steps 3 to 6 of case 1, but the references to the TPM are not relevant, and a password is required rather than a PIN).

4. The encryption of the boot volume starts.

5. The encryption of the data volumes starts as well, without requiring any user interaction.

141

SafeGuard Enterprise

Case 3: A user logs on to a Windows 7 endpoint without a TPM.

1. The user is asked to save the encryption key for the boot volume to a USB memory stick.

2. The user attaches a USB memory stick and presses Save and Restart.

3. The system reboots, performs the hardware test and the user logs on again. (Same procedure as in the previous cases, but the user has to provide the USB memory stick at boot time. An additional hardware error could be that the USB memory stick cannot be read from the BitLocker pre-boot environment.)

4. The encryption of the boot volume starts.

5. The encryption of the data volumes starts as well, without requiring any user interaction.

Case 4: The security officer changes the policy setting BitLocker Fallback Logon Mode for

Boot Volumes to Password. A user logs on to a Windows 7 endpoint without a TPM.

1. Since the endpoint has no TPM and Windows 7 does not allow passwords for boot volumes, the boot volume will not be encrypted.

2. For each non-boot volume, the user is asked to store the external key on a USB memory stick.

Encryption of the respective volume starts when the user clicks Save.

3. When the user reboots the endpoint, the USB key has to be plugged in to be able to unlock the non-boot volumes.

5.2.1.3 Prerequisites for managing BitLocker on endpoints

■

To be able to use logon methods TPM + PIN, TPM + Startup Key, Startup Key, or Password, the Group Policy Require additional authentication at startup either in Active Directory or on computers locally must be enabled. In the Local Group Policy Editor (gpedit.msc), the Group

Policy can be found here:

Local Computer Policy\Computer Configuration\Administrative Templates\Windows

Components\BitLocker Drive Encryption\Operating System Drive.

To use Startup Key, you must activate Allow BitLocker without a compatible TPM in the

Group Policy.

■

To use TPM + PIN on tablets, the Group Policy Enable use of BitLocker authentication

requiring preboot keyboard input on slates must be activated.

Note: These Group Policies are enabled automatically at installation on the endpoint. Make sure that the settings are not overwritten by different Group Policies.

■

A BitLocker device protection policy which triggers the configuration of a TPM-based authentication mechanism (for example TPM, TPM + PIN, TPM + Startup Key) will automatically initiate TPM activation. The user is informed that the TPM needs to be activated and is informed if the system needs to be rebooted or shut down, depending on the TPM in use.

Note: If SafeGuard BitLocker management is installed on an endpoint Not prepared may be

displayed as the encryption state of a drive (see Drives tab (page 248)). This indicates that the

drive currently cannot be encrypted with BitLocker since necessary preparations have not been done yet. This only applies to managed endpoints since unmanaged endpoints cannot report inventory data.

With the

SGNState

command line tool (administrative rights necessary), you can check whether the endpoint is prepared appropriately for BitLocker encryption. In some cases, the Windows

BitLocker Drive Preparation Tool must be executed. For more information, see Sophos knowledgebase article 120819 .

142

administrator help

5.2.1.3.1 SafeGuard Challenge/Response for BitLocker

In order to use SafeGuard Enterprise BitLocker Challenge/Response the following requirements must be met:

■

64-bit Windows

■

UEFI version 2.3.1 or newer

■

Microsoft UEFI certificate is available or Secure Boot is disabled

■

NVRAM boot entries accessible from Windows

■

Windows installed in GPT mode

■

The hardware is not listed in the POACFG.xml file.

Sophos delivers a default POACFG.xml file embedded in the setup. It is recommended to download the newest file and provide it to the installer.

During installation on the endpoint and the first reboot, SafeGuard Enterprise determines whether the hardware meets the requirements for BitLocker with SafeGuard Challenge/Response. If not,

SafeGuard Enterprise BitLocker management is run without Challenge/Response. In this case, the BitLocker recovery key can be retrieved using the SafeGuard Management Center.

5.2.1.4 Manage BitLocker Drive Encryption with SafeGuard Enterprise

SafeGuard Enterprise’s central and fully transparent management of BitLocker can be used in heterogeneous IT environments. SafeGuard Enterprise enhances BitLocker capabilities significantly. Security policies for BitLocker can be centrally rolled out thanks to SafeGuard

Enterprise. Even critical processes such as key management and key recovery are available when BitLocker is managed with SafeGuard Enterprise.

With SafeGuard Enterprise, you can manage BitLocker Drive Encryption from the SafeGuard

Management Center. As a security officer, you can set encryption and authentication policies and distribute them to the BitLocker endpoints.

Once a BitLocker endpoint is registered in the SafeGuard Management Center, information on user, computer, logon mode, and encryption status is displayed. Events are logged for BitLocker endpoints as well.

In terms of management functionality, endpoints encrypted with BitLocker are equal to endpoints encrypted with SafeGuard Full Disk Encryption. You can find out the type of a computer in the

Inventory section in Users and Computers. The column Encryption Type tells you if a computer is a BitLocker endpoint.

Note: During installation of the SafeGuard Enterprise Client on Windows 7, the BitLocker feature needs to be explicitly selected to enable BitLocker management.

For information on BitLocker To Go and SafeGuard Enterprise, see BitLocker To Go (page 147).

5.2.1.5 Encrypting with BitLocker managed by SafeGuard Enterprise

With BitLocker Drive Encryption support in SafeGuard Enterprise you can encrypt boot volumes as well as non-boot volumes with BitLocker encryption and keys. Additionally, any data, for

143

SafeGuard Enterprise example removable media, can be encrypted with SafeGuard Enterprise file-based encryption and SafeGuard Enterprise keys. This is not a BitLocker feature but provided by SafeGuard

Enterprise.

5.2.1.5.1 BitLocker encryption keys

When encrypting the boot volume or other volumes with BitLocker through SafeGuard Enterprise, the encryption keys are always generated by BitLocker. A key is generated by BitLocker for each volume and cannot be reused for any other purpose.

When using BitLocker with SafeGuard Enterprise, a recovery key is stored in the SafeGuard

Enterprise Database. This allows for setting up a helpdesk and recovery mechanism similar to the SafeGuard Enterprise Challenge/Response.

However, it is not possible to select keys globally or reuse them as with SafeGuard Enterprise native clients. The keys are not displayed in the SafeGuard Management Center either.

Note: BitLocker also allows you to back up recovery keys to Active Directory. If this is enabled in the group policy objects (GPOs), this is done automatically when a volume is encrypted with

BitLocker. If a volume is already encrypted, the administrator can back up the BitLocker recovery keys manually with Windows Manage-BDE tool (see "manage-bde -protectors -adbackup -?").

5.2.1.5.2 BitLocker algorithms in SafeGuard Enterprise

BitLocker supports the following Advanced Encryption Standard (AES) algorithms:

■

AES-128

■

AES-256

AES-128 with diffuser and AES-256 with diffuser are no longer supported. Drives already encrypted using an algorithm with diffuser can be managed by SafeGuard Enterprise.

5.2.1.5.3 Encryption policies for BitLocker Drive Encryption

The security officer can create a policy for (initial) encryption in the SafeGuard Management

Center and distribute it to the BitLocker endpoints where it is executed. It triggers the BitLocker encryption of the drives specified in the policy.

As the BitLocker clients are managed transparently in the SafeGuard Management Center, the security officer does not have to specify any special BitLocker settings for encryption. SafeGuard

Enterprise knows the client status and selects the BitLocker encryption accordingly. When a

BitLocker client is installed with SafeGuard Enterprise and volume encryption is activated, the volumes are encrypted by BitLocker Drive Encryption.

A BitLocker endpoint processes policies of type Device Protection and Authentication.

The following settings are evaluated on the endpoint:

■

Settings in a policy of type Device Protection:

■

Target: Local Storage Devices | Internal Storage | Boot Volumes | Non-boot Volumes

| Drive Letters A: - Z:

■

■

■

Media Encryption Mode: Volume based | No encryption

Algorithm to be used for encryption: AES128 | AES256

Fast initial encryption: Yes | No

144

administrator help

For details see

Device Protection (page 369).

■

Settings in a policy of type Authentication:

■

■

■

■

BitLocker Logon Mode for Boot Volumes: TPM | TPM + PIN | TPM + Startup Key |

Startup Key |

BitLocker Fallback Logon Mode for Boot Volumes: Password |Startup Key | Password

or Startup Key | Error

BitLocker Logon Mode for Non-Boot Volumes: Auto-Unlock | Password | Startup Key

BitLocker Fallback Logon Mode for Non-Boot Volumes: Password | Password or

Startup Key| Startup Key

For details see

Authentication

(page 353).

All other settings are ignored by the BitLocker endpoint.

5.2.1.5.4 Encryption on a BitLocker-protected computer

Before the encryption starts, the encryption keys are generated by BitLocker. Depending on the system used the behavior differs slightly.

Endpoints with TPM

If the security officer defines a logon mode for BitLocker that involves the TPM (TPM, TPM + PIN, or TPM + Startup Key), TPM activation is automatically initiated.

The TPM (Trusted Platform Module) is a hardware device BitLocker uses to store its encryption keys. The keys are not stored on the computer’s hard disk. The TPM must be accessible by the basic input/output system (BIOS) during startup. When the user starts the computer, BitLocker will get these keys from the TPM automatically.

Endpoints without TPM

If an endpoint is not equipped with a TPM, either a BitLocker startup key or, if the endpoint is running Windows 8 or later, a password can be used as the logon mode.

A BitLocker startup key can be created using a USB memory stick to store the encryption keys.

The user will have to insert the memory stick each time when starting the computer.

When SafeGuard Enterprise activates BitLocker, users are prompted to save the BitLocker startup key. A dialog appears displaying the valid target drives in which to store the startup key.

For boot volumes, it is essential that the startup key is available when the endpoint is started.

Therefore, the startup key can only be stored on removable media.

For data volumes, the BitLocker startup key can be stored on an encrypted boot volume. This is done automatically if Auto-Unlock is defined in the policy.

BitLocker recovery keys

For BitLocker recovery, SafeGuard Enterprise offers a Challenge/Response procedure that allows information to be exchanged confidentially and allows the BitLocker recovery key to be retrieved

from the helpdesk, see Response for BitLocker encrypted SafeGuard Enterprise Clients - UEFI

145

SafeGuard Enterprise

endpoints (page 147) and

Recovery key for BitLocker encrypted SafeGuard Enterprise Clients -

BIOS endpoints (page 148).

To enable recovery with Challenge/Response or retrieval of the recovery key, the required data has to be available to the helpdesk. The data required for recovery is saved in specific key recovery files.

Note: If SafeGuard BitLocker management without Challenge/Response in standalone mode is used, the recovery key is not changed after a recovery procedure.

Note: If a BitLocker-encrypted hard disk in a computer is replaced by a new BitLocker-encrypted hard disk, and the new hard disk is assigned the same drive letter as the previous hard disk,

SafeGuard Enterprise only saves the recovery key of the new hard disk.

Managing drives already encrypted with BitLocker

If there are any drives already encrypted with BitLocker on your computer when SafeGuard

Enterprise is installed, SafeGuard Enterprise takes over the management of these drives.

Encrypted boot drives

■

■

Depending on the SafeGuard Enterprise BitLocker support used, you may be prompted to reboot the computer. It is important that you reboot the computer as early as possible.

If a SafeGuard Enterprise encryption policy applies for the encrypted drive:

■

■

SafeGuard Enterprise BitLocker Challenge/Response is installed: Management is taken over and SafeGuard Enterprise Challenge/Response is possible.

SafeGuard Enterprise BitLocker is installed: Management is taken over and recovery is possible.

■

If no SafeGuard Enterprise encryption policy applies for the encrypted drive:

■

■

SafeGuard Enterprise BitLocker Challenge/Response is installed: Management is not taken over and SafeGuard Enterprise Challenge/Response is not possible.

SafeGuard Enterprise BitLocker is installed: recovery is possible.

Encrypted data drives

■

If a SafeGuard Enterprise encryption policy applies for the encrypted drive:

Management is taken over and recovery is possible.

■

If no SafeGuard Enterprise encryption policy applies for the encrypted drive:

SafeGuard Enterprise recovery is possible.

5.2.1.5.5 Decryption with BitLocker

Computers encrypted with BitLocker cannot be decrypted automatically. Decryption can be carried out using either the BitLocker Drive Encryption item in the Control Panel or the Microsoft command-line tool "Manage-bde".

To allow users to decrypt BitLocker encrypted drives manually, a policy without an encryption rule for a BitLocker encrypted drive has to be applied on the endpoint. The user can then trigger

146

administrator help decryption by deactivating BitLocker for the desired drive in the BitLocker Drive Encryption

Control Panel item or via "Manage-bde".

5.2.1.6 BitLocker To Go

BitLocker To Go can be used to encrypt volumes on removable media when the client components for SafeGuard Enterprise BitLocker support are installed. However, BitLocker To Go cannot be managed by SafeGuard Enterprise.

To disable BitLocker To Go, see Deactivate BitLocker To Go encryption (page 147).

BitLocker To Go is not compatible with SafeGuard Full Disk Encryption (volume-based full disk encryption). When you install SafeGuard Full Disk Encryption, BitLocker To Go is disabled.

Volumes and removable media that are already encrypted with BitLocker To Go remain accessible.

5.2.1.6.1 Deactivate BitLocker To Go encryption

1. In the Windows Group Policy Editor, select Local Computer Policy > Computer Configuration

> Administrative Templates > Windows Components > BitLocker Drive Encryption>

Removable Data Drives.

2. Right-click Control use of BitLocker on removable drives and select Edit.

3. Select Enabled.

4. Under Options, deselect Allow users to apply BitLocker protection on removable data

drives.

5. Under Options, select Allow users to suspend and decrypt BitLocker protection on

removable data drives.

6. Click OK.

BitLocker To Go encryption is deactivated on the endpoints. Users cannot encrypt new volumes with BitLocker To Go anymore. Volumes and removable media that are already encrypted with

BitLocker To Go remain accessible.

5.2.1.7 Log events for BitLocker

Events reported by the BitLocker Client are logged, just as for any other SafeGuard Enterprise

Client. It is not especially mentioned that the event refers to a BitLocker Client. The events reported are the same as for any SafeGuard Enterprise Client.

5.2.1.8 Recovery for BitLocker

Depending on the system used, SafeGuard Enterprise offers a Challenge/Response procedure for recovery or the possibility of obtaining the recovery key from the helpdesk. For the requirements

for SafeGuard Enterprise Challenge/Response see Prerequisites for managing BitLocker on endpoints (page 142). For information on recovery on the client side, see the

SafeGuard Enterprise user help .

5.2.1.8.1 Response for BitLocker encrypted SafeGuard Enterprise Clients - UEFI endpoints

For UEFI endpoints that meet certain requirements, SafeGuard Enterprise offers

Challenge/Response for recovery. On UEFI endpoints that do not fulfill the requirements SafeGuard

BitLocker management without Challenge/Response is installed automatically. To recover these

147

SafeGuard Enterprise endpoints see

Recovery key for BitLocker encrypted SafeGuard Enterprise Clients - BIOS endpoints

(page 148).

1. In the SafeGuard Management Center, select Tools > Recovery to open the Recovery

Wizard.

2. On the Recovery type page, select SafeGuard Enterprise Client (managed).

3. Under Domain, select the required domain from the list.

4. Under Computer enter or select the required computer name. There are several ways to do so:

■

To select a name, click [...]. Then click Find now. A list of computers is displayed. Select the required computer and click OK. The computer name is displayed on the Recovery

type page.

■

Type the short name of the computer directly into the field. When you click Next, the database is searched for this name. If it is found, the distinguished computer name is displayed.

■

Enter the computer name directly in the distinguished name format, for example:

CN=Desktop1,OU=Development,OU=Headquarter,DC=Sophos,DC=edu

5. Click Next.

6. Select the volume to be accessed from the list and click Next.

7. Click Next.

A page is displayed where you can enter the challenge code.

8. Enter the challenge code the user has passed on to you and click Next.

9. A response code is generated. Provide the response code to the user. A spelling aid is provided.

You can also copy the response code to the clipboard.

The user can enter the response code and get access to the endpoint.

5.2.1.8.2 Recovery key for BitLocker encrypted SafeGuard Enterprise Clients - BIOS endpoints

For BitLocker encrypted BIOS computers a volume that cannot be accessed any more may be recovered.

1. In the SafeGuard Management Center, select Tools > Recovery to open the Recovery

Wizard.

2. On the Recovery type page, select SafeGuard Enterprise Client (managed).

3. Under Domain, select the required domain from the list.

4. Under Computer enter or select the required computer name. There are several ways to do so:

■

To select a name, click [...]. Then click Find Now. A list of computers is displayed. Select the required computer and click OK. The computer name is displayed in the Recovery

type window under Domain.

■

Type the short name of the computer directly into the field. When you click Next, the database is searched for this name. If it is found, the distinguished computer name is displayed.

148

administrator help

■

Enter the computer name directly in distinguished name format, for example:

CN=Desktop1,OU=Development,OU=Headquarter,DC=Utimaco,DC=edu

5. Click Next.

6. Select the volume to be accessed from the list and click Next.

7. The Recovery Wizard displays the corresponding 48-digit recovery key.

8. Provide this key to the user.

The user can enter the key to recover the BitLocker encrypted volume on the endpoint.

5.2.2 FileVault 2 encryption

FileVault 2 is an encryption technology built into OS X that protects an entire volume and can be managed by SafeGuard Enterprise.

5.2.2.1 Manage FileVault 2 full disk encryption with SafeGuard Enterprise

With SafeGuard Enterprise you can manage FileVault 2 full disk encryption from the SafeGuard

Management Center, like a native SafeGuard Enterprise Client.

The SafeGuard Enterprise Client installation does not contain the component for FileVault 2 management. It has to be installed separately. For details see your Sophos SafeGuard Native

Device Encryption for Mac documentation.

SafeGuard Enterprise’s central and fully transparent management of FileVault 2 allows the use in heterogeneous IT environments. Security policies for different platforms can be centrally rolled out.

5.2.2.2 Manage FileVault 2 endpoints with SafeGuard Management Center

In the SafeGuard Management Center, FileVault 2 endpoints can be managed just like any native

SafeGuard Enterprise endpoints. As a security officer you can set encryption policies for the

FileVault 2 endpoints and distribute them.

Once a FileVault 2 endpoint is registered at SafeGuard Enterprise, information on user, computer, logon mode and encryption status is displayed. Events are logged for FileVault 2 clients as well.

Management of the FileVault 2 in SafeGuard Enterprise is transparent, which means that management functions generally work the same way for FileVault 2 and native SafeGuard

Enterprise clients. You can find out on the type of a computer in the Inventory of a container in

Users and Computers. The column POA Type tells you if the respective computer is a FileVault

2 client.

5.2.2.3 Encryption policies for FileVault 2 full disk encryption

The security officer can create a policy for encryption in the SafeGuard Management Center and distribute it to the FileVault 2 endpoints where it is executed.

As the FileVault 2 endpoints are managed transparently in the SafeGuard Management Center, the security officer does not necessarily have to specify any special FileVault 2 settings for encryption. SafeGuard Enterprise knows the client status and selects the FileVault 2 encryption accordingly.

149

SafeGuard Enterprise

A FileVault 2 endpoint only processes policies of type Device Protection with target Boot Volumes and Media encryption mode set to Volume-based or No encryption. All other policy settings are ignored.

■

■

Volume-based activates FileVault 2 on the endpoint.

No encryption allows the user to decrypt the Mac.

5.2.2.4 Recovery key for Mac endpoints

Access to FileVault 2 encrypted SafeGuard Enterprise Clients can be regained with the following procedure:

1. On the Recovery type page, select SafeGuard Enterprise Client (managed).

2. Under Domain, select the required domain from the list.

3. Under Computer enter or select the required computer name. There are several ways to do so:

■

To select a name, click [...]. Then click Find Now. A list of computers is displayed. Select the required computer and click OK. The computer name is displayed in the Recovery

type window under Domain.

■

Type the short name of the computer directly into the field. When you click Next, the database is searched for this name. If it is found, the distinguished computer name is displayed.

■

Enter the computer name directly in distinguished name format, for example:

CN=Desktop1,OU=Development,OU=Headquarter,DC=Utimaco,DC=edu

4. Click Next.

5. The Recovery Wizard displays the corresponding 24-digit recovery key.

6. Provide this key to the user.

The user can enter the recovery key to get logged on to the Mac endpoint and reset the password.

5.3 Location-based File Encryption

The SafeGuard Enterprise module File Encryption offers location-based file encryption on local drives and network locations, mainly for work groups on network shares.

In the SafeGuard Management Center, you define the rules for file-based encryption in File

Encryption policies. In these File Encryption rules, you specify the folders that are to be handled by File Encryption, the encryption mode and the key to be used for encryption. In General Settings policies, you can define how specific applications and file systems are handled on endpoints in the context of File Encryption.You can specify ignored and trusted applications as well as ignored devices. You can also enable persistent encryption for File Encryption.

For encryption, Personal Keys can be used. A Personal Key that is active for a user only applies to this particular user and cannot be shared with or assigned to any other users. You can create

Personal Keys in the SafeGuard Management Center under Users and Computers.

150

administrator help

After a File Encryption policy has been assigned to endpoints, files in the locations covered by the policy are transparently encrypted without user interaction:

■

■

New files in the relevant locations are encrypted automatically.

If users have the key for an encrypted file, they can read and modify the content.

■

■

If users do not have the key for an encrypted file, access is denied.

If a user accesses an encrypted file on an endpoint where File Encryption is not installed, the encrypted content is shown.

Already existing files in the locations covered by the encryption policy are not encrypted automatically. Users have to carry out an initial encryption in the SafeGuard File Encryption

Wizard on the endpoint. For further information, see the SafeGuard Enterprise user help.

Note:

SafeGuard File Encryption is not compatible with Windows built-in EFS encryption and file compression. If EFS is enabled, it has priority over any applicable file encryption rule and files that are created in the relevant folder cannot be encrypted by File Encryption. If compression is enabled, File Encryption has a higher priority and files are encrypted but not compressed. To encrypt the files by File Encryption, EFS encryption or data compression has to be removed beforehand. This can be done manually or by running the SafeGuard Enterprise Initial Encryption

Wizard.

Note:

For details when using Mac endpoints and SafeGuard File Encryption for Mac, see About

SafeGuard File Encryption for Mac

(page 101) and the SafeGuard Enterprise for Mac user help.

5.3.1 Configuring encryption rules in location-based File Encryption policies

You define the rules for file-based encryption on network locations in a policy of the type File

Encryption.

Note: Certain folders (for example c:\Program Files) may prevent the operating system or applications from running when encrypted. When you define encryption rules, make sure that these folders are not encrypted.

1. In the Policies navigation area, create a new policy of the type File Encryption or select an existing one.

The File Encryption tab is displayed.

2. Select Location-based from the Encryption type drop-down list.

The table to specify locations where location-based file encryption is applied on the endpoint computer is displayed.

Note: SafeGuard Enterprise Versions prior to this did not have the Encryption type setting.

If you updated your Management Center, already existing File Encryption policies will be converted to File Encryption policies of type Location-based. For Encryption type No

Encryption see

Policies of type No encryption

(page 132).

151

SafeGuard Enterprise

3. In the Path column, set the path (that is the folder) to be handled by File Encryption:

■

Click the drop-down button and select a folder name placeholder from the list of available placeholders.

Note: By hovering your cursor over the list entries, you can display tooltips telling you how a placeholder is typically presented on an endpoint. You can only enter valid placeholders.

For a description of all available placeholders, see Placeholders for paths in location-based

File Encryption rules (page 154).

Important: Encrypting the whole user profile with the placeholder

<User Profile>

may result in an unstable Windows desktop on the endpoint.

■

■

Click the Browse button to browse the file system and select the required folder.

Alternatively, just enter a path name.

Note: For useful information on configuring paths in File Encryption rules, see

Additional information for configuring paths in location-based File Encryption rules

(page 153).

4. In the Scope column, select

■

■

Only this folder to apply the rule only to the folder indicated by the Path column, or

Include subfolders to also apply the rule to all its subfolders.

5. In the Mode column, define how File Encryption should handle the folder indicated in the Path column:

■

■

■

Select Encrypt to encrypt new files in the folder. The contents of the existing encrypted files are decrypted transparently when a user with the required key accesses them. If the user does not have the required key, access is denied.

If you select Exclude, new files in the folder are not encrypted. You might use this option to exclude a subfolder from encryption if the parent folder is already covered by a rule with the Encrypt option.

If you select Ignore, files in the folder are not handled by File Encryption at all. New files are saved in plaintext. If a user accesses already encrypted files in this folder, the encrypted content is displayed, regardless whether the user has the required key or not.

6. In the Key column, select the key to be used for the Encrypt mode. You can use keys created and applied in Users and Computers:

■

Click the Browse button to open the Find Keys dialog. Click Find now to display a list of all available keys and select the required key.

Note: Machine keys are not shown in the list. They cannot be used by File Encryption as they are only available on a single machine and can therefore not be used to enable groups of users to access the same data.

■

Click the Personal Key button with the key icon, to insert the Personal Key placeholder in the Key column. On the endpoint, this placeholder will be resolved to the active Personal

Key of the logged on SafeGuard Enterprise user. If the relevant users do not have active

Personal Keys yet, they are created automatically. You can create Personal Keys for single

or multiple users in Users and Computers. For further information, see Personal Keys for file-based encryption by File Encryption

(page 277).

7. The System type (Windows, Mac OS X or All systems for Windows and Mac OSX systems) will be assigned automatically.

152

administrator help

8. Add further encryption rules as required and save your changes.

Note: All File Encryption rules that are assigned by policies and activated for users/computers at different nodes in Users and Computers are cumulated. The order of encryption rules within a File Encryption policy is not relevant for their evaluation on the endpoint. Within a

File Encryption policy, you can drag the rules into order to gain a better overview.

5.3.1.1 Additional information for configuring paths in location-based File Encryption rules

When configuring paths in File Encryption rules, consider the following.

■

■

A path can only contain characters that can also be used in file systems. Characters like <, >,

* and $ are not allowed.

You can only enter valid placeholders. For a list of all supported placeholders, see Placeholders for paths in location-based File Encryption rules

(page 154).

Note: Names of environment variables are not checked by the SafeGuard Management

Center. They only need to be present on the endpoint.

■

■

The Path field always indicates a folder. You cannot specify a rule for a single file or use wildcards for folder names, file names or file extensions.

Absolute and relative rules

You can define absolute and relative rules. An absolute rule exactly defines a specific folder, for example

C:\encrypt

. A relative rule does not include UNC server/share information, drive letter information or parent folder information. An example for a path used in a relative rule is

encrypt_sub

. In this case, all files on all drives (including network locations) that reside in a folder

encrypt_sub

(or one of its subfolders) are covered by the rule.

Note: Relative paths are only supported on Windows endpoint computers.

■

Long folder names and 8.3 notation

Always enter the long folder names for File Encryption rules since 8.3 names for long folder names may differ from computer to computer. 8.3 name rules are detected automatically by the endpoint protected by SafeGuard Enterprise when the relevant policies are applied. Whether applications use long folder names or 8.3 names for accessing files - the result should be the same. For relative rules, use the short folder names to make sure that the rule can be enforced regardless of an application that uses long folder names or 8.3 notation.

■

UNC and/or mapped drive letters

Whether you administer rules in UNC notation or based on mapped drive letters depends on your specific requirements:

■

Use UNC notation if your server and share names are not likely to change, but drive letter mappings vary between users.

■

Use mapped drive letters, if drive letters stay the same, but server names may change.

If you use UNC, specify a server name and a share name, for example \\server\share.

File Encryption matches UNC names and mapped drive letters internally. In a rule, a path therefore needs to be defined either as a UNC path or with mapped drive letters.

153

SafeGuard Enterprise

Note: Since users may be able to change their drive letter mappings, we recommend to use

UNC paths in File Encryption rules for security reasons.

■

Offline folders

If the Windows feature Make Available Offline is used, you do not have to create special rules for local (offline) copies of folders. New files in the local copy of a folder that has been made available for offline use are encrypted according to the rule for the original (network) location.

Note: For further information on naming files and paths, see http://msdn.microsoft.com/en-us/library/aa365247.aspx

.

5.3.1.2 Placeholders for paths in location-based File Encryption rules

The following placeholders can be used when specifying paths in encryption rules in File

Encryption policies. You can select these placeholders by clicking the drop-down button of the

Path field.

Note: Always use backslashes as path separator, even when creating File Encryption rules for

Mac OS X. This allows you to apply rules on both operating systems, Windows and Mac OS X.

On Mac OS X client side, backslashes will automatically be transformed to slashes in order to match the requirements of the Mac OS X operating system. Any errors in placeholders are logged.

Invalid File Encryption rules are logged and then discarded on the endpoint.

Example: The Windows path

<User Profile>\Dropbox\personal

is converted on Mac side into

/Users/<Username>/Dropbox/personal

.

Path placeholder Operating System

(All=Windows and

Mac OS X)

Results in the following value on the endpoint

<%environment_variable_name%>

All The value of environment variable. Example:

<%USERNAME%>.

Note: If environment variables contain several locations (for example the PATH environment variable), the paths will not be separated into multiple rules. This causes an error and the encryption rule is invalid.

<Desktop>

<Documents>

All

All

The virtual folder that represents the endpoints desktop.

This is the virtual folder that represents the My

Documents desktop item (equivalent to

CSIDL_MYDOCUMENTS). Typical path:

C:\Documents and Settings\username\My

Documents.

154

administrator help

Path placeholder

<Downloads>

<Music>

<Network Shares>

<Pictures>

<Public>

<Removables>

<User Profile>

<Videos>

<Cookies>

<Favorites>

<Local Application Data>

All

All

Operating System

(All=Windows and

Mac OS X)

Results in the following value on the endpoint

All

All

The folder where downloads are stored by default. A typical path for Windows is

C:\Users\username\Downloads.

The file system directory that serves as a data repository for music files. Typical path:

C:\Documents and Settings\User\My

Documents\My Music.

All

All

All

The file system directory that serves as a data repository for image files. Typical path:

C:\Documents and Settings\username\My

Documents\My Pictures.

The file system directory that serves as a common repository for document files for all users. Typical path:

C:\Users\<username>\Public.

Points to the root folders of all removable media.

The user's profile folder. Typical path:

C:\Users\username.

Note: Encrypting the whole user profile with this placeholder may result in an unstable

Windows desktop on the endpoint.

All

Windows

Windows

Windows

The file system directory that serves as a common repository for video files for all users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Videos.

The file system directory that serves as a common repository for internet cookies. Typical path: C:\Documents and

Settings\username\Cookies.

The file system directory that serves as a common repository for the user's favorite items.

Typical path: \Documents and

Settings\username\Favorites.

The file system directory that serves as a data repository for local (non-roaming) applications.

155

SafeGuard Enterprise

Path placeholder

<Program Data>

<Program Files>

<Public Music>

<Public Pictures>

<Public Videos>

<Roaming>

<System>

<Temporary Burn Folder>

<Temporary Internet Folder>

Operating System

(All=Windows and

Mac OS X)

Results in the following value on the endpoint

Typical path: C:\Documents and

Settings\username\Local Settings\Application

Data.

Windows The file system directory that contains application data for all users. Typical path:

C:\Documents and Settings\All

Users\Application Data.

Windows

Windows

Windows

The Program Files folder. Typical path:

\Program Files. For 64-bit systems, this will be expanded into two rules - one for 32-bit applications and one for 64-bit applications.

The file system directory that serves as a common repository for music files for all users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Music.

The file system directory that serves as a common repository for image files for all users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Pictures

Windows

Windows

Windows

Windows

Windows

The file system directory that serves as a common repository for video files for all users.

Typical path: C:\Documents and Settings\All

Users\Documents\My Videos.

The file system directory that serves as a common repository for application-specific data.

Typical path: C:\Documents and

Settings\username\Application Data.

The Windows System folder. Typical path:

C:\Windows\System32. For 64-bit systems, this will be expanded to two rules - one for 32-bit and one for 64-bit.

The file system directory that is used as a staging area for files waiting to be written on a

CD. Typical Path: C:\Documents and

Settings\username\Local Settings\Application

Data\Microsoft\CD Burning.

The file system directory that serves as a common repository for Temporary Internet

Files. Typical path: C:\Documents and

156

administrator help

Path placeholder

<Windows>

<Root>

Operating System

(All=Windows and

Mac OS X)

Results in the following value on the endpoint

Settings\username\Local Settings\Temporary

Internet Files.

Windows

Mac OS X

The Windows directory or SYSROOT. This corresponds to the environment variables

%windir% or %SYSTEMROOT%. Typical path:

C:\Windows.

The Mac OS X root folder. It is not recommended to specify policies for the root folder, even if it is technically possible.

5.3.2 Configuring location-based File Encryption settings in General Settings policies

In addition to the encryption rules defined in File Encryption policies of Encryption type

Location-based, you can configure the following File Encryption settings in policies of the type

General Settings:

■

■

Trusted Applications

Ignored Applications

■

■

Ignored Devices

Enable persistent encryption

5.3.2.1 Configure trusted and ignored applications for File Encryption

You can define applications as trusted to grant them access to encrypted files. This is for example necessary to enable antivirus software to scan encrypted files.

You can also define applications as ignored to exempt them from transparent file encryption/decryption. For example, if you define a backup program as an ignored application, encrypted data backed up by the program remains encrypted.

Note: Child processes will not be trusted/ignored.

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

2. Under File Encryption, click the drop-down button of the Trusted Applications or Ignored

Applications field.

157

SafeGuard Enterprise

3. In the editor list box, enter the applications to be defined as trusted/ignored.

■

■

You can define multiple trusted/ignored applications in one policy. Each line in the editor list box defines one application.

Application names must end with .exe.

■

■

Application names must be specified as fully qualified paths including drive/directory information, for example "c:\dir\example.exe". Entering the file name only (for example

"example.exe") is not sufficient. For better usability the single line view of the application list only shows the file names separated by semicolons.

Application names can contain the same placeholder names for Windows shell folders and environment variables as encryption rules in File Encryption policies. For a description of

all available placeholders, see Placeholders for paths in location-based File Encryption rules (page 154).

4. Save your changes.

Note: The Trusted Applications and Ignored Applications policy settings are machine settings.

The policy must therefore be assigned to machines, not to users. Otherwise the settings do not become active.

5.3.2.2 Configuring ignored devices

You can define devices as ignored to exclude them from the file encryption process. You can only exclude entire devices.

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

2. Under File Encryption, click the drop-down button of the Ignored Devices field.

3. In the editor list box: a) Select Network if you don't want to encrypt any data on the network.

b) Enter the required device names to exclude specific devices from encryption. This may be useful when you need to exclude systems from third party suppliers.

Note: You can display the names of the devices currently used in the system by using third party tools (for example OSR's Device Tree). SafeGuard Enterprise logs all devices it connects to and you can display a list of attached and ignored devices by using registry keys. For further information, see

Displaying ignored and attached devices on Windows

(page 138).

You can exclude individual (network) disk drives from encryption by creating a File Encryption rule in a File Encryption policy and set the encryption Mode to Ignore. You can apply this setting only to Windows administered drives and not to Mac OS X volumes.

5.3.2.2.1 Displaying ignored and attached devices on Windows

To help you when defining ignored devices, you can use registry keys to show which devices are being considered for encryption (attached devices) and which devices are currently being ignored.

The list of ignored devices shows only devices that are actually available on the computer and are being ignored. If a device is set to be ignored in a policy and the device is not available on the computer, the device is not listed.

158

administrator help

Use the following registry keys to display attached and ignored devices:

■

HKLM\System\CurrentControlSet\Control\Utimaco\SGLCENC\Log\AttachedDevices

■

HKLM\System\CurrentControlSet\Control\Utimaco\SGLCENC\Log\IgnoredDevices

5.3.2.3 Configure persistent encryption for File Encryption

The content of files encrypted by File Encryption are decrypted on-the-fly, if the user owns the required key. When the content is saved as a new file in a location that is not covered by an encryption rule, the resulting file will not be encrypted.

With persistent encryption, copies of encrypted files will be encrypted, even when they are saved in a location not covered by an encryption rule.

You can configure persistent encryption in policies of the type General Settings. The policy setting Enable persistent encryption is activated by default.

Note: If files are copied or moved to an ignored device or to a folder to which a policy with encryption mode Ignore applies, the Enable persistent encryption setting has no effect.

5.3.3 Multiple location-based File Encryption policies

All File Encryption rules that are assigned by policies and activated for users/computers at different nodes in Users and Computers in the SafeGuard Management Center are cumulated.

You can assign a general File Encryption policy at the root node that includes rules relevant for all users, and more specific policies at specific subnodes. All rules in all policies assigned to users/computers are cumulated and enforced on the endpoint.

5.3.3.1 Location-based File Encryption policies in the RSOP

If several File Encryption policies apply to a user/computer, the RSOP (Resulting Set of Policies) tab in Users and Computers shows the sum of all File Encryption rules of all File Encryption policies. The rules are sorted in the order of encryption rule evaluation on the endpoint computer

(see

Evaluation of location-based File Encryption rules on endpoints (page 159)).

The Policy Name column shows where the individual rules originate from.

For duplicate rules, the second (and third etc.) rule is marked by an icon. This icon also provides a tooltip informing you that the rule will be discarded on the endpoint as it is a duplicate of a rule with a higher priority.

5.3.4 Evaluation of location-based File Encryption rules on endpoints

On endpoints, File Encryption rules are sorted in an order that causes the more specifically defined locations to be evaluated first:

■

■

If two rules with the same Path and Scope settings originate from policies that are assigned to different nodes, the rule from the policy nearest to the user object in Users and Computers is applied.

If two rules with the same Path and Scope settings originate from policies that are assigned to the same node, the rule from the policy with the highest priority is applied.

159

SafeGuard Enterprise

■

■

■

■

■

■

■

Absolute rules are evaluated before relative rules, for example

c:\encrypt

before

encrypt

.

For further information, see

Additional information for configuring paths in location-based File

Encryption rules

(page 153).

Rules with a path containing more subdirectories are evaluated before rules with a path containing less subdirectories.

Rules defined with UNC are evaluated before rules with drive letter information.

Rules with Only this folder activated are evaluated before rules without this option.

Rules using the Ignore mode are evaluated before rules using Encrypt or Exclude mode.

Rules using the Exclude mode are evaluated before rules using Encrypt mode.

If two rules are equal regarding the criteria listed, the one that comes first in alphabetical order is evaluated before the other rule.

5.3.5 Conflicting location-based File Encryption Rules

As multiple File Encryption policies can be assigned to a user/computer, conflicts may occur. Two rules are considered as conflicting, if they have the same values for path, mode and subdirectory, but the key to be used is different. In this case the rule from the File Encryption policy with the higher priority applies. The other rule is discarded.

5.3.6 Location-based File Encryption and SafeGuard Data Exchange

SafeGuard Data Exchange is used to encrypt data stored on removable media connected to a computer and to exchange this data with other users. For SafeGuard Data Exchange file-based encryption is used.

If both SafeGuard Data Exchange and location-based File Encryption are installed on an endpoint, it may occur that a SafeGuard Data Exchange encryption policy is defined for a drive on the computer and location-based File Encryption policies are defined for folders on the same drive.

If this is the case, the SafeGuard Data Exchange encryption policy overrules the File Encryption policies. New files are encrypted according to the SafeGuard Date Exchange encryption policy.

For further information on SafeGuard Data Exchange, see

SafeGuard Data Exchange (page 166).

5.4 Cloud Storage

The SafeGuard Enterprise module Cloud Storage offers file-based encryption of data stored in the cloud.

It does not change the way users work with data stored in the cloud. Users are still using the same vendor specific synchronization applications to send data to or receive data from the cloud.

The purpose of Cloud Storage is to make sure that the local copies of data stored in the cloud is encrypted transparently and will therefore always be stored in the cloud in encrypted form.

In the SafeGuard Management Center, you create Cloud Storage Definitions (CSDs) and use them as targets in Device Protection policies. Predefined Cloud Storage Definitions are available for several cloud storage providers, for example Dropbox or Egnyte.

160

administrator help

After a Cloud Storage policy has been assigned to endpoints, files in locations covered by the policy are transparently encrypted without user interaction:

■

■

Encrypted files will be synchronized into the cloud.

Encrypted files received from the cloud can be modified by applications as usual.

To access Cloud Storage encrypted files on endpoints without SafeGuard Enterprise Cloud

Storage, SafeGuard Portable can be used to read encrypted files.

Note: Cloud Storage only encrypts new data stored in the cloud. If data is already stored in the cloud before installing Cloud Storage, this data will not automatically be encrypted. If you want to encrypt this data, you have to remove it from the cloud first and then enter it again.

5.4.1 Requirements for Cloud Storage vendor software

To enable encryption of data stored in the cloud, the software provided by the cloud storage vendor must:

■

Run on the computer where Cloud Storage is installed.

■

■

Have an application (or system service) that is stored on the local file system and synchronizes data between the cloud and the local system.

Store the synchronized data on the local file system.

5.4.2 Create Cloud Storage Definitions (CSDs)

In the SafeGuard Management Center, predefined Cloud Storage Definitions are available for several cloud storage providers, for example Dropbox or Egnyte.You can modify the paths defined in predefined Cloud Storage Definitions according to your requirements or create a new one and copy values from a predefined one as a basis. This is for example useful, if you only want to encrypt part of the data in cloud storage.You can also create your own Cloud Storage Definitions.

Note: Certain folders (for example the Dropbox installation folder) may prevent the operating system or applications from running when encrypted. When you create Cloud Storage Definitions for Device Protection policies, make sure that these folders are not encrypted.

1. In the Policies navigation area, select Cloud Storage Definitions.

2. In the context menu of Cloud Storage Definitions, click New > Cloud Storage Definition.

3. The New Cloud Storage Definition dialog appears. Enter a name for the Cloud Storage

Definition.

4. Click OK. The Cloud Storage Definition appears with the entered name under the Cloud

Storage Definitions root node in the Policies navigation area.

5. Select the Cloud Storage Definition. In the work area on the right-hand side the content of a

Cloud Storage Definition is displayed:

■

■

Target name:

This is the name you entered initially. It is used for referencing the Cloud Storage Definition as a target in a policy of the type Device Protection.

Synchronization application:

Enter path and application that synchronizes the data with the cloud (for example:

<Desktop>\dropbox\dropbox.exe). The application must reside on a local drive.

161

SafeGuard Enterprise

■

Synchronization folders:

Enter the folder(s) that will be synchronized with the cloud. Only local paths are supported.

Note: For paths in the Synchronization application and Synchronization folders settings, the same placeholders as for File Encryption are supported, see

Placeholders for paths in location-based File Encryption rules

(page 154).

5.4.2.1 Placeholders for cloud storage providers

As a security officer you can use placeholders for cloud storage providers to define synchronization application and synchronization folders. These placeholders represent supported 3rd party cloud storage applications. You can use the placeholder to specify a certain 3rd party application as synchronization application and even use the same placeholder to point the synchronization folders the 3rd party application actually uses for synchronization.

Placeholders for cloud storage providers are encapsulated by

<!

and

!>

.

Provider

Box

Dropbox

Placeholder

<!Box!>

<!Dropbox!>

Egnyte

Windows only

<!Egnyte!>

Can be used in CSD setting Resolves to

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the Box software.

For synchronization folders: The fully qualified path of the synchronization folder used by the Box software.

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the Dropbox software.

For synchronization folders: The fully qualified path of the synchronization folder used by the Dropbox software.

Synchronization Application

The fully qualified path of the synchronization application used by the

Egnyte software.

162

administrator help

Provider Placeholder

<!EgnytePrivate!>

<!EgnyteShared!>

Can be used in CSD setting

Synchronization folders

Synchronization folders

Resolves to

All private folders in the

Egnyte cloud storage. For standard Egnyte users this is usually a single folder.

For Egnyte administrators this placeholder typically resolves to multiple folders.

All shared folders in the

Egnyte cloud storage.

Google Drive

OneDrive

Note:

Changes to the Egnyte folder structure (including adding or removing private and shared folders) are detected automatically. The policies concerned are adjusted automatically.

Note: As Egnyte synchronization folders may reside on network locations you can enter network paths in the Synchronization folders setting. The SafeGuard Enterprise Cloud

Storage module therefore attaches to network file systems by default. If this is not required, you can deactivate this behavior by defining a General Settings policy and selecting Network under Ignored Devices.

<!GoogleDrive!>

<!OneDrive!>

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the Google Drive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the Google

Drive software.

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the OneDrive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the

OneDrive software.

163

SafeGuard Enterprise

Provider Placeholder Can be used in CSD setting Resolves to

Note: SafeGuard Enterprise does not support Microsoft accounts. Under Windows 8.1,

OneDrive can only be used if the Windows user is a domain user. Under Windows 8.1

SafeGuard Enterprise does not support OneDrive for local users.

OneDrive for

Business

<!OneDriveForBusiness!>

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the OneDrive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the

OneDrive software.

Note: OneDrive for Business only supports storing encrypted files in local folders and synchronizing them with the cloud. Storing encrypted files from Microsoft Office 2013 applications directly in the OneDrive for Business cloud or directly on the SharePoint

Server is not supported. These files are stored unencrypted in the cloud.

SafeGuard Enterprise encrypted files in the OneDrive for Business cloud cannot be opened by Microsoft Office 365.

SkyDrive

Windows only

<!SkyDrive!>

Synchronization application,

Synchronization folders

For synchronization applications: The fully qualified path of the synchronization application used by the OneDrive software.

For synchronization folders: The fully qualified path of the synchronization folder used by the

OneDrive software.

Since Microsoft renamed SkyDrive to OneDrive, the

<!SkyDrive!>

placeholder is still available.

This way older policies using the placeholder and SafeGuard Enterprise endpoints before version 7 which cannot handle the

<!OneDrive!>

placeholder can be used without any changes. SafeGuard Enterprise endpoints version 7 can handle both placeholders.

164

administrator help

Example

If you use Dropbox as your cloud storage provider you can simply enter

<!Dropbox!>

in

Synchronization application. If you do not explicitly specify a synchronization folder,

<!Dropbox!>

is also copied into the list of folders under Synchronization folders.

Assuming

■

You used the placeholders

<!Dropbox!>

as synchronization application and

<!Dropbox!>\encrypt

as synchronization folder in the Cloud Storage Definition

■

■

Dropbox is installed on the endpoint

The user has d:\dropbox

configured as folder to be synchronized with Dropbox:

When the SafeGuard Enterprise endpoint receives a policy with a CSD like this, it will automatically translate the placeholders in the CSD to match the path of Dropbox.exe for the synchronization application and it will read the Dropbox configuration and set the encryption policy on the folder d:\dropbox\encrypt

.

5.4.2.2 Export and import Cloud Storage Definitions

As a security officer you can export and import Cloud Storage Definitions (CSD). A CSD will be exported as an XML file.

■

To export a CSD click Export Cloud Storage Definition... in the context menu of the desired

Cloud Storage Definition in the Policy area.

■

To import a CSD click Import Cloud Storage Definition... in the context menu of the Cloud

Storage Definition node in the Policy area.

Both commands are also available in the Actions menu of the SafeGuard Management Center.

5.4.3 Create a device protection policy with a Cloud Storage Definition target

The Cloud Storage Definitions must have been created beforehand. Predefined Cloud Storage

Definitions are available for several cloud storage providers, for example Dropbox or Egnyte.

You define the settings to encrypt cloud storage data in a policy of the type Device Protection.

1. In the Policies navigation area, create a new policy of the type Device Protection.

2. Select a Cloud Storage Definition as a target.

3. Click OK. The new policy is displayed in the navigation window below Policy Items. In the action area, all settings for the Device Protection policy are displayed and can be changed.

4. For the Media encryption mode setting select File-based. Volume-based encryption is not supported.

5. Under Algorithm to be used for encryption select the algorithm to be used for encrypting the data in the synchronization folders defined in the CSD.

6. Settings Key to be used for encryption and Defined key for encryption are used to define the key or the keys that shall be used for encryption. For further information, see

Device

Protection

(page 369).

165

SafeGuard Enterprise

7. If you activate the Copy SG Portable to target setting, SafeGuard Portable is copied to each synchronization folder as soon as content is written to it. SafeGuard Portable is an application that can be used to read encrypted files on Windows computers that do not have SafeGuard

Enterprise installed.

Note: To share encrypted data stored in the cloud with users that do not have SafeGuard

Enterprise installed, users should be allowed to create local keys, see

Local keys (page 167).

8. The Plaintext folder setting allows you to define a folder that will be excluded from encryption.

Data stored in subfolders of the defined plaintext folder will also be excluded from encryption.

SafeGuard Cloud Storage automatically creates empty plaintext folders in all synchronization folders defined in the Cloud Storage Definition.

5.4.4 Track files accessed in cloud storage

You can track files accessed in cloud storage by using the Reports function of the SafeGuard

Management Center. Files accessed can be tracked regardless of any encryption policies applied to them.

In a policy of the type Logging you can define the following:

■

To log an event when a file or directory is created on a removable media device.

■

■

To log an event when a file or directory is renamed on a removable media device.

To log an event when a file or directory is deleted from a removable media device.

For further information, see

File access report for removable media and cloud storage

(page 319).

5.5 SafeGuard Data Exchange

SafeGuard Data Exchange is used to encrypt data stored on removable media connected to a computer and to exchange this data with other users. All encryption and decryption processes run transparently and involve minimum user interaction.

Only users who have the appropriate keys can read the contents of the encrypted data. All subsequent encryption processes run transparently.

In central administration, you define how data on removable media are handled.

As a security officer, you define the specific settings in a policy of type Device Protection with

Removable media as Device protection target.

For SafeGuard Data Exchange, File-based has to be used as Media Encryption mode.

5.5.1 Group keys

To exchange encrypted data between users, SafeGuard Enterprise group keys have to be used.

If the group key is in the users’ key rings, the users get full transparent access to removable media connected to their computers.

On computers without SafeGuard Enterprise, it is not possible to access encrypted data on removable media, except the centrally defined domain/group key which can be used together with the media passphrase.

166

administrator help

Note: To use/share encrypted data on removable media also on/with computers/users that do not have SafeGuard Enterprise, SafeGuard Portable can be used. SafeGuard Portable requires the usage of local keys or a media passphrase.

5.5.2 Local keys

SafeGuard Data Exchange supports encryption using local keys. Local keys are created on the computers and can be used to encrypt data on removable media. They are created by entering a passphrase and are backed up in the SafeGuard Enterprise Database.

Note: By default a user is allowed to create local keys. If users should not be able to do so, you have to disable this option explicitly. This has to be done in a policy of the type Device Protection with Local Storage Devices as Device protection target (General Settings > User is allowed

to create a local key > No).

If local keys are used to encrypt files on removable media, these files can be decrypted using

SafeGuard Portable on a computer without SafeGuard Data Exchange. When the files are opened with SafeGuard Portable, the user is prompted to enter the passphrase that was specified when the key was created. If the user knows the passphrase, they can open the file.

Using SafeGuard Portable every user who knows the passphrase can get access to an encrypted file on removable media. This way it is also possible to share encrypted data with partners who do not have SafeGuard Enterprise installed. They only need to be provided with SafeGuard

Portable and the passphrase for the files they should have access to.

If different local keys are used to encrypt files on removable media, you can even restrict access to files. For example: You encrypt the files on a USB memory stick using a key with passphrase

my_localkey and encrypt a single file named ForMyPartner.doc using the passphrase

partner_localkey. If you give the USB memory stick to a partner and provide them with the passphrase partner_localkey, they will only have access to ForMyPartner.doc.

Note: By default SafeGuard Portable is automatically copied to removable media connected to the system as soon as content is written to media covered by an encryption rule. If you do not want SafeGuard Portable to be copied to removable media, deactivate the Copy SG Portable

to target option in a policy of the type Device Encryption.

5.5.3 Media passphrase

SafeGuard Data Exchange allows you to specify that one single media passphrase for all removable media - except optical media - has to be created on the endpoints. The media passphrase provides access to the centrally defined domain/group key as well as to all local keys used in SafeGuard

Portable. The user only has to enter one single passphrase and gets access to all encrypted files in SafeGuard Portable, regardless of the local key used for encryption.

On every endpoint, a unique Media Encryption Key for data encryption is automatically created for each device. This key is protected with the media passphrase and a centrally defined domain/group key. On a computer with SafeGuard Data Exchange it is therefore not necessary to enter the media passphrase to access encrypted files on the removable media. Access is granted automatically if the appropriate key is part of the user's key ring.

The domain/group key to be used has to be specified under Defined key for encryption.

Media passphrase functionality is available when the User may define a media passphrase for

devices option is activated in a policy of the type Device Protection.

167

SafeGuard Enterprise

When this setting becomes active on the endpoint, the user is automatically prompted to enter a media passphrase, when he connects removable media for the first time. The media passphrase is valid on every computer the user is allowed to log on to. The user may also change the media passphrase and it will be synchronized automatically when the passphrase known on the computer and the media passphrase of the removable media are out of sync.

If the user forgets the media passphrase, it can be recovered by the user without any need of a helpdesk.

Note: To enable the media passphrase, activate the User may define a media passphrase for

devices option in a policy of the type Device Protection. This is only available, if you have selected Removable media as Device protection target.

5.5.3.1 Media passphrase and unmanaged endpoints

On an unmanaged endpoint (operating in standalone mode) without an activated media passphrase feature, no keys are available after installation since unmanaged endpoints only use local keys.

Before encryption can be used, the user has to create a key.

If the media passphrase feature is activated in a removable media policy for these endpoints, the media encryption key is created automatically on the endpoint and can be used for encryption immediately after installation has been completed. It is available as a predefined key in the user's key ring and displayed as <user name> in dialogs for key selection.

If available, the media encryption keys is also used for all initial encryption tasks.

5.5.4 Best practice

This section describes some typical use cases for SafeGuard Data Exchange and how to implement them by creating the appropriate policies.

Bob and Alice are two employees of the same company and have SafeGuard Data Exchange installed, Joe is an external partner and does not have SafeGuard Enterprise installed on his computer.

5.5.4.1 Company internal use only

Bob wants to share encrypted data on removable media with Alice. Both belong to the same group and therefore have the appropriate group key in their SafeGuard Enterprise key ring. As they are using the group key, they can access the encrypted files transparently without the need to enter a passphrase.

You have to specify the settings in a policy of the type Device Protection\Removable media:

■

Media encryption mode: File-based

■

Key to be used for encryption: Defined key on list

■

Defined key on list: <group/domain key > (for example, group_users_Bob_Alice@DC=...) to ensure that both share the same key

If company policies additionally define that all files on removable media have to be encrypted in any situation, add the following settings:

■

Initial encryption of all files: Yes

168

administrator help

Ensures that files on removable media are encrypted as soon as the media is connected to the system for the first time.

■

User may cancel initial encryption: No

The user cannot cancel initial encryption, for example to postpone it.

■

User is allowed to access unencrypted files: No

If plaintext files on removable media are detected, access to them will be denied.

■

User may decrypt files: No

The user is not permitted to decrypt files on removable media.

■

Copy SG Portable to target: No

As long as data on removable media are shared within the workgroup, SafeGuard Portable is not necessary. Also, SafeGuard Portable would allow to decrypt files on computers without

SafeGuard Enterprise.

The users can share data just by exchanging their devices. When they connect the devices to their computers they have transparent access to encrypted files.

Note: This use case can be fulfilled by using SafeGuard Enterprise Device Encryption where the whole removable media is sector-based encrypted.

5.5.4.2 Home office or personal use on 3rd party computers

■

Home office:

Bob wants to use his encrypted removable media on his home computer, where SafeGuard

Enterprise is not installed. On his home computer, Bob decrypts files using SafeGuard Portable.

By defining one media passphrase for all of Bob's removable media, he only has to open

SafeGuard Portable and enter the media passphrase. Afterwards, Bob has transparent access to all encrypted files regardless of the local key used to encrypt them.

■

Personal use on 3rd party computers

Bob plugs in the removable media on Joe's (external partner) computer and enters the media passphrase to get access to the encrypted files stored on the device. Bob can now copy the files, either encrypted or unencrypted, to Joe's computer.

Behavior on endpoint:

■

Bob plugs in the removable media for the first time.

■

The Media Encryption Key, which is unique for each device, is created automatically.

■

Bob is prompted to enter the media passphrase for offline use with SafeGuard Portable.

■

There is no need to bother the user with knowledge about the keys to be used or the key ring.

The Media Encryption Key will always be used for data encryption without any user interaction.

The Media Encryption Key is not even visible to the user, but only the centrally defined group/domain key.

169

SafeGuard Enterprise

■

Bob and Alice within the same group or domain have transparent access since they share the same group/domain key.

■

If Bob wants to access encrypted files on a removable media device on a computer without

SafeGuard Data Exchange, he can use the media passphrase within SafeGuard Portable.

You have to specify the settings in a policy of the type Device Protection\Removable media:

■

Media encryption mode: File-based

■

Key to be used for encryption: Defined key on list

Defined key on list: <group/domain key > (for example group_users_Bob_Alice@DC=...) to ensure that both share the same key.

■

User may define a media passphrase for devices: Yes

The user defines one media passphrase on their computer which is valid for all their removable media.

■

Copy SG Portable to target: Yes

SafeGuard Portable gives the user access to all encrypted files on the removable media by entering a single media passphrase on the system without SafeGuard Data Exchange.

If the company policies additionally define that all files on removable media have to be encrypted in any situation, add the following settings:

■

Initial encryption of all files: Yes

Ensures that files on removable media are encrypted as soon as the media is connected to the system for the first time.

■

User may cancel initial encryption: No

The user cannot cancel initial encryption, for example to postpone it.

■

User is allowed to access unencrypted files: No

If plaintext files on removable media are detected, access to them will be denied.

■

User may decrypt files: No

The user is not permitted to decrypt files on removable media.

At work, Bob and Alice have transparent access to encrypted files on removable media. At home or on 3rd party computers, they can use SafeGuard Portable to open encrypted files. The users only have to enter the media passphrase to access all encrypted files. This is a simple but effective way to encrypt data on all removable media. The goal of this configuration is to reduce user interaction to a minimum while encrypting each and every file on removable media and giving the user access to the encrypted files in offline mode. The user is not permitted to decrypt files on removable media.

Note: In this configuration, users are not allowed to create local keys since it is not necessary for that use case. This has to be specified in a policy of the type Device Protection with Local

170

administrator help

Storage Devices as Device protection target (General Settings > User is allowed to create

a local key > No).

■

Copy SG Portable to removable media: No.

As long as data on removable media are shared in the workgroup SafeGuard Portable is not necessary. Also, SafeGuard Portable would allow to decrypt files without SafeGuard Enterprise.

At work, the user has transparent access to encrypted files on removable media. At home, they use SafeGuard Portable to open encrypted files. The user only has to enter the media passphrase to access all encrypted files, regardless of the key used for encrypting them.

5.5.4.3 Share removable media with external party

Note: This example applies only for Windows endpoints.

Bob wants to hand out an encrypted device to Joe (external party) who does not have SafeGuard

Data Exchange installed and therefore has to use SafeGuard Portable. Under the assumption that Bob does not want to give Joe access to all encrypted files on the removable media, he can create a local key and encrypt the files with this local key. Joe can now use SafeGuard Portable and open the encrypted files with the passphrase of the local key, whereas Bob still can use the media passphrase to access any encrypted file on the removable device.

Behavior on the computer

■

Bob plugs in the removable media for the first time. The Media Encryption Key, which is unique for each device, is created automatically.

■

Bob is prompted to enter the media passphrase for offline use.

■

The Media Encryption Key is used for data encryption without any user interaction, but…

■

Bob can now create or select a local key (for example JoeKey) for the encryption of specific files that shall be exchanged with Joe.

■

Bob and Alice within the same group or domain have transparent access since they share the same group/domain key.

■

If Bob wants to access encrypted files on a removable media device on a computer without

SafeGuard Data Exchange, he can use the media passphrase within SafeGuard Portable.

■

Joe can access the specific files by entering the passphrase of the JoeKey without having access to the whole removable media.

You have to specify the settings in a policy of the type Device Protection\Removable Media:

■

Media encryption mode: File-based

■

Key to be used for encryption: Any key in user key ring

Allows the user to choose different keys for encrypting files on their removable media

Defined key for encryption: <group/domain key > (for example group_users_Bob_Alice@DC=...). To ensure that the user can share data in their work

171

SafeGuard Enterprise group and to give them transparent access to removable media when they connect them to their computer at work.

■

User may define a media passphrase for devices: Yes

The user defines one media passphrase on their computer which is valid for all their removable media.

■

Copy SG Portable to target: Yes

SafeGuard Portable gives the user access to all encrypted files on the removable media by entering a single media passphrase on the system without SafeGuard Data Exchange.

If the company policies additionally define that all files on removable media have to be encrypted in any situation, add the following settings:

■

Initial encryption of all files: Yes

Ensures that files on removable media are encrypted as soon as the media is connected to the system for the first time.

■

User may cancel initial encryption: No

The user cannot cancel initial encryption, for example to postpone it.

■

User is allowed to access unencrypted files: No

If plaintext files on removable media are detected, access to them will be denied.

■

User may decrypt files: No

The user is not permitted to decrypt files on removable media.

At work, Bob and Alice have transparent access to encrypted files on removable media. At home, they can use SafeGuard Portable to open encrypted files by entering the media passphrase. If

Bob or Alice wants to hand out the removable media to a 3rd party computer that does not have

SafeGuard Data Exchange installed, they can use local keys to ensure that the external party can access only some specific files. This is an advanced configuration, which means more interaction for the user by allowing them to create local keys on their computer.

Note: A prerequisite for this example is that the user is allowed to create local keys (default setting in SafeGuard Enterprise).

5.5.5 Configure trusted and ignored applications for SafeGuard Data Exchange

You can define applications as trusted to grant them access to encrypted files. This is for example necessary to enable antivirus software to scan encrypted files.

You can also define applications as ignored to exempt them from transparent file encryption/decryption. For example, if you define a backup program as an ignored application, encrypted data backed up by the program remains encrypted.

Note: Child processes will not be trusted/ignored.

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

172

administrator help

2. Under File Encryption, click the drop-down button of the Trusted Applications or Ignored

Applications field.

3. In the editor list box, enter the applications to be defined as trusted/ignored.

■

■

■

You can define multiple trusted/ignored applications in one policy. Each line in the editor list box defines one application.

Application names must end with .exe.

Application names must be specified as fully qualified paths including drive/directory information. Entering the file name only (for example "example.exe") is not sufficient. For better usability the single line view of the application list only shows the file names separated by semicolons.

4. Save your changes.

Note: The Trusted Applications and Ignored Applications policy settings are machine settings.

The policy must therefore be assigned to machines, not to users. Otherwise the settings do not become active.

5.5.6 Configure ignored devices for SafeGuard Data Exchange

You can define devices as ignored to exclude them from the file encryption process. You can only exclude entire devices.

1. In the Policies navigation area, create a new policy of the type General Settings or select an existing one.

2. Under File Encryption, click the drop-down button of the Ignored Devices field.

3. In the editor list box, enter the required device names to exclude specific devices from encryption. This may be useful when you need to exclude systems from third party suppliers.

Note: You can display the names of the devices currently used in the system by using third party tools (for example OSR's Device Tree). SafeGuard Enterprise logs all devices it attaches to and you can display a list of attached and ignored devices by using registry keys.

5.5.6.1 Display attached and ignored devices for SafeGuard Data Exchange configuration

To help you when defining ignored devices, you can use registry keys to show which devices are being considered for encryption (attached devices) and which devices are currently being ignored.

The list of ignored devices shows only devices that are actually available on the computer and are being ignored. If a device is set to be ignored in a policy and the device is not available on the computer, the device is not listed.

Use the following registry keys to display attached and ignored devices:

■

HKLM\System\CurrentControlSet\Control\Utimaco\SGLCENC\Log\AttachedDevices

■

HKLM\System\CurrentControlSet\Control\Utimaco\SGLCENC\Log\IgnoredDevices

173

SafeGuard Enterprise

5.5.7 Configure persistent encryption for SafeGuard Data Exchange

The content of files encrypted by SafeGuard Data Exchange is being decrypted on-the-fly, if the user owns the required key. When the content is saved as a new file in a location that is not covered by an encryption rule, the resulting file will be not be encrypted.

With persistent encryption, copies of encrypted files will be encrypted, even when they are saved in a location not covered by an encryption rule.

You can configure persistent encryption in policies of the type General Settings. The policy setting Enable persistent encryption is activated by default.

Note:

■

■

If files are copied or moved to an ignored device or to a folder to which a policy with encryption

Mode Ignore applies, the Enable persistent encryption setting has no effect.

Copy operations are detected based on file names. When a user saves an encrypted file with

Save As under a different file name in a location not covered by an encryption rule, the file will be plaintext.

5.5.8 Track files accessed on removable media

You can track files accessed on removable media by using the Reports function of the SafeGuard

Management Center. Files accessed can be tracked regardless of any encryption policy applying to files on removable media.

In a policy of the type Logging you can define the following:

■

An event to be logged when a file or directory is created on a removable media device.

■

■

An event to be logged when a file or directory is renamed on a removable media device.

An event to be logged when a file or directory is deleted from a removable media device.

For further information, see

File access report for removable media and cloud storage

(page 319).

5.5.9 SafeGuard Data Exchange and File Encryption

The SafeGuard Enterprise module File Encryption offers file-based encryption on network locations, especially for work groups on network shares.

If both SafeGuard Data Exchange and File Encryption are installed on an endpoint, it may occur that a SafeGuard Data Exchange encryption policy is defined for a drive on the computer and

File Encryption policies are defined for folders on the same drive. If this is the case, the SafeGuard

Data Exchange encryption policy overrules the File Encryption policies. New files are encrypted according to the SafeGuard Data Exchange encryption policy.

For further information see

Location-based File Encryption (page 150).

5.6 SafeGuard Full Disk Encryption

SafeGuard Full Disk Encryption with SafeGuard Power-on Authentication (POA) is the Sophos module for encrypting volumes on endpoints. It comes with a Sophos implemented pre-boot

174

administrator help authentication named SafeGuard Power-on Authentication (POA) which support logon options like smartcard and fingerprint and a Challenge/Response mechanism for recovery.

Files are encrypted transparently. When users open, edit and save files, they are not prompted for encryption or decryption. Full Disk Encryption can be volume- or file-based with different keys and algorithms.

As a security officer, you specify the settings for encryption in a security policy of the type Device

Protection. For further information, see Working with policies

(page 86), and see Device Protection

(page 369).

Note: SafeGuard Full Disk Encryption is only available for Windows 7 BIOS endpoints. If you use Windows 7 UEFI or a newer version of Windows, make use of the integrated Windows

BitLocker Drive Encryption functionality. For more information refer to BitLocker Drive Encryption

(page 139).

5.6.1 Volume-based full disk encryption

With volume-based full disk encryption, all data on a volume (including boot files, pagefiles, hibernation files, temporary files, directory information etc.) are encrypted. Users do not have to change normal operating procedures or consider security.

To apply volume-based encryption to endpoint, create a policy of the type Device Protection

and set the Media encryption mode to Volume-based. For further information, see Device

Protection

(page 369).

Note:

■

Volume-based encryption/decryption is not supported for drives without a drive letter assigned.

■

■

■

■

If an encryption policy exists for a volume or a volume type and encryption of the volume fails, the user is not allowed to access it.

Endpoints can be shut down and restarted during encryption/decryption.

If decryption is followed by an uninstallation, we recommend that the endpoint is not suspended or hibernated during decryption.

If after volume encryption a new policy is applied to an endpoint computer that allows decryption, the following applies: After a complete volume-based encryption, the endpoint computer must be restarted at least once before decryption can be started.

Note: In contrast to SafeGuard BitLocker Drive Encryption, SafeGuard volume-based encryption does not support GUID partition table (GPT) disks. Installation will be aborted if such a disk is found. If a GPT disk is added to the system later, volumes on the disk will get encrypted. Please be aware that the SafeGuard recovery tools - such as BE_Restore.exe and recoverkeys.exe cannot handle such volumes and Sophos highly recommends to avoid GPT disks to be encrypted.

To decrypt volumes that were accidentally encrypted, please change your SafeGuard Enterprise policies accordingly and have the user decrypt them.

5.6.1.1 Volume-based encryption and Windows 7 system partition

For Windows 7 Professional, Enterprise and Ultimate, a system partition is created on endpoints without a drive letter assigned. This system partition cannot be encrypted by SafeGuard Enterprise.

175

SafeGuard Enterprise

5.6.1.2 Fast initial encryption

SafeGuard Enterprise offers fast initial encryption as a special mode for volume-based encryption.

It reduces the time needed for initial encryption (or final decryption) of volumes on endpoints by accessing only disk space that is actually in use.

For fast initial encryption, the following prerequisites apply:

■

Fast initial encryption only works on NTFS-formatted volumes.

■

NTFS-formatted volumes with a cluster size of 64 KB cannot be encrypted with the fast initial encryption mode.

Note: This mode leads to a less secure state if a disk has been used before its current usage with SafeGuard Enterprise. Unused sectors may still contain data. Fast initial encryption is therefore disabled by default.

To enable fast initial encryption, select the setting Fast initial encryption in a policy of the type

Device Protection.

Note: For volume decryption, the fast initial encryption mode will always be used, regardless of the specified policy setting. For decryption, the prerequisites listed also apply.

5.6.1.3 Volume-based encryption and Unidentified File System Objects

Unidentified File System Objects are volumes that cannot be clearly identified as plaintext or device-encrypted by SafeGuard Enterprise. If an encryption policy exists for an Unidentified File

System Object, access to this volume will be denied. If no encryption policy exists, the user can access the volume.

Note: If an encryption policy with Key to be used for encryption set to an option that enables key selection (for example, Any key in user key ring) exists for an Unidentified File System

Object volume, there is a period of time between the key selection dialog being displayed and access being denied. During this time period the volume can be accessed. As long as the key selection dialog is not confirmed, the volume is accessible. To avoid this, specify a preselected key for encryption. For further information on the relevant policy settings, see

Device Protection

(page 369). This period of time also occurs for Unidentified File System Object volumes connected to an endpoint, if the user has already opened files on the volume when an encryption policy takes effect. In this case, it cannot be guaranteed that access to the volume will be denied as this could lead to data loss.

5.6.1.4 Encryption of volumes with enabled Autorun functionality

If you apply an encryption policy to volumes for which Autorun is enabled, the following can occur:

■

The volume is not encrypted.

■

If the volume is an Unidentified File System Object, access is not denied.

5.6.1.5 File-based full disk encryption

File-based encryption ensures that all data is encrypted, apart from the boot medium and directory information. With file-based encryption, even optical media such as CD/DVD can be encrypted.

176

administrator help

Also, data can be exchanged with external computers on which SafeGuard Enterprise is not installed, if policies permit, see

SafeGuard Data Exchange

(page 166).

Note: Boot volumes are never file-based encrypted. They are automatically exempted from file-based encryption, even if a corresponding rule is defined.

Note: Data encrypted using file-based encryption cannot be compressed. Nor can compressed data be file-based encrypted.

To apply file-based encryption to endpoints, create a policy of the type Device Protection and set the Media encryption mode to File-based.

5.6.1.5.1 Default behavior when saving files

Since applications behave differently when saving files, SafeGuard Enterprise offers two ways for handling encrypted files that have been modified.

If a file is encrypted with a different key than the default key of the volume and you edit the file and save it, you may expect the original encryption key to be preserved, since you are editing a file, not creating a new one. But many applications save files by performing a combination of save, delete, and rename operations (for example Microsoft Office). If they do so, the default SafeGuard

Enterprise setting is to use the default key for this encryption task and therefore change the key used for encryption.

If you want to change this behavior and preserve the key used for encryption in any case, you can modify a registry key on the endpoint.

To always use the same key as before when saving modified files:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\UTIMACO\SGLCENC]

"ActivateEncryptionTunneling"=dword:00000001

To revert to the default setting that allows the use of a different key (default key) when saving modified files, use the following:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\UTIMACO\SGLCENC]

"ActivateEncryptionTunneling"=dword:00000000

Note: Changes in this setting require a restart of the endpoint to become active.

5.6.2 SafeGuard Power-on Authentication (POA)

Note: This description refers to Windows 7 endpoints with SafeGuard full disk encryption.

SafeGuard Enterprise identifies the user even before the operating system starts up. To do this,

SafeGuard Enterprise's own system core starts before this. It is protected against modifications and is saved, hidden, on the hard disk. Only when the user has been properly authenticated in the SafeGuard POA, is the actual operating system (Windows) started from the encrypted partition.

The user is logged on automatically to Windows later. The procedure is the same when the endpoint is switched back on from hibernation (Suspend to Disk).

177

SafeGuard Enterprise

The SafeGuard Power-on Authentication offers:

■

A graphical user interface with mouse support and draggable windows, so it is easy to read and use.

■

A graphical layout which, following guidelines, can be adapted by corporate computers

(background image, logon image, welcome message, etc.).

■

Support for many card readers and smartcards.

■

Support for Windows user accounts and passwords even pre-boot, no more separate credentials which the user has to remember.

■

Support for Unicode and therefore also for foreign language passwords and user interfaces.

5.6.2.1 Logging on

SafeGuard Enterprise works with certificate-based logon. So users need keys and certificates to successfully log on at the SafeGuard Power-on Authentication. However, user-specific key and certificates are only created after a successful Windows logon. Only users who have successfully logged on to Windows can also be authenticated in the SafeGuard Power-on Authentication.

To clarify how a user logs on in SafeGuard Enterprise, a brief introduction follows. For a detailed description of the SafeGuard POA logon procedures, see the SafeGuard Enterprise user help.

178

administrator help

SafeGuard Autologon

When logging on for the first time, SafeGuard Enterprise autologon appears after starting the endpoint.

What happens?

1. An autouser is logged on.

2. The client is automatically registered on the SafeGuard Enterprise Server.

3. The machine key is sent to the SafeGuard Enterprise Server and stored in the SafeGuard

Enterprise Database.

4. Machine policies are sent to the endpoint.

Windows logon

The Windows logon dialog is displayed. The user logs on.

What happens?

1. User ID and a hash of the user’s credentials are sent to the server.

2. User policies, certificates and keys are created and sent to the endpoint.

3. The SafeGuard POA is activated.

SafeGuard POA logon

When the endpoint restarts, the SafeGuard POA appears.

What happens?

1. Certificates and keys are available for the user and they can log on at the SafeGuard POA.

2. All the data is securely encrypted with the user's public RSA key.

3. Any other users who want to log on must first be imported to the SafeGuard POA.

5.6.2.1.1 Logon delay

On a SafeGuard Enterprise protected endpoint, a logon delay applies if a user provides incorrect credentials during authentication at Windows or at the SafeGuard Power-on Authentication. With every failed logon attempt the delay is increased. After a failed logon a dialog displays the remaining delay time.

Note: If a user enters an incorrect PIN during token logon, there is no delay.

You can specify the number of logon attempts allowed in a policy of the type Authentication using the Maximum no. of failed logons option. When the maximum number of failed logon attempts has been reached, the endpoint is locked. For unlocking their computer, users have to initiate a Challenge/Response procedure.

179

SafeGuard Enterprise

5.6.2.2 Register further SafeGuard Enterprise users

The first user to log on in Windows is automatically registered in the SafeGuard POA. At first, no other Windows user can log on at the SafeGuard POA.

Further users must be imported with the assistance of the first user. For a detailed description of importing further users, see the SafeGuard Enterprise user help.

A policy setting specifies who is permitted to import a new user. You can find this policy in the

SafeGuard Management Center under

Policy items

■

Type: Specific Machine Settings

■

Field: Allow registration of new SGN users for

Default setting: Owner

An endpoint's owner is specified in the SafeGuard Management Center under

Users and Computers

■

Select <endpoint name>.

■

Users tab

5.6.2.3 User types

There are various types of user in SafeGuard Enterprise. For more information on how the default

behavior of these user types can be changed, see Policy types and their fields of applications

(page 346).

■

Owner: The first user to log on to an endpoint after the installation of SafeGuard Enterprise is not just entered as an SGN user, but also as the owner of that endpoint. Provided that the default settings have not been changed, an owner has the right to enable other users to log on to the endpoint and become SGN users.

■

SGN user: A "full" SGN user is allowed to log on at the SafeGuard Power-on Authentication, is added to the UMA (User Machine Assignment) and is provided with a user certificate and a key ring for accessing encrypted data.

■

SGN Windows user: A SGN Windows user is not added to the SafeGuard POA, but has a key ring for accessing encrypted files, just as a SGN user. He is also added to the UMA, which means that he is allowed to log on to Windows on that endpoint.

■

SGN guest user: A SGN guest user is not added to the UMA, is not provided with rights to log on to the SafeGuard POA, is not assigned a certificate or a key ring and is not saved to the database. See

Specific machine settings - basic settings (page 375) for information on how

to prevent a SGN guest user from logging on to Windows.

■

Service account: With service accounts, users (for example rollout operators, members of the IT team) can log on to endpoints after the installation of SafeGuard Enterprise without activating the SafeGuard POA and without being added as SGN users (owners) to the

180

administrator help endpoints. Users included on a service account list are treated as SGN guest users after their

Windows logon at the endpoint.

■

POA user: After activation of the POA it might still be necessary to perform administrative tasks. POA users are predefined local accounts that are allowed to pass the POA. There is no automatic logon to Windows. The users logging on with POA user accounts log on to

Windows with their existing Windows accounts. The accounts are defined in the Users and

Computers area of the SafeGuard Management Center (user ID and password) and assigned to the endpoint in POA groups. For further information, see

POA users for SafeGuard POA logon (page 191).

5.6.2.4 Configuring the SafeGuard Power-on Authentication

The SafeGuard POA dialog consists of these components:

■

Logon image

■

Dialog text

■

Language of the keyboard layout

You can change the look of the SafeGuard POA dialog to suit your preferences by using policy settings in the SafeGuard Management Center.

5.6.2.4.1 Background and logon image

By default the background and logon images that appear in the SafeGuard POA are in SafeGuard design. You can change these images to show a company logo, for example.

Background and logon images are defined in a policy of the type General Settings.

For usage in SafeGuard Enterprise, background and logon images must fulfill certain requirements:

Background image

Maximum file size for all background images: 500 KB

SafeGuard Enterprise supports two variants for background images:

■

1024x768 (VESA mode)

Colors: no restrictions

Policy of the type General Settings, option Background image in POA

■

640x480 (VGA mode)

Colors: 16

Policy of the type General Settings, option Background image in POA (low resolution)

Logon image

Maximum file size for all logon images: 100 KB

SafeGuard Enterprise supports two variants for logon images:

■

413x140

181

SafeGuard Enterprise

Colors: no restrictions

Policy of the type General Settings, option Logon image in POA

■

413x140

Colors: 16

Policy of the type General Settings, option Logon image in POA (low resolution)

Images have to be created as files (BMP, PNG, JPG) first and can then be registered in the navigation window.

5.6.2.4.1.1 Register images

1. In the Policies navigation area, right-click Images and select New > Image.

2. Enter a name for the image in the Image name field.

3. Click [...] to select the previously created image.

4. Click OK.

The new image is shown as a subnode of Images in the policy navigation area. If you select the image, it is displayed in the action area. The image can now be selected when creating policies.

Proceed as described to register further images. All registered images are shown as subnodes.

Note: You can use the Modify Image button to change the picture assigned.

5.6.2.4.2 User-defined information text in the SafeGuard POA

You can customize the SafeGuard POA to display the following user-defined information texts:

■

Information text to be displayed upon initiating a Challenge/Response procedure for logon recovery (for example: “Please contact Support Desk on telephone number 01234-56789.”)

You can set an information text by using the option Texts in a policy of the type General

Settings.

■

Legal notices to be displayed after logging on to the SafeGuard POA

You can set a legal notice text by using the option Legal notice text in a policy of the type

Specific Machine Settings.

■

Text for additional information to be displayed after logging on to the SafeGuard POA

You can set an additional information text by using the option Additional information text in a policy of the type Specific Machine Settings.

5.6.2.4.2.1 Register information texts

The text files containing the required information have to be created before registering them in the SafeGuard Management Center. The maximum file size for information texts is 50 KB.

SafeGuard Enterprise only uses Unicode UTF-16 coded texts. If you do not create the text files in this format, they will be automatically converted when they are registered. Special characters should therefore be used with caution in the information texts created for the SafeGuard POA.

Some of these characters may not be displayed properly.

182

administrator help

To register information texts:

1. In the Policies navigation area, right-click Texts and select New > Text.

2. Enter a name for the text to be displayed in the Text item name field.

3. Click [...] to select the text file previously created. If the file needs to be converted, a message will be displayed.

4. Click OK.

The new text item is displayed as a subnode below Texts in the policy navigation area. If you select a text item, its contents will be displayed in the window on the right-hand side. The text item can now be selected when creating policies.

Proceed as described to register further text items. All registered text items will be shown as subnodes.

Note: You can use the Modify Text button to add new text to existing text. When you click this button a dialog is displayed for selecting another text file. The text contained in this file is appended to the existing text.

5.6.2.4.3 Language for SafeGuard POA dialog text

After installation of the SafeGuard Enterprise encryption software, the SafeGuard POA dialog text is displayed in the default language set in the Windows Regions and Language Options on the endpoint when SafeGuard Enterprise was installed.

You can change the language of the SafeGuard POA dialog text after SafeGuard Enterprise has been installed by using one of the two following methods:

■

Change the default language in the Windows Regions and Language Options on the endpoint.

After the user has restarted the endpoint twice, the new language setting is active in the

SafeGuard POA.

■

Create a policy of the type General Settings, set the language in the field Language used

on client and deploy the policy to the endpoint.

Note: If you define a policy and deploy it to the endpoint, the language set in the policy applies instead of the language specified by the Windows Regions and Language Options.

5.6.2.4.4 Keyboard layout

Almost every country has its own keyboard layout. The keyboard layout in the SafeGuard POA is significant when entering user names, passwords and response codes.

By default, SafeGuard Enterprise adopts the keyboard layout in the SafeGuard POA which was set in Windows Regional and Language Options for the Windows default user at the time

SafeGuard Enterprise was installed. If "German" is the keyboard layout set under Windows, the

German keyboard layout will be used in the SafeGuard POA.

The language of the keyboard layout being used is displayed in the SafeGuard POA, for example

"EN" for English. Apart from the default keyboard layout, the US keyboard layout (English) can also be used.

There are certain exceptions:

■

The keyboard layout is supported, but the absence of a font (for example for Bulgarian) means that only special characters are displayed in the User Name field.

183

SafeGuard Enterprise

■

No specific keyboard layout is available (for example Dominican Republic). In these cases, the SafeGuard POA falls back on the original keyboard layout. For the Dominican Republic, this is "Spanish".

■

When the user name and password consist of characters that are not supported by the chosen keyboard layout or the fallback layout, the user cannot log on at the SafeGuard POA.

Note: All unsupported keyboard layouts use the US keyboard layout by default. This also means that the only characters that are recognized and can be typed in are those which are supported in the US keyboard layout. So users can only log on at the SafeGuard POA if their user name and password is composed of characters that are supported by the US keyboard layout or the respective fallback keyboard of their language.

Virtual keyboard

SafeGuard Enterprise provides a virtual keyboard which users can show/hide at the SafeGuard

POA and which allows them to use on-screen keys to enter credentials.

As a security officer, you can activate/deactivate the display of the virtual keyboard in a policy of the type Specific Machine Settings using the Virtual Keyboard in POA option.

Virtual keyboard support must be activated/deactivated by policy setting.

The virtual keyboard supports different layouts and it will be possible to change the layout using the same options as for changing the SafeGuard POA keyboard layout.

5.6.2.4.4.1 Change the keyboard layout

The SafeGuard Power-on Authentication keyboard layout, including the virtual keyboard layout, can be changed retrospectively.

1. Select Start > Control Panel > Regional and Language Options > Advanced.

2. In the Regional Options tab, select the required language.

3. In the Advanced tab, select Apply all settings to the current user account and to the

default user profile under Default user account settings.

4. Click OK.

The SafeGuard POA remembers the keyboard layout used for the last successful logon and automatically enables it for the next logon. This requires two restarts of the endpoint. If the remembered keyboard layout is deactivated in Regional and Language Options, it is still used until the user selects a different one.

Note: You must change the language of the keyboard layout for non-Unicode programs.

If the language you want is not available on the endpoint, Windows may prompt you to install it.

After you have done so, you must restart the endpoint twice so that the SafeGuard Power-on

Authentication can read in the new keyboard layout and can set it.

You can change the required keyboard layout for the SafeGuard Power-on Authentication using the mouse or keyboard (Alt+Shift).

To see which languages are installed and available on the system, select

Start > Run > regedit > HKEY_USERS\.DEFAULT\Keyboard Layout\Preload

.

184

administrator help

5.6.2.5 Supported Hotkeys in the SafeGuard Power-on Authentication

Certain hardware settings and functionalities can lead to problems when starting endpoints, causing the system to no longer respond. The SafeGuard Power-on Authentication supports a number of hotkeys for modifying these hardware settings and deactivating functionalities.

Furthermore, grey and black lists covering functions known to cause problems are integrated in the .msi file installed on the endpoint.

We recommend that you install an updated version of the SafeGuard POA configuration file before any significant deployment of SafeGuard Enterprise. The file is updated on a monthly basis and made available to download from Sophos knowledgebase article 65700 .

You can customize this file to reflect the hardware of a particular environment.

Note: When you define a customized file, only this will be used instead of the one integrated in the .msi file. The default file will be applied only when no SafeGuard POA configuration file is defined or found.

To install the SafeGuard POA configuration file, enter the following command:

MSIEXEC /i <Client MSI package> POACFG=<path of the SafeGuard POA configuration file>

You can help us improve hardware compatibility by executing a tool that we provide to collect hardware relevant information only. The tool is very easy to use. The collected information is added to the hardware configuration file.

For more information, see Sophos knowledgebase article 110285 .

The following hotkeys are supported in the SafeGuard POA:

■

Shift F3 = USB Legacy Support (on/off)

■

Shift F4 = VESA graphic mode (off/on)

■

Shift F5 = USB 1.x and 2.0 support (off/on)

■

Shift F6 = ATA Controller (off/on)

■

Shift F7 = USB 2.0 support only (off/on)

USB 1.x support remains as set by Shift F5.

■

Shift F9 = ACPI/APIC (off/on)

USB Hotkeys dependency matrix

Shift F3 off on off

Shift F5 off off on

Shift F7 off off off

Legacy on off on

USB 1.x

on on off

USB 2.0

on on off

Comment

3.

Default

1., 2.

185

SafeGuard Enterprise

Shift F3 on off on off on

Shift F5 off on on off on

Shift F7 on on off on on

Legacy off on on on on

USB 1.x

on off off on off

USB 2.0

off off off off off

Comment

1., 2.

3.

2.

1. Shift F5 disables both USB 1.x and USB2.0.

Note: Pressing Shift F5 during startup will considerably reduce the time it takes to launch the

SafeGuard POA. However, be aware that if the computer uses a USB keyboard or USB mouse, they might be disabled when you press Shift F5.

2. If no USB support is active, the SafeGuard POA tries to use BIOS SMM instead of backing up and restoring the USB controller. The Legacy mode may work in this scenario.

3. Legacy support is active, USB is active. The SafeGuard POA tries to back up and restore the

USB controller. The system might hang, depending on the BIOS version used.

You can specify changes that can be carried out using hotkeys when installing SafeGuard

Enterprise encryption software using a .mst file. This is done using the appropriate call in combination with msiexec.

NOVESA

NOLEGACY

ALTERNATE:

NOATA

ACPIAPIC

Defines whether VESA or VGA mode is used: 0 = VESA mode (standard); 1 = VGA mode

Defines whether Legacy Support is activated after SafeGuard POA log on: 0 = Legacy

Support activated; 1 = Legacy Support not activated (standard)

Defines whether USB devices are supported by the SafeGuard POA: 0 = USB support is activated (standard); 1 = no USB support

Defines whether int13 device driver is used: 0 = standard ATA device driver (default);

1 = Int13 device driver

Defines whether ACPI/APIC support is used: 0 = no ACPI/APIC support (default); 1

= ACPI/APIC support active

5.6.2.6 Disabled SafeGuard POA and Lenovo Rescue and Recovery

If the SafeGuard Power-on Authentication is disabled on the computer, the Rescue and Recovery authentication should be enabled to protect against access to encrypted files from the Rescue and Recovery environment.

186

administrator help

For details on activating the Rescue and Recovery authentication, refer to the Lenovo Rescue and Recovery documentation.

5.6.3 Administrative access to Windows endpoints

Note: The following descriptions refer to Windows endpoints protected with SafeGuard Enterprise with SafeGuard Power-on Authentication.

SafeGuard Enterprise uses two types of accounts to enable users to log on to endpoints and carry out administrative tasks after SafeGuard Enterprise has been installed.

■

Service accounts for Windows logon

With service accounts, administrators can log on (Windows logon) to endpoints after the installation of SafeGuard Enterprise without activating the SafeGuard Power-on Authentication and without being added as users to the endpoints. Service accounts lists are defined in the

Policies area of the SafeGuard Management Center and assigned in policies to the endpoint.

Users included on a service account list are treated as guest users when logging on at the endpoint.

Note: Service account lists are assigned to endpoints in policies. They should be assigned in the first SafeGuard Enterprise configuration package you create for the configuration of endpoints.

For further information, see

Service Account Lists for Windows logon

(page 187).

■

POA users for SafeGuard POA logon

POA users are predefined local accounts that enable users to log on (SafeGuard POA logon) to endpoints after the SafeGuard Power-on Authentication has been activated to perform administrative tasks. The accounts are defined in the Users and Computers area of the

SafeGuard Management Center (user ID and password) and assigned to the endpoints by means of POA groups included in configuration packages.

For further information, see

POA users for SafeGuard POA logon

(page 191).

5.6.4 Service Account Lists for Windows logon

Note: Service accounts are only supported for Windows endpoints protected by SafeGuard

Enterprise with SafeGuard Power-on Authentication.

A typical scenario for most implementations is that a rollout team installs new computers in an environment including the installation of SafeGuard Enterprise. For installation or verification reasons, rollout operators may log on to the respective computer before the end user receives the new machine and is able to activate the SafeGuard Power-on Authentication.

Thus, the scenario may be as follows:

1. SafeGuard Enterprise is installed on an endpoint.

2. After restarting the endpoint, the rollout operator logs on.

3. The rollout operator is added to the SafeGuard POA and the POA becomes active. The rollout operator becomes owner of the endpoint.

187

SafeGuard Enterprise

When the end user receives the endpoint, they will not be able to log on to the SafeGuard POA.

The user needs to perform a Challenge/Response procedure.

To prevent that administrative operations on a SafeGuard Enterprise protected endpoint lead to an activation of the SafeGuard Power-on Authentication and the addition of rollout operators as users and machine owners to the endpoint, SafeGuard Enterprise allows you to create service account lists for SafeGuard Enterprise protected endpoints. The users included in these lists are treated as SafeGuard Enterprise guest users.

With service accounts the scenario is as follows:

1. SafeGuard Enterprise is installed on an endpoint.

2. After restarting the endpoint, a rollout operator included on a service account list logs on

(Windows logon).

3. According to the service account list applied to the computer the user is identified as a service account and is treated as a guest user.

The rollout operator is not added to the SafeGuard POA and the POA does not become active.

The rollout operator does not become owner of the endpoint. The end user can log on and activate the SafeGuard POA.

Note: Service account lists are assigned to endpoints in policies. They should be assigned in the first SafeGuard Enterprise configuration package you create for the configuration of endpoints.

5.6.4.1 Create service account lists and add users

1. In the navigation area, click Policies.

2. In the policy navigation window, select Service Account Lists.

3. In the context menu of Service Account Lists, click New > Service account list.

4. Enter a name for the service account list and click OK.

5. Select the new list under Service account lists in the policy navigation window.

6. Right-click in the action area to open the context menu for the service account list. In the context menu, select Add.

A new user line is added.

7. Enter the User Name and the Domain Name in the respective columns and press Enter. To add further users, repeat this step.

8. Save your changes by clicking the Save icon in the toolbar.

The service account list is now registered and can be selected for assignment when creating a policy.

5.6.4.2 Additional information for entering user and domain names

There are different methods for specifying users in service account lists using the two fields User

Name and Domain Name. Restrictions also apply for valid input in these fields.

188

administrator help

Covering different combinations for logging on

The two separate fields User Name and Domain Name per list entry allow you to cover all available combinations for logging on, for example "user@domain" or "domain\user".

To handle several user name/domain name combinations, you can use asterisks (*) as wildcards.

An asterisk is allowed as the first sign, the last sign and the only sign.

For example:

■

User Name: Administrator

■

Domain Name: *

This combination specifies all users with the user name "Administrator" who log on to any network or local machine.

The predefined domain name [LOCALHOST] available in the drop-down list of the Domain Name field stands for the logon on any local computer.

For example:

■

User Name: "*admin"

■

Domain Name: [LOCALHOST]

This combination specifies all users whose user names end on "admin" and who log on to any local machine.

Users may log on in different ways.

For example:

■ user: test, domain: mycompany or

■ user: test, domain: mycompany.com.

As domain specifications in the service account lists are not automatically resolved, there are three possible ways to specify the domain correctly:

■

You know exactly how the user is going to log on and enter the domain accordingly.

■

You create several service account list entries.

■

You use wildcards to cover all the different cases (user: test, domain: mycompany*).

Note: To avoid any problems caused by the fact that Windows may not use the same character sequence, but truncate names, we recommend that you enter the FullQualifiedName and the

NetBIOS name or use wildcards.

189

SafeGuard Enterprise

Restrictions

Asterisks are only allowed as the first sign, the last sign and the only sign. Following are examples for valid and invalid strings using asterisks:

■

Valid strings include admin*, *, *strator, *minis*.

■

Invalid strings include **, Admin*trator, Ad*minst*.

In addition, the following restrictions apply:

■

The character ? is not allowed in user logon names.

■

The characters / \ [ ] : ; | = , + * ? < > " are not allowed in domain names.

5.6.4.3 Edit and delete service account lists

As a security officer with the Modify service account lists right, you can edit or delete service account lists at any time:

■

To edit a service account list, click it in the policy navigation window. The service account list is opened in the action area and you can add, delete or modify user names on the list.

■

To delete a service account list, select it in the policy navigation window, open the context menu and select Delete.

5.6.4.4 Assign a service account list in a policy

1. Create a new policy of the type Authentication or select an existing one.

2. Under Logon Options, select the required service account list from the Service Account

List drop-down list.

Note: The default setting is [No list], this means that no service account list applies. Rollout operators logging on to the endpoint after installation of SafeGuard Enterprise are not treated as guest users and may activate SafeGuard Power-on Authentication and be added to the endpoint. To undo the assignment of a service account list, select the [No list] option.

3. Save your changes by clicking the Save icon in the toolbar.

You can now transfer the policy to the respective endpoints to make the service accounts available on them.

Note: If you select different service account lists in different policies which are all relevant according to the RSOP (Resulting Set of Policies, the settings valid for a specific computer/group), the service account list assigned in the last policy applied overrules all previously assigned service account lists. Service account lists are not merged. To view the RSOP in Users and Computers, you need at least Read Only access rights for the relevant objects.

5.6.4.5 Transfer the policy to the endpoint

The service account list functionality is especially helpful and important during initial installation in the rollout phase of an implementation. We therefore recommend that you transfer the service

190

administrator help account settings to the endpoint immediately after installation. To make the service account list available on the endpoint at this point, include a policy of the type Authentication when you create the initial configuration package for configuring the endpoint after installation.

You can change the service account list settings at any time, create a new policy and transfer it to endpoint.

5.6.4.6 Log on to an endpoint using a service account

At the first Windows logon after restarting the endpoint, a user included on a service account list logs on to the endpoint as a SafeGuard Enterprise guest user. This first Windows logon to the endpoint neither triggers a pending SafeGuard Power-on Authentication nor adds the user to the endpoint. The SafeGuard Enterprise System Tray icon balloon tool tip "Initial user synchronization completed" is not displayed.

Service account status display on the endpoint

The guest user logon status is also available through the System Tray Icon. For further information, see the SafeGuard Enterprise user help, chapter System Tray icon and tool tips (description of the SGN user state field).

5.6.4.7 Log events for service account lists

Actions performed regarding service account lists are reported by the following log events:

SafeGuard Management Center

■

Service account list <name> created

■

■

Service account list <name> modified

Service account list <name> deleted

SafeGuard Enterprise protected endpoint

■

Windows user <domain/user name> logged on at <timestamp> to machine <domain/workstation name> as SGN service account.

■

■

New service account list <name> imported.

Service account list <name> deleted.

5.6.5 POA users for SafeGuard POA logon

Note: POA users are only supported for Windows endpoints protected by SafeGuard Enterprise with SafeGuard Power-on Authentication.

After SafeGuard Enterprise has been installed and the SafeGuard Power-on Authentication (POA) has been activated, access to endpoints to perform administrative tasks may be required. With

POA users, users (for example members of the IT team) can log on at the SafeGuard Power-on

Authentication on endpoints for administrative tasks without having to initiate a Challenge/Response procedure. There is no automatic logon to Windows. The users logging on with POA user accounts log on to Windows with their existing Windows accounts.

191

SafeGuard Enterprise

You can create POA users, group them into POA groups and assign groups to endpoints. The users included in the POA group, are added to the SafeGuard POA and can log on using their predefined user name and password.

Note: To manage POA users and POA groups you need Full access rights for the POA node under Users and Computers.

5.6.5.1 Create POA users

To create POA users, you need Full access rights for the POA node under Users and Computers.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the Users and Computers navigation window under POA, select POA Users.

3. In the context menu of POA Users, click New > Create new user.

The Create new user dialog is displayed.

4. In the Full name field, enter a name (the logon name) for the new POA user.

5. Optionally, enter a description for the new POA user.

6. Enter a password for the new POA user and confirm it.

Note: To enhance security, the password should adhere to certain minimum complexity requirements, for example minimum length of 8 characters, mixture of numerical and alphanumerical characters etc. If the password you have entered is too short, a warning message is displayed.

7. Click OK.

The new POA user is created and displayed under POA Users in the Users and Computers navigation area.

5.6.5.2 Change the password for a POA user

To edit POA users, you need Full access rights for the POA node under Users and Computers.

1. Click Users and Computers in the navigation area of the SafeGuard Management Center.

2. In the Users and Computers navigation window under POA, POA Users, select the relevant

POA user.

3. In the context menu of the POA user, select Properties.

The properties dialog for the POA user is displayed.

4. On the General tab under User Password, enter the new password and confirm it.

5. Click OK.

The new password applies for the relevant POA user.

5.6.5.3 Delete POA users

To delete POA users, you need Full access rights for the POA node under Users and Computers.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the Users and Computers navigation window under POA, POA Users, select the relevant

POA user.

192

administrator help

3. Right-click on the POA user and select Delete from the context menu.

The POA user is deleted. It is no longer displayed in the Users and Computers navigation window.

Note: If the user is part of one or several POA groups, the POA user is also removed from all groups. However, the POA user is still available on the endpoint until the POA group has been unassigned.

5.6.5.4 Create POA groups

To create POA groups, you need Full access rights for the POA node under Users and

Computers.

To assign POA users to endpoints, the accounts must be arranged in groups.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the Users and Computers navigation area under POA, select POA Groups.

3. In the context menu of POA Groups, click New > Create new group.

The Create new group dialog is displayed.

4. In the Full name field, enter a name for the new POA group.

5. Optionally, enter a description.

6. Click OK.

The new POA group is created. It is displayed under POA Groups in the Users and Computers navigation area. You can now add POA users to the POA group.

5.6.5.5 Add users to POA groups

To edit POA groups, you need Full access rights for the POA node under Users and Computers.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the Users and Computers navigation window under POA, POA Groups, select the relevant

POA group.

In the action area of the SafeGuard Management Center on the right-hand side, the Members tab is displayed.

3. In the SafeGuard Management Center toolbar, click the Add icon (green plus sign).

The Select member object dialog is displayed.

4. Select the user you want to add to the group.

5. Click OK.

The POA user is added to the group and displayed in the Members tab.

5.6.5.6 Remove users from POA groups

To edit POA groups, you need Full access rights for the POA node under Users and Computers.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

193

SafeGuard Enterprise

2. In the Users and Computers navigation window under POA, POA Group, select the relevant

POA group.

In the action area of the SafeGuard Management Center on the right-hand side, the Members tab is displayed.

3. Select the user you want to remove from the group.

4. In the SafeGuard Management Center toolbar, click the Remove (Delete) icon (red cross sign).

The user is removed from the group.

5.6.5.7 Assigning POA users to endpoints

Note: To assign POA users to endpoints, the accounts must be arranged in groups.

How you assign and unassign POA users to endpoints depends on the type of endpoint:

■

For managed endpoints, POA groups can be assigned in the POA Group Assignment tab in Users and Computers.

■

For unmanaged endpoints which run in standalone mode and are not connected to the

SafeGuard Enterprise Server, a configuration package with a POA group must be created and deployed.

5.6.5.7.1 Assign POA users to managed endpoints

To assign POA users to managed endpoints, you need Full access or Read only rights for the relevant POA group and Full access rights for the relevant containers.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the Users and Computers navigation window, select the required container.

3. In the action area of the SafeGuard Management Center, select the POA Group Assignment tab.

Under POA Groups on the right-hand side, all available POA groups are displayed.

4. Drag the required POA group from POA Groups into the POA Group Assignment action area.

The POA group’s GroupName and Group DSN are displayed in the work area.

5. Save your changes to the database.

All members of the POA group assigned are deployed to all endpoints in the container selected.

You can unassign a POA group or change the assigned POA group by proceeding as described and dragging groups from and to the action area of the POA Group Assignment tab and the

POA Groups area.

After you have saved your changes in the database, the new assignment applies.

5.6.5.7.2 Assign POA users to unmanaged endpoints

To assign POA users to unmanaged endpoints, you need Read only or Full access rights for the relevant POA group.

194

administrator help

POA users are assigned to unmanaged endpoints (operating in standalone mode) in configuration packages.

1. In the SafeGuard Management Center, select Configuration Package Tool from the Tools menu.

2. Select an existing configuration package or create a new one.

3. Specify a POA Group created beforehand in the Users and Computers area of the SafeGuard

Management Center, to be applied to the endpoints.

A no list group is available for selection by default. This group can be used to delete a POA group assignment on endpoints.

4. Specify an output path for the configuration package.

5. Click Create Configuration Package.

6. Deploy the configuration package to the endpoints.

By installing the configuration package, the users included in the group are added to the SafeGuard

POA on the endpoints. The POA users are available for POA logon.

Note: When you upgrade unmanaged endpoints to managed, the POA users remain active, if they have also been assigned in the SafeGuard Management Center. The passwords set in the

POA groups deployed in configuration packages are set to the ones specified in the SafeGuard

Management Center. Passwords changed using F8 are overwritten.

5.6.5.7.3 Unassign POA users from unmanaged endpoints

POA users can be deleted from unmanaged endpoints by assigning an empty POA group:

1. In the SafeGuard Management Center, select the Configuration Package Tool from the

Tools menu.

2. Select an existing configuration package or create a new one.

3. Specify an empty POA Group created beforehand in the Users and Computers area of the

SafeGuard Management Center, or select the no list POA group that is available by default in the Configuration Package Tool.

4. Specify an output path for the configuration package.

5. Click Create Configuration Package.

6. Deploy the configuration package to the endpoints.

By installing the configuration package, all POA users are removed from the endpoints, so all relevant POA users are removed from the SafeGuard POA.

5.6.5.7.4 Change POA users assignments on unmanaged endpoints

1. Create a new POA group or modify an existing one.

2. Create a new configuration package and select the new or modified POA group.

3. Deploy the new configuration package to the endpoint.

The new POA group is available on the endpoint and all POA users included are added to the

POA. The new group overwrites the old one. POA groups are not merged.

5.6.5.8 Log on to an endpoint with a POA user

1. Switch on the endpoint.

The SafeGuard Power-on Authentication logon dialog is displayed.

195

SafeGuard Enterprise

2. Enter the User name and the Password of the predefined POA user.

You are not automatically logged on to Windows. The Windows logon dialog is displayed.

3. In the Domain field, select the domain <POA>.

4. Log on to Windows using your existing Windows user account.

5.6.5.8.1 Local password change

If the password of a POA user has been changed with F8, the change is not synchronized with other endpoints. The administrator must change the password for this user centrally.

5.6.6 User Machine Assignment

SafeGuard Enterprise manages the information about the users who are allowed to log on to a particular machine in a list which is referred to as the User Machine Assignment (UMA).

For a user to be included in the UMA, they must have logged on once to a computer on which

SafeGuard Enterprise has been installed and be registered in the SafeGuard Management Center as a "full" user in terms of SafeGuard Enterprise. A "full" user is one for whom a certificate has been generated after the first logon and for whom a key ring has been created. Only then can this user data be replicated on other computers. After replication, the user can log on to this computer at the SafeGuard POA.

If the default setting applies, the first user to log on to the computer after the installation of

SafeGuard Enterprise is entered as the owner of that computer in the UMA.

This attribute allows the user, after they have authenticated at SafeGuard Power-on Authentication,

to enable other users to log on to that computer (see Register further SafeGuard Enterprise users

(page 180)). They will also be added to the UMA for this computer.

An automatic list is generated which determines which user is allowed to log on to which computer.

This list can be edited in the SafeGuard Management Center.

5.6.6.1 User Machine Assignment in the SafeGuard Management Center

Users can be allocated to specific computers in the SafeGuard Management Center. If a user is assigned to a computer in the SafeGuard Management Center (or vice versa) this allocation is incorporated into the UMA. The user data (certificate, key, etc.) is replicated on this computer and the user can log on to this computer. When a user is removed from the UMA, all user data is automatically deleted from the SafeGuard POA. The user can no longer log on at the SafeGuard

POA with their user name and password.

Note: In Users and Computers, to view the assignment of users and computers you need at least Read only access rights for one of the objects (user or computer) involved. To define or change the assignment, you need Full access rights for both of the objects involved. The UMA display showing available users/machines is filtered according to your access rights. In the UMA grid display, which shows the users assigned to computers and vice versa, objects for which you do not have the required access rights are shown for your information, but the assignment cannot be modified.

When you assign a user to a computer, you can also specify who can allow other users to log on to this computer.

196

administrator help

Under Type the SafeGuard Management Center indicates how the user was added to the

SafeGuard Enterprise Database. Adopted means that the user has been added to the UMA on an endpoint.

Note: If no one is assigned in the SafeGuard Management Center and no user is specified as the owner, the first user to log on after the installation of SafeGuard Enterprise on the computer

is entered as the owner. This user can allow further users to log on to this computer, see Register further SafeGuard Enterprise users (page 180). If users are assigned to this computer in the

SafeGuard Management Center at a later date, they can log on at the SafeGuard Power-on

Authentication. Nevertheless, such users must be full users (with existing certificate and key).

The owner of the computer does not need to assign access entitlements in this case.

The following settings are used to specify who is allowed to add users to the UMA:

■

Can Become Owner: If this setting is selected, the user can be registered as the owner of a computer.

■

User is Owner: This setting means that this user is entered in the UMA as the owner. Only one user per computer can be entered in the UMA as the owner.

The Allow registration of new SGN users for policy setting in policies of the type Specific

Machine Settings determines who is allowed to add further users to the UMA. The Enable

registration of SGN Windows users setting in Specific Machine Settings policies determines whether SGN Windows users may be registered on the endpoint and added to the UMA.

■

Allow registration of new SGN users for

Nobody

Even the user entered as the owner cannot add more users to the UMA. The option for an owner to add further users is deactivated.

Owner (default setting)

Note: A security officer can always add users in the SafeGuard Management Center.

Everybody

Lifts the restriction that users may only be added by the owner.

Note: For endpoints that do not have the Device Encryption module installed the Allow

registration of new SGN users for setting must be set to Everybody if it should be possible on the endpoint to add more than one user to the UMA with access to their key ring. Otherwise users can only be added in the Management Center. This setting is only evaluated on managed endpoints. For more information, see Sophos knowledgebase article 110659 .

■

Enable registration of SGN Windows users

If you select Yes, SGN Windows users can be registered on the endpoint. An SGN Windows user is not added to the SafeGuard POA, but has a key ring for accessing encrypted files, just as an SGN user. If you select this setting, all users, that would have otherwise become SGN guest users, will become SGN Windows users. The users are added to the UMA as soon as they have logged on to Windows. SGN Windows users can be removed from the UMA automatically on managed endpoints and manually on unmanaged endpoints. For further information, see

Specific machine settings - basic settings

(page 375).

Example:

197

SafeGuard Enterprise

The following example shows how you can assign logon entitlements in the SafeGuard

Management Center to just three users (User_a, User_b, User_c) for Computer_ABC.

First: Specify the response you require in the SafeGuard Management Center. SafeGuard

Enterprise is installed on all endpoints during the night. In the morning, the users should be able to log on to the computer with their credentials.

1. In the SafeGuard Management Center, assign User_a, User_b and User_c to Computer_ABC.

(Users and Computers -> Select computer_ABC -> Assign user by drag-and-drop). By doing this, you have specified a UMA.

2. In a policy of the type Specific Machine Settings, set Allow registration of new SGN users

for to Nobody. Since User_a, User_b and User_c are not allowed to add new users is not necessary to specify a user as an owner.

3. Assign the policy to the computer and/or to a point within the directory structure at which it will be active for the computer.

When the first user logs on to Computer_ABC, an autologon is implemented for the SafeGuard

POA. The computer policies are sent to the endpoint. Since User_a is included in the UMA and will become a full user when logging on to Windows. The user's policies, certificates and keys are sent to the endpoint. The SafeGuard POA is activated.

Note: The user can check the status message in the SafeGuard System Tray Icon (balloon tool tip) when this process has completed.

User_a is now a full user in terms of SafeGuard Enterprise and after the first logon can authenticate at the SafeGuard POA and is automatically logged on.

User_a now leaves the computer and User_b wants to log on. As the SafeGuard POA is activated, there is no more autologon.

User_b and User_c have two options for gaining access to this computer.

■

User_a deactivates the Pass through to Windows option in the SafeGuard POA logon dialog and logs on.

■

User_b uses Challenge/Response to log on at the SafeGuard POA.

In both cases, the Windows logon dialog is displayed.

User_b can enter their Windows credentials. The user's policies, certificates and keys are sent to the endpoint. The user is activated in the SafeGuard POA. User_b is now a full user in terms of SafeGuard Enterprise and after the first logon can authenticate themselves at the SafeGuard

POA and will be automatically logged on.

While the computer policy specifies that no one can import users to this computer, since these users are already in the UMA, User_b and User_c nevertheless gain "full" user status at the

Windows logon and are activated in the SafeGuard POA.

No other users will be added to the UMA or will ever be able to authenticate themselves at the

SafeGuard Power-on Authentication. Any users logging on to Windows who are not User_a,

User_b or User_c are excluded from the UMA in this scenario and will never be active in the

SafeGuard POA.

Users can always be added later on in the SafeGuard Management Center. However, their key ring will not be available after the first logon as synchronization will only be triggered by this first logon. After logging on again, the key ring will be available and the users can access their

198

administrator help computers according to policies applying. If they have never successfully logged on to an endpoint, they can be added as described above.

Note: If the last valid user certificate is removed from the UMA by an SO or MSO, any user can pass the SafeGuard POA of the corresponding computer. The same applies if the domain of the endpoint changes. Then only Windows credentials are necessary to log on to the computer, to reactivate the SafeGuard POA and to be added as the new owner.

5.6.6.1.1 Block User

If you select the check box in the Block User column, the user is no longer allowed to log on to the relevant computer. If the relevant user is logged on when the policy with this setting becomes active on the computer, the user is logged off.

5.6.6.1.2 Groups

In the SafeGuard Management Center, computer groups can be assigned to a user (account) and/or user groups can be assigned to a computer.

To create a group: In Users and Computers, right-click the relevant object node where you want to create the group and select New, Create new group. In Create new group, in Full name, enter the name of the group and optionally a description. Click OK.

Example: Maintenance account

It is for example possible to use a single maintenance account to service a large number of computers. For this purpose the computers concerned must be in a single group. This group is then assigned to a maintenance account (user). The owner of the maintenance account can log on to all computers within this group

Also, by assigning a group containing different users, these users can log on to a specific computer in a single step.

5.6.6.2 Assignment of user and computer groups

In Users and Computers, to view the assignment of user and computer groups you need at least

Read only access rights for one of the objects (user or computer group) involved. To define or change the assignment, you need Full access rights for both of the objects involved. The UMA display showing available users/machines is filtered according to your access rights.

Note: You can assign individual users to a computer or vice versa using the same process as for groups.

1. Click Users and Computers.

2. To assign a group of computers to single user, select the user.

3. Click the Computer tab in the action area.

All computers and computer groups are displayed under Available computers.

4. Drag the selected groups from the Available Groups list into the action area.

5. A dialog is displayed asking whether the user should be the owner of all computers.

If there is no specified owner in the SafeGuard Management Center, the first user to log on to this computer is automatically entered as the owner. The user is the entitled to allow other users to access this computer. The condition is that the user Can Become Owner.

■

If you answer Yes, the first user to log on to this computer becomes the owner and can allow access to other users.

199

SafeGuard Enterprise

■

If you answer No, the user is not the owner of this computer.

It is not generally necessary for a service account owner to be the owner of the computer. This setting can be changed after initial assignment.

All computers from the assigned group are displayed in the action area.

The user can log on to all computers assigned in this way.

A user group can be assigned to a single computer in the same way.

5.6.7 Secure Wake on LAN (WOL)

In the SafeGuard Management Center, you can define policy settings for Secure Wake on LAN

(WOL) to prepare endpoints for software rollouts. If a relevant policy applies to endpoints, the necessary parameters (for example SafeGuard POA deactivation and a time interval for Wake on LAN) are transferred directly to the endpoints where parameters are analyzed.

The rollout team can design a scheduling script using the commands provided to guarantee maximum endpoint protection despite the deactivation of the SafeGuard POA.

Note: Deactivating the SafeGuard POA - even for a limited number of boot processes - reduces the security of your system!

You define the settings for Secure Wake on LAN (WOL) in a policy of the type Specific Machine

Settings.

5.6.7.1 Secure Wake on LAN example

The software rollout team informs the SafeGuard Enterprise security officer about a software rollout planned for September 25th, 2014 between 03:00 and 06:00 am. Two reboots are required.

The local software rollout agent must be able to log on to Windows.

In the SafeGuard Management Center, the security officer creates a policy of the type Specific

Machine Settings with the following settings and assigns it to the relevant endpoints.

Policy Setting

Number of auto logons (0 = no WOL)

Windows logon allowed during WOL

Start of time slot for external WOL Start

End of time slot for external WOL Start

Value

5

Yes

24th Sept., 2014, 12:00

25th Sept., 2014, 06:00

For further information on the individual settings, see

Specific machine settings - basic settings

(page 375).

As the number of autologons is set to 5, the endpoint starts 5 times without authentication through the SafeGuard POA.

200

administrator help

Note: For Wake on LAN, we recommend that you allow three more restarts than necessary to overcome any unforeseen problems.

The security officer sets the time interval to 12 o'clock midday on the day before the software rollout. In this way, the scheduling script SGMCMDIntn.exe is started in time and WOL starts no later than the 25th September at 3:00 am.

The software rollout team creates two commands for the scheduling script:

■

Starting 24th Sept.2014, 12:15 am, SGMCMDIntn.exe -WOLstart

■

Starting 26th Sept.2014, 09.00 am SGMCMDIntn.exe -WOLstop

The software rollout script is dated 25.09.2014, 03:00. WOL can be explicitly deactivated again at the end of the script by using SGMCMDIntn.exe -WOLstop.

All endpoints which log on before the 24th of September 2014 and which connect to the rollout servers will receive the new policy and the scheduling commands.

Any endpoint on which the schedule triggers the command SGMCMDIntn -WOLstart between

24th Sept. 2014, 12:00 midday and 26th Sept. 2014, 09:00 am falls within the WOL time interval and therefore Wake on LAN will be activated.

5.6.8 Recovery options

For recovery, SafeGuard Enterprise offers different options that are tailored to different scenarios:

■

Logon recovery with Local Self Help

Local Self Help enables users who have forgotten their password to log on to their computers without the assistance of a helpdesk. Even in situations where neither telephone nor network connections are available (for example aboard an aircraft), users can regain access to their computers. To log on, they answer a predefined number of questions in the SafeGuard

Power-on Authentication.

Local Self Help reduces the number of calls concerning logon recovery, thus freeing the helpdesk staff from routine tasks and allowing them to concentrate on more complex support requests.

For further information, see

Recovery with Local Self Help

(page 202).

■

Recovery with Challenge/Response

The Challenge/Response recovery mechanism is a secure and efficient recovery system that helps users who cannot log on to their computers or access encrypted data. During the

Challenge/Response procedure, the user provides a challenge code generated on the endpoint to the helpdesk officer who in turn generates a response code that authorizes the user to perform a specific action on the computer.

With recovery with Challenge/Response, SafeGuard Enterprise offers different workflows for typical recovery scenarios requiring helpdesk assistance.

For further information, see

Recovery with Challenge/Response

(page 206).

■

System recovery for SafeGuard Full Disk Encryption

201

SafeGuard Enterprise

SafeGuard Enterprise offers different methods and tools for recovery from problems with crucial system components and SafeGuard Enterprise components, for example:

■

Corrupted MBR

■

SafeGuard Enterprise kernel problems

■

Volume access problems

■

Windows boot problems

For further information, see

System Recovery for SafeGuard Full Disk Encryption (page 221).

5.6.8.1 Recovery with Local Self Help

Note: Local Self Help is only available for Windows 7 endpoints with SafeGuard Power-on

Authentication (POA).

SafeGuard Enterprise offers Local Self Help to enable users who have forgotten their password to log on to their computers without the assistance of the help desk. Local Self Help reduces the number of calls concerning logon recovery, thus freeing the help desk staff from routine tasks and allowing them to concentrate on more complex support requests.

With Local Self Help, users can, for example, regain access to their laptops in situations where neither telephone nor network connections are available and where they cannot use a

Challenge/Response procedure (for example, aboard an aircraft). Users can log on to their computer by answering a predefined number of questions in the SafeGuard Power-on

Authentication.

As a security officer, you can define the set of questions to be answered centrally and distribute it to the endpoints in a policy. We provide you with a predefined question theme as a template.

You can use this question theme as it is or modify it. In the relevant policy, you can also grant the users the right to define their own questions.

When Local Self Help has been enabled by the policy, a Local Self Help Wizard is available to guide the end users through providing initial answers and editing the questions.

For a detailed description of Local Self Help on the endpoint see the SafeGuard Enterprise user

help, chapter Recovery with Local Self Help.

5.6.8.1.1 Define Local Self Help settings in a policy

You define the settings for Local Self Help in a policy of the type General Settings under Logon

Recovery - Local Self Help. This is where you enable the function to be used on the endpoints and define further rights and parameters.

Enabling Local Self Help

To activate Local Self Help for use on endpoints, select Yes in the Enable Local Self Help field.

After the policy has become effective on the endpoints, this setting entitles the users to use Local

Self Help for logon recovery. To be able to use Local Self Help, the users now have to activate this recovery method by answering a specified number of questions from the set of questions received or by creating and answering their own questions, depending on permission.

202

administrator help

For this purpose, the Local Self Help Wizard is available from the System Tray Icon in the Windows taskbar after the computer has received the policy and been restarted.

Configuring Local Self Help

You can set the following options for Local Self Help in a policy of the type General Settings:

■

Minimal length of answers

Define the minimum length of the answers in characters. The default is 1.

■

Welcome text under Windows

You can specify the individual information text to be displayed in the first dialog when the Local

Self Help Wizard is launched on the endpoint. Before you specify the text here, it has to be created and registered.

■

Users can define their own questions

There are the following possible scenarios for the definition of questions for Local Self Help:

■

As a security officer, you define the questions and distribute them to the users. The users are not permitted to define their own questions.

■

■

As a security officer, you define the questions and distribute them to the users. In addition, the users are permitted to define their own questions. When answering the minimum number of questions required for activating Local Self Help, the users can choose between predefined questions and their own questions or use a combination of both.

You entitle the users to define their own questions. The users activate Local Self Help on their computers by defining and answering their own questions.

To entitle users to define their own questions, select Yes in the Users can define their own

questions field.

5.6.8.1.2 Define questions

To be able to use Local Self Help on the endpoint, the user has to answer and save a predefined number of questions. As a security officer with the required rights, you can specify how many questions the user has to answer to activate Local Self Help on the endpoint.You can also specify how many questions will be selected randomly in the SafeGuard POA. To log on at the SafeGuard

POA with Local Self Help, the user has to answer all questions displayed in the POA correctly.

As a security officer with the required rights, you can register and edit Local Self Help questions in the SafeGuard Management Center.

Note:

Not all characters that can be entered in Windows can be handled by the SafeGuard POA, for example Hebrew or Arabic characters cannot be used.

5.6.8.1.3 Define the number of questions to be answered

You can define the number of questions to be answered during Local Self Help configuration and in the SafeGuard POA.

1. In the Policies navigation area, select Local Self Help questions.

203

SafeGuard Enterprise

2. In the action area under Local Self Help parameters, you can specify two different values for the number of Local Self Help questions: a) In the Minimum number of available questions/answers field, specify the number of questions the user has to answer in the Local Self Help Wizard to activate Local Self Help on the endpoint.

The number of questions specified in this field must be available with answers on the endpoint for Local Self Help to be active.

b) In the Number of questions presented in POA field, specify the number of questions the user has to answer in the SafeGuard POA when logging on with Local Self Help.

The questions displayed in the SafeGuard POA are selected randomly from the questions the user has answered in the Local Self Help Wizard.

The number specified in Minimum number of available questions/answers field must be higher than the number specified in Number of questions presented in POA field. If this is not the case, an error message is displayed when you save your changes.

The defaults are:

■

Minimum number of available questions/answers: 10

■

Number of questions presented in POA: 5

3. Save your changes to the database.

The number of questions applies to the Local Self Help configuration deployed to endpoints.

5.6.8.1.4 Use the template

A predefined question theme is available for Local Self Help. You find this question theme in the

SafeGuard Management Center under Local Self Help questions.

You can use the predefined question theme as it is, edit it or delete it.

5.6.8.1.5 Import question themes

Using the import procedure, you can import your own question lists created as .XML files.

1. Create a new question theme (see

Create a new question theme and add questions

(page

204)).

2. In the Policies navigation area, select the new question theme under Local Self Help

questions.

3. Right-click in the action area to open the context menu for the question theme. In the context menu, select Import.

4. Select the required directory and question theme and click Open.

The imported questions are displayed in the action area. You can now save the question theme as it is or edit it.

5.6.8.1.6 Create a new question theme and add questions

You can create new question themes covering different topics, to provide users with several different question themes to suite their preferences.

1. In the Policies navigation area, select Local Self Help questions.

204

administrator help

2. Right-click Local Self Help questions and select New > Question Theme.

3. Enter a name for the question theme and click OK.

4. In the Policies navigation area, select the new question theme under Local Self Help

questions.

5. Right-click in the action area to open the context menu for the question theme. In the context menu, select Add.

A new question line is added.

6. Enter your question and press Enter. To add further questions, repeat this step.

7. To save your changes, click the Save icon in the toolbar.

Your question theme is registered. It is automatically transferred with the policy of the type General

Settings that enables Local Self Help on the endpoints.

5.6.8.1.7 Edit question themes

1. In the Policies navigation area, select the required question theme under Local Self Help

questions.

2. You can now add, modify or delete questions.

■

To add questions, right-click in the action area, to display the context menu. In the context menu, click Add. A new line is added to the question list. Enter your question on the line.

■

To modify questions, click the required question text in the action area. The question is marked by a pencil icon. Enter your changes on the question line.

■

To delete questions, select the required question by clicking on the grey box at the beginning of the question line in the action area and click Remove in the context menu of the question.

3. To save your changes, click the Save icon in the toolbar.

The modified question theme is registered. It is transferred with the policy of the type General

Settings that enables Local Self Help on the endpoints.

5.6.8.1.8 Delete question themes

To delete an entire question theme, right-click the required theme under Local Self Help questions in the Policies navigation area, and select Delete.

Note: If you delete a question theme after users have answered some of these questions to activate Local Self Help on their computers, the users’ answers become invalid, as the questions no longer exist.

5.6.8.1.9 Register welcome texts

You can register a welcome text to be displayed in the first dialog of the Local Self Help Wizard.

The text files containing the required information have to be created before registering them in the SafeGuard Management Center. The maximum file size for information texts is 50 KB.

SafeGuard Enterprise only uses Unicode UTF-16 coded texts. If you do not create the text files in this format, they will be automatically converted when they are registered.

1. In the Policies navigation area, right-click Texts and select New > Text.

2. Enter a name for the text to be displayed in the Text item name field.

205

SafeGuard Enterprise

3. Click [...] to select the text file previously created. If the file needs to be converted, a message is displayed.

4. Click OK.

The new text item is displayed as a subnode below Texts in the Policies navigation area. If you select a text item, its contents are displayed in the window on the right-hand side. The text item can now be selected when creating policies.

Proceed as described to register further text items. All registered text items are shown as subnodes.

5.6.8.2 Recovery with Challenge/Response

To smoothen the workflow and to reduce helpdesk costs, SafeGuard Enterprise provides a

Challenge/Response recovery solution. SafeGuard Enterprise offers help to users who fail to log on or to access encrypted data by providing a user-friendly Challenge/Response mechanism.

This functionality is integrated in the SafeGuard Management Center as a Recovery Wizard.

Benefits of Challenge/Response

The Challenge/Response mechanism is a secure and efficient recovery system to fall back on.

■

No confidential data is exchanged in unencrypted form throughout the entire process.

■

There is no point in third parties eavesdropping on this procedure because the data they spy out cannot be used at any later point in time or on any other devices.

■

The computer to be accessed does not need an online network connection. The Response

Code Wizard for the helpdesk also runs on an unmanaged endpoint without any SafeGuard

Enterprise Server connection. There is no need for a complex infrastructure.

■

The user can start working again quickly. No encrypted data is lost just because the password has been forgotten.

Typical situations requiring helpdesk assistance

■

A user has forgotten the password for logging on and the computer has been locked.

■

A user has forgotten or lost the token/smartcard.

■

The SafeGuard Power-on Authentication local cache is partly damaged.

■

A user is not available at the moment due to illness or vacation but the data on the computer must be accessible to a colleague.

■

A user wants to access a volume encrypted with a key that is not available on the computer.

SafeGuard Enterprise offers different recovery workflows for these typical scenarios enabling the users to access their computers again.

206

administrator help

5.6.8.2.1 Challenge/Response workflow

The Challenge/Response procedure is based on two components:

■

The endpoint on which the Challenge code is generated.

■

The SafeGuard Management Center where, as a helpdesk officer with sufficient rights, you create a response code that authorizes the user to perform the requested action on their computer.

Note: For a Challenge/Response process, you need Full access rights for the computers/users involved.

1. On the endpoint, the user requests the challenge code. Depending on the recovery type, this is either requested in the SafeGuard Power-on Authentication or in the KeyRecovery Tool.

A challenge code in form of an ASCII character string is generated and displayed.

2. The user contacts the helpdesk and provides them with the necessary identification and the challenge code.

3. The helpdesk launches the Recovery Wizard in the SafeGuard Management Center.

4. The helpdesk selects the appropriate recovery type, confirms the identification information and the challenge code and selects the required recovery action.

A response code in form of an ASCII character string is generated and displayed.

5. The helpdesk provides the user with the response code, for example by phone or text message.

6. The user enters the response code. Depending on the recovery type, this is either done in the

SafeGuard POA or in the KeyRecovery Tool.

The user is then permitted to perform the authorized action, for example resetting the password, and can resume working.

5.6.8.2.2 User password change requirements

As part of the SafeGuard Enterprise recovery process users may be forced to change their

Windows passwords. The following table provides details on when changing the password will be required. The first four columns show specific conditions which can occur during the

Challenge/Response procedure. The last column indicates whether the user is forced to change the Windows password based on the conditions indicated in the previous columns.

Condition: C/R issued with user logon and show password option

Yes

Yes

Yes

No

Condition: C/R issued with user logon

Yes

Yes

Yes

Yes

Condition: Domain controller available

Condition: Show password option declined by user

Result: User is forced to change

Windows password

Yes

Yes

No

Yes

No

Yes

Yes n/a

No

Yes

No

Yes

207

SafeGuard Enterprise

Condition: C/R issued with user logon and show password option

No

No

Condition: C/R issued with user logon

Yes

No

Condition: Domain controller available

Condition: Show password option declined by user

Result: User is forced to change

Windows password

No

No n/a n/a

No

No

5.6.8.2.3 Launch the Recovery Wizard

To be able to perform a recovery procedure, make sure you have the required rights and permissions.

1. Log on to the SafeGuard Management Center.

2. Click Tools > Recovery in the menu bar.

The Recovery Wizard is started. You can select which type of recovery you want to use.

5.6.8.2.4 Recovery types

Select which type of recovery you want to use. The following recovery types are provided:

■

SafeGuard Enterprise Clients (managed)

Challenge/Response for endpoints that are centrally managed by the SafeGuard Management

Center. They are listed in the Users and Computers area in the SafeGuard Management

Center.

■

Virtual Clients

For complex recovery situations, for example when the SafeGuard POA is corrupted, access to encrypted data can easily be regained with Challenge/Response. Specific files called Virtual

Clients are used in this case. This type is available for managed and unmanaged endpoints.

■

Sophos SafeGuard Clients (standalone)

Challenge/Response for unmanaged endpoints. They never have any connection to the

SafeGuard Enterprise Server. The required recovery information is based on the key recovery file. On each endpoint this file is generated during deployment of the Sophos SafeGuard encryption software. To provide Challenge/Response in this case, the key recovery file must be accessible to the SafeGuard Enterprise helpdesk, for example on a shared network path.

Note: Also see the logon recovery method Local Self Help that does not require any helpdesk assistance.

5.6.8.2.5 Challenge/Response for SafeGuard Enterprise Clients (managed)

SafeGuard Enterprise offers recovery for SafeGuard Enterprise protected endpoints registered in the database in various recovery scenarios, for example password recovery.

Challenge/Response is supported for both SafeGuard Enterprise native endpoints and BitLocker encrypted endpoints. The system dynamically determines which type of computer is in use. The recovery workflow is adjusted accordingly.

208

administrator help

5.6.8.2.5.1 Recovery actions for SafeGuard Enterprise Clients

The recovery workflow depends on the type of endpoint that recovery is requested for.

Note: For BitLocker encrypted computers the only recovery action is to recover the key used to encrypt a specific volume. No password recovery is provided.

5.6.8.2.5.1.1

Best practice for recovering the password at SafeGuard POA level

We recommend that you use the following methods when the user has forgotten their password to avoid that the password has to be centrally reset:

■

Use Local Self Help.

With recovery with Local Self Help the user can have the current password displayed and may continue using this password without having to reset it and without any helpdesk assistance.

■

When using Challenge/Response on SafeGuard Enterprise Clients (managed):

We recommend that you avoid to reset the password in the Active Directory before the

Challenge/Response procedure. Avoiding this ensures that the password remains synchronized between Windows and SafeGuard Enterprise. Make sure that the Windows helpdesk is educated accordingly.

As a SafeGuard Enterprise helpdesk officer, generate a response for Boot SGN client with user

logon with the Display user password option. This is useful as the password does not have to be reset in the Active Directory. The user can continue working with the old password and change it locally afterwards.

5.6.8.2.5.1.2

Recover the password at SafeGuard POA level

One of the most common scenarios is that users have forgotten their password. By default,

SafeGuard Enterprise is installed with an activated SafeGuard Power-on Authentication (POA).

The SafeGuard POA password for accessing the computer is the same as the Windows password.

If the user has forgotten the password at SafeGuard POA level, the SafeGuard Enterprise helpdesk officer will generate a response for Boot SGN client with user logon, but without displaying the user password. However, in this case, after entering the response code the computer will boot into the operating system. The user has to change the password at Windows level provided that the domain is accessible. The user can then log on to Windows as well as to the SafeGuard

Power-on Authentication with the new password.

5.6.8.2.5.1.3

Display the user password

SafeGuard Enterprise offers users to have their password displayed during Challenge/Response.

This is useful as the password does not have to be reset in the Active Directory. The option is only available if Boot SGN client with user logon is requested.

5.6.8.2.5.1.4

A different user needs to start the SafeGuard Enterprise protected endpoint

In this case, the user who needs to access the endpoint starts it and enters their user name. The user then requests a Challenge. The SafeGuard helpdesk generates a Response of the type

Booting SGN client without user logon and Passthrough to Windows enabled. The user is logged on and can use the computer.

5.6.8.2.5.1.5

Restore the SafeGuard Enterprise policy cache

209

SafeGuard Enterprise

This procedure is necessary, if the SafeGuard policy cache is damaged. The local cache stores all keys, policies, user certificates and audit files. By default, logon recovery is deactivated when the local cache is corrupted. It is restored automatically from its backup. In this case, no

Challenge/Response procedure is required for repairing the local cache. If the local cache is to be repaired by using a Challenge/Response procedure, logon recovery can be activated by policy.

In this case, the user is automatically prompted to initiate a Challenge/Response procedure, if the local cache is corrupted.

5.6.8.2.5.1.6

SafeGuard Data Exchange: Recover a forgotten password

SafeGuard Data Exchange without Device Encryption does not provide Challenge/Response recovery, when the user has forgotten their password. In this case, you must change the password in the Active Directory. Log on to the endpoint without a Sophos Credential Provider and restore the user configuration on the endpoint.

5.6.8.2.5.2 Response for SafeGuard Enterprise Clients

1. On the Recovery type page, select SafeGuard Enterprise Client (managed).

2. Under Domain, select the required domain from the list.

3. Under Computer enter or select the required computer name. There are several ways to do so:

■

To select a name, click [...]. Then click Find now. A list of computers is displayed. Select the required computer and click OK. The computer name is displayed on the Recovery

type page.

■

Type the short name of the computer directly into the field. When you click Next, the database is searched for this name. If it is found, the distinguished computer name is displayed.

■

Enter the computer name directly in the distinguished name format, for example:

CN=Desktop1,OU=Development,OU=Headquarter,DC=Sophos,DC=edu

4. Click Next.

5. Select the domain of the user.

6. Enter the required user name. There are several possibilities to do so:

■

To select the user name click [...] in the User information section of the Logon recovery page. Then click Find now. A list of users is displayed. Select the required name and click

OK. The user name is displayed on the Recovery type page.

■

Enter the name of the user directly. Make sure the name is spelled correctly.

7. Click Next.

A page is displayed where you can enter the challenge code.

8. Enter the challenge code the user has passed on to you and click Next. The challenge code is verified. If the code has been entered incorrectly, Invalid challenge is displayed below the block containing the error.

210

administrator help

9. If the challenge code has been entered correctly, the recovery action requested by the

SafeGuard Enterprise Client and the possible recovery actions on the client are displayed.

The possible actions for response depend on the actions requested on the client side when calling the challenge. For example, if Crypto token requested is required on the client side, the available actions for response are Boot SGN client with user logon and Boot SGN client

without user logon.

10. Select the action the user needs to perform.

11. If Boot SGN client with user logon has been selected, you can additionally select Show

user password to have the password displayed on the target computer.

12. Click Next.

13. A response code is generated. Provide the response code to the user. A spelling aid is provided.

You can also copy the response code to the clipboard.

The user can enter the response code on the endpoint and perform the authorized action.

5.6.8.2.6 Challenge/Response using Virtual Clients

With Virtual Client recovery SafeGuard Enterprise offers recovery of encrypted volumes even in complex disaster situations, for example when the SafeGuard POA is corrupted. It can be applied to managed endpoints as well as to unmanaged endpoint.

Note: Virtual Client recovery should only be used to resolve complex disaster situations. If for example only a key is missing to recover a volume, the best way to recover the volume would simply be to assign the missing key to the respective user’s key ring.

5.6.8.2.6.1 Recovery workflow using Virtual Clients

To access the encrypted endpoint, the following general workflow applies:

1. Obtain the SafeGuard Enterprise recovery disk from technical support.

The helpdesk may download the Windows PE recovery disk with the latest SafeGuard Enterprise filter drivers from the Sophos support site. For more information, see Sophos knowledgebase article 108805 .

2. Create the Virtual Client in the SafeGuard Management Center, see

Create Virtual Clients

(page 228).

3. Export the Virtual Client to a file, see

Export Virtual Clients

(page 228).

4. Optionally, export several Virtual Client keys to a file, see Create and export key files for Virtual

Client recovery (page 229).

5. Boot the endpoint from the recovery disk.

6. Import the Virtual Client file into the KeyRecovery Tool.

7. Initiate the Challenge in the KeyRecovery Tool.

8. Confirm the Virtual Client in the SafeGuard Management Center.

9. Select the required recovery action.

10. Enter the challenge code in the SafeGuard Management Center.

11. Generate the response code in the SafeGuard Management Center.

12. Enter the response code into the KeyRecovery tool.

The computer can be accessed again.

211

SafeGuard Enterprise

5.6.8.2.6.2 Boot the computer from the recovery disk

Prerequisite: Make sure that the boot sequence in the BIOS settings allows booting from CD.

1. Obtain the SafeGuard Enterprise Windows PE disk from Sophos technical support.

The helpdesk may download the Windows PE recovery disk with the latest SafeGuard Enterprise filter drivers from the Sophos support site. For more information, see Sophos knowledgebase article 108805 .

2. On the endpoint, insert the recovery disk and start the computer. The integrated file manager opens. At a glance, you can see the mounted volumes and drives.

212

The contents of the encrypted drive are not visible in the file manager. Neither the file system, nor the capacity and used/free space are indicated in the properties of the encrypted drive.

administrator help

3. At the bottom of the file manager in the Quick Launch section, click the KeyRecovery icon to open the KeyRecovery Tool. The Key Recovery Tool displays the key ID of the encrypted drives.

4. Find the key ID of the drives that you need to access. The key ID will be requested later on.

Next import the Virtual Client into the Key Recovery Tool.

5.6.8.2.6.3 Import the Virtual Client into the KeyRecovery Tool

Prerequisite:

■

The computer has been booted from the recovery disk.

■

Ensure that the USB drive with the Virtual Client file

recoverytoken.tok

stored on it has been mounted successfully.

1. In the Windows PE file manager, select the drive on which the Virtual Client is stored. The file recoverytoken.tok is displayed on the right.

213

SafeGuard Enterprise

2. Select the file recoverytoken.tok and drag it to the drive in which the KeyRecovery Tool is located. There, drop it into the Tools\SGN-Tools directory.

214

administrator help

5.6.8.2.6.4 Initiate the Challenge in the KeyRecovery Tool

1. At the bottom of the Windows PE file manager in the Quick Launch section, click the

KeyRecovery icon to open the KeyRecovery Tool. The KeyRecovery Tool displays the key ID of the encrypted drives.

The tool is started displaying a list of all volumes and their corresponding encryption information

(key ID).

2. Select the volume you want to decrypt and click Import by C/R to generate the challenge code.

As reference in the SafeGuard Enterprise Database the Virtual Client file is used and stated in the challenge. The challenge code is generated and displayed.

3. Communicate the Virtual Client name and the challenge code to the help desk, for example by phone or text message. A spelling aid is provided.

5.6.8.2.6.5 Confirm the Virtual Client

Prerequisite: The Virtual Client must have been created in the SafeGuard Management Center in Virtual Clients and must be available in the database.

1. In the SafeGuard Management Center, click Tools > Recovery to open the Recovery Wizard.

2. In Recovery type, select Virtual Client.

3. Enter the name of the Virtual Client the user has given to you. There are different ways to do so:

■

Enter the unique name directly.

215

SafeGuard Enterprise

■

Select a name by clicking [...] in the Virtual Client section of the Recovery type dialog.

Then click Find now. A list of Virtual Clients is displayed. Select the required Virtual Client and click OK. The Virtual Client name is then displayed on the Recovery type page below

Virtual Client.

4. Click Next to confirm the name of the Virtual Client file.

Next select the requested recovery action.

5.6.8.2.6.6 Select required recovery action

1. On the Virtual Client, Requested Action page, select one of the following options:

■

Select Key requested to recover a single key for accessing an encrypted volume on the computer.

This option is available for unmanaged and managed endpoints.

■

Select Password for key file requested to recover multiple keys for accessing encrypted volumes on the computer. The keys are stored in one file which is encrypted with a random password stored in the database. The password is unique for each created key file. Within the response code the password is transferred to the target computer.

This option is only available for managed endpoints.

2. Click Next.

5.6.8.2.6.7 Select the requested key (single key)

Prerequisite:

You must have selected the required Virtual Client in the SafeGuard Management Center Recovery

Wizard and the recovery action Key requested.

1. In the Recovery Wizard, on the Virtual Client page, select if the action is requested by a managed or unmanaged endpoint:

■

For managed endpoints, select Recovery key for SafeGuard Enterprise Client managed.

Click [...]. In Find Keys, you can either display the keys by key ID or by symbolic name.

Click Find now, select the key and click OK.

Note: A response can only be initiated for assigned keys. If a key is inactive, this means that the key is not assigned to at least one user, a Virtual Client Response is not possible.

In this case, the inactive key can be reassigned to any other user and a response for this key can be generated again.

■

For unmanaged endpoints, select Recovery key for Sophos SafeGuard Client standalone.

Click [...] next to this option to browse for the respective file. For easier identification the recovery files carry the name of the computer: computername.GUID.xml. Select the file and click Open.

Note: The required key recovery file needed to regain access to the computer must be accessible to the helpdesk, for example on a network share.

2. Click Next. The page for entering the challenge code is displayed.

The requested key is transferred to the user environment within the response code.

216

administrator help

5.6.8.2.6.8 Select the requested key file (several keys)

Prerequisite:

This option is only available for managed endpoints.

You must have created the key file beforehand in the SafeGuard Management Center in Keys

and Certificates and the password encrypting the key file must have been stored in the database.

You must have selected the required Virtual Client file in the SafeGuard Management Center

Recovery Wizard and the recovery action Password for key file requested.

1. To select a key file, click [...] next to this option. In Key file, click Find now. Select the key file and click OK.

2. Click Next to confirm.

The page for entering the challenge code is displayed.

5.6.8.2.6.9 Enter the challenge code and generate the response code

Prerequisite:

You must have selected the required Virtual Client in the SafeGuard Management Center Recovery

Wizard and the required recovery action.

1. Enter the challenge code the user has passed on to you and click Next. The challenge code is verified.

If the challenge code has been entered correctly, the response code is generated. If the code has been entered incorrectly, Invalid challenge is displayed below the block containing the error.

2. Pass the response code on to the user. A spelling aid is provided. You can also copy the response code to the clipboard.

When you have selected Key requested as recovery action, the requested key is transferred to the user environment within the response code.

When you have selected Password for key file requested as recovery action, the password for the encrypted key file is transferred within the response code. The key file is then deleted.

5.6.8.2.6.10 Enter the response code in the KeyRecovery Tool

1. In the KeyRecovery Tool on the endpoint, enter the response code the helpdesk has given to you.

Within the response code the required key or password for the key file is transported.

217

SafeGuard Enterprise

2. Click OK. The drive selected for Challenge/Response has been decrypted.

3. To ensure that description has been successful, select the decrypted drive in the Windows

PE file manager:

218

The contents of the decrypted drive are now displayed in the file manager. The file system as well as the capacity and used/free space are now indicated in the properties of the decrypted drive.

administrator help

Access to the data stored on this partition is recovered. As a result of the successful decryption you can read, write and copy data from or to the drive.

5.6.8.2.7 Challenge/Response for Sophos SafeGuard Clients (standalone)

SafeGuard Enterprise also provides Challenge/Response for unmanaged endpoints (Sophos

SafeGuard Clients standalone), when the user has forgotten the password or entered the password incorrectly too often. Unmanaged endpoints never have any connection to the SafeGuard Enterprise

Server, not even temporarily. They operate in standalone mode.

Recovery information needed for a Challenge/Response is in this case based on the key recovery file. On each unmanaged endpoint, this key recovery file is generated during deployment of the

SafeGuard Enterprise encryption software. The key recovery file must be accessible to the

SafeGuard Enterprise helpdesk, for example on a shared network path.

To facilitate searching and grouping of the recovery files the files will carry the name of the computer:

computername.GUID.xml

in their file names. This allows for wild card search with asterisks (*), for example: *.GUID.xml.

Note: When a computer is renamed, it will not be renamed accordingly in the computer's local cache. The local cache stores all keys, policies, user certificates and audit files. The new computer name therefore has to be removed from the local cache so that only the previous name will remain, even if a computer is renamed under Windows.

5.6.8.2.7.1 Recovery actions for Sophos SafeGuard Clients (standalone)

Challenge/Response for an unmanaged endpoint can be initiated in the following situations:

■

The user has entered the password incorrectly too often.

■

The user has forgotten the password.

■

A corrupted local cache needs to be repaired.

For an unmanaged endpoint no user key is available in the database. Therefore, the only recovery action possible in a Challenge/Response session is Boot SGN client without user logon.

The Challenge/Response procedure enables the computer to boot through SafeGuard Power-on

Authentication. The user is then able to log on to Windows

Potential recovery use cases:

The user has entered the password incorrectly too often at the SafeGuard POA level and the computer has been locked. But the user still knows the password.

The computer is locked, and the user is prompted to initiate a Challenge/Response procedure to unlock the computer. As the user still knows the correct password, there is no need to reset it.

The Challenge/Response procedure enables the computer to boot through SafeGuard Power-on

Authentication. The user can then type the password correctly into the Windows logon dialog and is logged on to Windows.

The user has forgotten the password

Note: We recommend that you use Local Self Help to recover a forgotten password. Local Self

Help allows users to have the current password displayed and to continue using it. This avoids the need to reset the password or to involve the helpdesk.

When recovering a forgotten password with Challenge/Response a password reset is required.

219

SafeGuard Enterprise

1. The Challenge/Response procedure enables the computer to boot through SafeGuard Power-on

Authentication.

2. In the Windows logon dialog, the user does not know the correct password. The password needs to be reset at Windows level. This requires further recovery actions outside the scope of SafeGuard Enterprise, using standard Windows means.

Note: We recommend that you avoid resetting the password centrally before to the

Challenge/Response procedure. Avoiding this ensures that the password remains synchronized between Windows and SafeGuard Enterprise. Make sure that the Windows helpdesk is educated accordingly.

We recommend the following methods to reset the password at Windows level.

■

By using a service or administrator account available on the endpoint with the required

Windows rights.

■

By using a Windows password reset disk on the endpoint.

As a helpdesk officer, you can inform the user which procedure should be used and either provide the additional Windows credentials or the required disk.

3. The user enters the new password that the helpdesk has reset at Windows level. The user then needs to change this password immediately to a value only known to the user. A new user certificate is created based on the newly chosen Windows password. This enables the user to log on to the computer again and to log on at SafeGuard Power-on Authentication with the new password.

Note: Keys for SafeGuard Data Exchange: When a password is reset and a new certificate is created, local keys previously created for SafeGuard Data Exchange can still be used if the endpoint is a member of a domain. If the endpoint is a member of a workgroup, the user has to remember the SafeGuard Data Exchange passphrase to reactivate these local keys.

The local cache needs to be repaired

The local cache stores all keys, policies, user certificates and audit files. By default, logon recovery is deactivated when the local cache is corrupted, which means that it is restored automatically from its backup. In this case, no Challenge/Response procedure is required to repair the local cache. However, logon recovery can be activated by policy, if the local cache is to be repaired explicitly with a Challenge/Response procedure. In this case, the user is prompted automatically to initiate a Challenge/Response procedure, if the local cache is corrupted.

5.6.8.2.7.2 Generate a response for unmanaged endpoints using the key recovery file

Note: The key recovery file generated during installation of the SafeGuard Enterprise encryption software needs to be stored in a location that a helpdesk officer is able to access and the name of the file must be known.

1. In the SafeGuard Management Center, select Tools > Recovery from the menu bar to open the Recovery Wizard.

2. In Recovery type, select Sophos SafeGuard Client (standalone).

3. Locate the required key recovery file by clicking the [...] button next to the Key recovery file field. For easier identification, the recovery files carry the name of the computer: computername.GUID.xml.

220

administrator help

4. Enter the challenge code the user has passed on to you and click Next. The challenge code is verified.

If the challenge code has been entered correctly, the recovery action requested by the computer as well as the possible recovery actions are displayed. If the code has been entered incorrectly,

Invalid challenge is displayed below the block containing the error.

5. Select the action to be taken by the user and click Next.

6. A response code is generated. Communicate the response code to the user. A spelling aid is provided. You may also copy the response code to the clipboard.

The user can enter the response code, perform the requested action and resume working.

5.6.8.3 System Recovery for SafeGuard Full Disk Encryption

SafeGuard Enterprise encrypts files and drives transparently. Boot drives can also be encrypted, so decryption functionalities such as code, encryption algorithms and encryption key must be available very early in the boot phase. Therefore encrypted information cannot be accessed if the crucial SafeGuard Enterprise modules are unavailable or do not work.

The following sections cover possible problems and recovery methods.

5.6.8.3.1 Recover data by booting from an external medium

This recovery type can be applied when the user cannot access the encrypted volume any more.

In this case, access to the encrypted data can be regained by booting the computer from a

Windows PE recovery disk customized for SafeGuard Enterprise.

Prerequisites:

■

The user booting from the external medium must have the right to do so. This has to be configured in the computer's BIOS.

■

The computer must support booting from different media than the fixed hard drive.

To regain access to encrypted data on the computer, do the following:

1. Obtain the SafeGuard Enterprise Windows PE disk from Sophos technical support.

The helpdesk may download the Windows PE recovery disk with the latest SafeGuard Enterprise filter drivers from the Sophos support site. For more information, see Sophos knowledgebase article 108805 .

2. Insert the Windows PE recovery disk into the computer.

3. Boot the computer from the recovery disk and carry out a Challenge/Response procedure with a Virtual Client. For further information, see

Challenge/Response using Virtual Clients (page

211).

Access to the data stored on this partition is recovered.

Note: Depending on the BIOS in use, booting from the disk may not work.

5.6.8.3.2 Corrupted MBR

For resolving problems with a corrupted MBR, SafeGuard Enterprise offers the tool

BE_Restore.exe

.

For a detailed description of how to restore a corrupted MBR with this tool refer to the SafeGuard

Enterprise tools guide.

221

SafeGuard Enterprise

5.6.8.3.3 Damaged kernel boot code

It is possible to access a hard disk with damaged kernel boot code as keys are stored separately from the kernel in the so-called KSA (Key Storage Area). By separating the kernel and the keys, this type of drive can be decrypted when hooked up to another computer.

To do this, the user logging on to the other computer needs a key for the KSA of the unbootable partition on their key ring.

In the worst case, the partition is only encrypted using the other computer's Boot_Key. In such a case, the Master Security Officer or the Recovery Officer must assign this Boot_Key to the user.

For further information, see

"Slaving" a hard disk (page 223).

5.6.8.3.4 Volumes

SafeGuard Enterprise provides volume-based encryption. This includes saving encryption information consisting of the boot sector, primary and backup KSA and the original boot sector on each drive itself.

If one of the following conditions applies, the volume cannot be accessed any longer:

■

Both Key Storage Areas (KSA) are damaged at the same time.

■

The original MBR is damaged.

5.6.8.3.4.1 Boot sector

During the encryption process a volume's boot sector is swapped for the SafeGuard Enterprise boot sector.

The SafeGuard Enterprise boot sector holds information about

■

The location of the primary and backup KSA in clusters and sectors in relation to the start of the partition

■

The size of the KSA

If the SafeGuard Enterprise boot sector is damaged, encrypted volumes cannot be accessed.

The

tool BE_Restore

can restore the damaged boot sector. For further information, see the

SafeGuard Enterprise tools guide.

5.6.8.3.4.2 Original boot sector

The original boot sector is the one that is run after the DEK (Data Encryption Key) has been decrypted and the algorithm and the key have been loaded to the BE filter driver.

If this boot sector is defective, Windows is unable to access the volume. Normally the common error message "Device is not formatted. Would you like to format it now? Yes/No" is displayed.

Nonetheless, SafeGuard Enterprise will load the DEK for this volume. A tool that is used to repair the boot sector needs to be compatible with the SafeGuard Enterprise Upper Volume Filter.

5.6.8.3.5 Windows boot problems

Its cryptographic design of the volume-specific key (boot sector, Key Storage Area KSA) makes

SafeGuard Enterprise extremely flexible.

222

administrator help

You can save a damaged system by booting a restore medium from the SafeGuard Power-on

Authentication (Windows PE with the SafeGuard Enterprise encryption subsystem installed).

These media have transparent en-/decryption access to volumes encrypted with SafeGuard

Enterprise. The cause of the unbootable system can be remedied from there.

5.6.8.3.5.1 Encryption subsystem

Encryption subsystems are for example BEFLT.sys. Carry out the procedure described under

Windows boot problems and repair the system.

5.6.8.3.6 Setting up WinPE for SafeGuard Enterprise

To get access to encrypted drives with a computer's BOOTKEY within a WinPE environment,

SafeGuard Enterprise offers WinPE with the required SafeGuard Enterprise function modules and drivers. To start SetupWinPE, enter the following command:

SetupWinPE -pe2 <WinPE image file>

WinPE image file

being the full path name of a WinPE image file

SetupWinPE makes all the changes needed.

Note: With this type of WinPE environment, only encrypted drives that are encrypted with the

BOOTKEY can be accessed. Drives that are encrypted with a user key cannot be accessed because the keys are not available in this environment.

5.6.8.3.7 "Slaving" a hard disk

SafeGuard Enterprise allows encrypted volumes or hard disks to be enslaved. It permits the end user, the Windows administrator and the SafeGuard Enterprise Security Officer to connect or remove new volumes or hard disks in spite of sector-based encryption.

A volume's Key Storage Area (KSA) holds all the information required, this means:

■

The randomly generated DEK (Data Encryption Key).

■

An ID for the encryption algorithm used to encrypt the volume.

■

The list of GUIDs for the KEKs (Key Encryption Keys) that can encrypt and decrypt the DEK.

■

The volume itself contains its size.

A volume encrypted with SafeGuard Enterprise can be accessed from all SafeGuard Enterprise protected endpoints, provided that the user or computer possess a KEK for the KSA of the volume on their key ring.

Users or computers must be able to decrypt the DEK encrypted by the KEK.

Many users and computers can access a volume that has been encrypted with a distributable

KEK such as an OU, group or domain key, because many users/computers of a domain have this key on their key ring.

However, a volume that is only encrypted with the individual boot key ("Boot_machinename") of the SafeGuard Enterprise protected endpoint can only be accessed by that particular computer.

If a volume does not boot on its original computer, it may be "enslaved" on another SafeGuard

Enterprise protected endpoint. However, the correct boot key cannot be accessed then. It has to be made accessible.

223

SafeGuard Enterprise

Whenever the user attempts to access the volume from another computer, this can be done, because the KEKs in the KSA and the key rings of the other users or computers match again.

5.6.8.3.7.1 Example

Alice has her own personal user key. Whenever she is logged on to her other computer

("Laptop_Alice"), she cannot access the volume that is encrypted with the boot key of the

"SGNCLT" computer.

The SafeGuard Enterprise protected endpoint "SGNCLT" only has its own boot key

BOOT_SGNCLT.

The Security Officer assigns the boot key "BOOT_SGNCLT" to Alice as follows:

1. Select user Alice

2. Click the "Binocular" icon in the SafeGuard Enterprise toolbar. This opens the search dialog which can also display boot keys.

3. Select the "BOOT_SGNCLT" key.

Now Alice has two keys - "User_Alice" and "BOOT_SGNCLT". This can be verified under Keys

& Certificates.

The "BOOT_SGNCLT" has been assigned twice - to the SGNCLT computer and to user Alice.

Alice can now access the encrypted volume of any other SafeGuard Enterprise protected endpoint computer which she is able to log on to.

She can then easily use tools such as Windows Explorer and regedit.exe to resolve the reason for the boot problem.

If, in the worst case, the problem is not resolved, she can save data on another drive, reformat the volume or set it up as new again.

5.7 SafeGuard Configuration Protection

The module SafeGuard Configuration Protection is no longer available as of SafeGuard Enterprise

6.1. The corresponding policy as well as the Suspension Wizard are still available in the SafeGuard

Management Center 8.0 to support SafeGuard Enterprise 6 or even 5.60 clients with Configuration

Protection installed and managed with a 8.0 Management Center.

For further information on SafeGuard Configuration Protection, refer to the SafeGuard Enterprise

6 Administrator help: http://www.sophos.com/en-us/medialibrary/PDFs/documentation/sgn_60_h_eng_admin_help.pdf

.

224

administrator help

6 Recovery

6.1 Synchronize full disk encryption keys with mobile devices

BitLocker and FileVault 2 recovery keys can be sent to the Sophos Mobile Control Server. They will be added to the SafeGuard Enterprise key ring and users of Sophos Secure Workspace managed by Sophos Mobile Control can then display these keys on their compliant mobile device for recovery purposes. Sophos Secure Workspace supports recovery via mobile from version

6.2. For details see the Sophos Secure Workspace 6.2 user help.

Requirements:

■

■

■

Key ring sharing between SafeGuard Enterprise and Sophos Mobile Control must be configured.

The Recovery via mobile option must be activated, see

Share SafeGuard Enterprise key ring with mobile devices managed by Sophos Mobile Control (page 135).

Sophos Secure Workspace 6.2 must be used on mobile devices.

Users have to be SGN users on the endpoints. They need to be in the UMA

(User-Machine-Assignment list) of the endpoints concerned.

■

Users must have logged on to a particular computer from which they should get the full disk encryption keys.

Note: In order to limit the amount of transmitted data only the keys of ten endpoints are added to the SafeGuard Enterprise key ring. These ten computers are the ones with the most recent server contact.

6.1.1 Display recovery keys on mobile devices

Note: Sophos Secure Workspace must be installed inside the Sophos Mobile Control container.

To display the recovery key for a computer:

1. Tap Recovery keys in the menu to display a list of computers that are assigned to you.

2. Tap a computer name to display its recovery key.

3. To unlock your computer, follow the instructions that are displayed on the BitLocker (on

Windows) or FileVault (Mac OS X) screen on your computer.

6.2 Recovery for BitLocker

Depending on the system used, SafeGuard Enterprise offers a Challenge/Response procedure for recovery or the possibility of obtaining the recovery key from the helpdesk. For the requirements

for SafeGuard Enterprise Challenge/Response see Prerequisites for managing BitLocker on endpoints (page 142). For information on recovery on the client side, see the

SafeGuard Enterprise user help .

225

SafeGuard Enterprise

6.2.1 Response for BitLocker encrypted SafeGuard Enterprise Clients - UEFI endpoints

For UEFI endpoints that meet certain requirements, SafeGuard Enterprise offers

Challenge/Response for recovery. On UEFI endpoints that do not fulfill the requirements SafeGuard

BitLocker management without Challenge/Response is installed automatically. To recover these endpoints see

Recovery key for BitLocker encrypted SafeGuard Enterprise Clients - BIOS endpoints

(page 148).

1. In the SafeGuard Management Center, select Tools > Recovery to open the Recovery

Wizard.

2. On the Recovery type page, select SafeGuard Enterprise Client (managed).

3. Under Domain, select the required domain from the list.

4. Under Computer enter or select the required computer name. There are several ways to do so:

■

To select a name, click [...]. Then click Find now. A list of computers is displayed. Select the required computer and click OK. The computer name is displayed on the Recovery

type page.

■

Type the short name of the computer directly into the field. When you click Next, the database is searched for this name. If it is found, the distinguished computer name is displayed.

■

Enter the computer name directly in the distinguished name format, for example:

CN=Desktop1,OU=Development,OU=Headquarter,DC=Sophos,DC=edu

5. Click Next.

6. Select the volume to be accessed from the list and click Next.

7. Click Next.

A page is displayed where you can enter the challenge code.

8. Enter the challenge code the user has passed on to you and click Next.

9. A response code is generated. Provide the response code to the user. A spelling aid is provided.

You can also copy the response code to the clipboard.

The user can enter the response code and get access to the endpoint.

6.2.2 Recovery key for BitLocker encrypted SafeGuard Enterprise Clients -

BIOS endpoints

For BitLocker encrypted BIOS computers a volume that cannot be accessed any more may be recovered.

1. In the SafeGuard Management Center, select Tools > Recovery to open the Recovery

Wizard.

2. On the Recovery type page, select SafeGuard Enterprise Client (managed).

3. Under Domain, select the required domain from the list.

226

administrator help

4. Under Computer enter or select the required computer name. There are several ways to do so:

■

To select a name, click [...]. Then click Find Now. A list of computers is displayed. Select the required computer and click OK. The computer name is displayed in the Recovery

type window under Domain.

■

Type the short name of the computer directly into the field. When you click Next, the database is searched for this name. If it is found, the distinguished computer name is displayed.

■

Enter the computer name directly in distinguished name format, for example:

CN=Desktop1,OU=Development,OU=Headquarter,DC=Utimaco,DC=edu

5. Click Next.

6. Select the volume to be accessed from the list and click Next.

7. The Recovery Wizard displays the corresponding 48-digit recovery key.

8. Provide this key to the user.

The user can enter the key to recover the BitLocker encrypted volume on the endpoint.

6.3 Recovery key for Mac endpoints

Access to FileVault 2 encrypted SafeGuard Enterprise Clients can be regained with the following procedure:

1. On the Recovery type page, select SafeGuard Enterprise Client (managed).

2. Under Domain, select the required domain from the list.

3. Under Computer enter or select the required computer name. There are several ways to do so:

■

To select a name, click [...]. Then click Find Now. A list of computers is displayed. Select the required computer and click OK. The computer name is displayed in the Recovery

type window under Domain.

■

Type the short name of the computer directly into the field. When you click Next, the database is searched for this name. If it is found, the distinguished computer name is displayed.

■

Enter the computer name directly in distinguished name format, for example:

CN=Desktop1,OU=Development,OU=Headquarter,DC=Utimaco,DC=edu

4. Click Next.

5. The Recovery Wizard displays the corresponding 24-digit recovery key.

6. Provide this key to the user.

The user can enter the recovery key to get logged on to the Mac endpoint and reset the password.

227

SafeGuard Enterprise

6.4 Virtual Clients

Note: Virtual Clients can only be used for SafeGuard Full Disk Encryption with SafeGuard

Power-on Authentication (POA).

Virtual Clients are specific encrypted key files that can be used for recovery in a

Challenge/Response procedure when the required user information is not available and

Challenge/Response would usually not be supported (for example when the SafeGuard POA is corrupted).

To enable a Challenge/Response procedure in this complex recovery situation, specific files called

Virtual Clients can be created. They must be distributed to the user before the Challenge/Response session is carried out. Using Virtual Clients, Challenge/Response can be initiated with a key recovery tool on the endpoint computer. The user only needs to inform the helpdesk officer of the required key or keys and enter the response code in order to regain access to encrypted volumes.

Recovery is either possible by using a single key or an encrypted key file containing several keys.

In the SafeGuard Management Center Keys and Certificates area you can:

■

Create and export Virtual Clients.

■

Create and export encrypted key files containing several keys.

■

Display and filter Virtual Clients and exported key files.

■

Delete Virtual Clients.

6.4.1 Create Virtual Clients

Virtual Client files can be used by different computers and for several Challenge/Response sessions.

1. In the SafeGuard Management Center, click Keys and Certificates.

2. In the left-hand navigation window, click Virtual Clients.

3. In the toolbar, click Add Virtual Client.

4. Enter a unique name for the Virtual Client and click OK.

The Virtual Clients are identified in the database by these names.

5. In the toolbar, click the Save icon to save the Virtual Client to the database.

The new Virtual Client is displayed in the action area.

6.4.2 Export Virtual Clients

After you have created the Virtual Client you need to export it to a file. This file is always called

recoverytoken.tok

and must be distributed to the help desk. This file must be available in the endpoint environment to initiate a Challenge/Response session with a recovery tool (for example when the SafeGuard POA is corrupted). The user must place the Virtual Client file

228

administrator help

recoverytoken.tok

in the same folder as the recovery tool so that a Challenge/Response can be supported.

1. In the SafeGuard Management Center, click Keys and Certificates.

2. In the left-hand navigation window, click Virtual Clients.

3. In the action area, search for the respective Virtual Client by clicking the magnifier icon. The available Virtual Clients are displayed.

4. Select the required entry in the action area and click Export Virtual Client in the toolbar.

5. Select a location to store the file

recoverytoken.tok

and click OK. A success message is displayed.

6. Distribute this Virtual Client file

recoverytoken.tok

to the respective SafeGuard Enterprise users.

Store the file in a safe place, for example on a memory stick. When a Challenge/Response is initiated, this file needs to be located in the same folder as the recovery tool.

6.4.3 Create and export key files for Virtual Client recovery

When multiple keys are needed to recover access to encrypted volumes during a Virtual Client recovery, the security officer can combine them in one exported file. This key file is encrypted with a random password which is stored in the database. The password is unique for each created key file.

The encrypted key file needs to be transferred to the user and must be available to the user when starting a Challenge/Response session with a recovery tool.

In the Challenge/Response session, the password for the key file is transmitted with the response code. The key file can be decrypted with the password and all volumes encrypted with the available keys can be accessed again.

To export key files, you need Full access rights for the objects the relevant keys are assigned to.

1. In the SafeGuard Management Center, click Keys and Certificates.

2. In the left-hand navigation window, click Virtual Clients and then Exported Key Files.

3. In the toolbar, click Export keys to a key file.

4. In Export keys to a key file, enter the following: a) Directory: Click [...] to select a location for the key file.

b) File name: The key file is encrypted with a random password which is displayed here. You cannot change this name.

c) Click Add key or Remove key to add or remove keys. A popup window is displayed to search for and select the required keys. Click OK to confirm the selection.

d) Click OK to confirm all entries.

5. Distribute this key file to the respective endpoint environment. It must be available before the response code is entered on the endpoint.

229

SafeGuard Enterprise

6.4.4 Display and filter Virtual Client views

To find the requested Virtual Client or keys more easily during a Challenge/Response, there are several filter and search possibilities in the SafeGuard Management Center under Keys and

Certificates.

6.4.5 Views for Virtual Clients

1. Click Virtual Clients in the left-hand navigation window.

2. Click the magnifier icon to generate a complete list of all Virtual Clients.

3. Filter the Virtual Clients by Symbolic name or Key GUID.

6.4.6 Views for exported key files

1. In the SafeGuard Management Center, click Virtual Clients, then Exported Key Files.

2. Click the magnifier icon to generate a complete list of all exported key files.

3. Click the + icon next to the required key file to display the keys contained in the file.

6.4.7 Delete Virtual Clients

1. Open the SafeGuard Management Center and click Keys and Certificates.

2. Click Virtual Clients in the left-hand navigation window.

3. In the action area, search for the respective Virtual Client by clicking the magnifier icon. The available Virtual Clients are displayed.

4. Select the required entry in the action area and click Delete Virtual Client in the toolbar.

5. Save the changes to the database by clicking the Save icon in the toolbar.

The Virtual Client is deleted from the database.

6.5 Repair a corrupted Management Center installation

A corrupted SafeGuard Management Center installation can easily be repaired, if the database is still intact. In this case, reinstall the SafeGuard Management Center and use the existing database as well as the backed up Master Security Officer certificate.

■

The company and Master Security Officer certificates of the relevant database configuration must have been exported to .p12 files. The data must be available and valid.

■

The passwords for the .p12 file as well as for the certificate store must be known to you.

To repair a corrupted SafeGuard Management Center installation:

1. Reinstall the SafeGuard Management Center installation package. Open the SafeGuard

Management Center. The Configuration Wizard is started automatically.

2. In Database Connection, select the relevant database server and configure the connection to the database if required. Click Next.

230

administrator help

3. In Database Settings click Select an available database and select the relevant database from the list.

4. In Security Officer Data, do either of the following:

■

If the backed up certificate file can be found on the computer, it is displayed. Enter the password you use for authenticating at SafeGuard Management Center.

■

If the backed up certificate file cannot be found on the computer, select Import. Browse for the backed up certificate file and click Open. Enter the password for the selected certificate file. Click Yes. Enter and confirm the password for authenticating at the SafeGuard

Management Center.

5. Click Next, and then Finish to complete the SafeGuard Management Center configuration.

The corrupted SafeGuard Management Center installation is repaired.

6.6 Repair a corrupted database configuration

A corrupted database configuration can be repaired by installing SafeGuard Management Center afresh to create a new instance of the database based upon the backed up certificate files. This guarantees that all existing SafeGuard Enterprise endpoints still accept policies from the new installation.

■

The company and Master Security Officer certificates of the relevant database configuration must have been exported to .p12 files. The data must be available and valid.

■

The passwords for the two .p12 files as well as for the certificate store must be known to you.

Note: We only recommend this procedure if there is no valid database backup available. All computers that connect to a repaired backend lose their user-machine-assignment. As a consequence, Power-on Authentication is temporarily switched off. Challenge/Response mechanisms will not be available until the corresponding endpoint has successfully sent its key information again.

To repair a corrupted database configuration:

1. Reinstall the SafeGuard Management Center installation package. Open the SafeGuard

Management Center. The Configuration Wizard is started automatically.

2. In Database Connection, check Create a new database. Under Database settings, configure the connection to the database. Click Next.

3. In Security Officer Data, select the relevant MSO and click Import.

4. In Import Authentication Certificate browse for the backed up certificate file. Under Key file enter and confirm the password specified for this file. Click OK.

5. The MSO certificate is imported. Click Next.

6. In Company Certificate, check Restore using an existing company certificate. Click Import to browse for the backed up certificate file that contains the valid company certificate. You are prompted to enter the password specified for the certificate store. Enter the password and click OK. Click Yes in the message displayed.

The company certificate is imported.

7. Click Next and then Finish.

231

SafeGuard Enterprise

The database configuration is repaired.

232

administrator help

7 Advanced management

7.1 Security recommendations

By following the simple steps described here, you can mitigate risks and keep your company's data secure and protected at all times.

To operate SafeGuard Enterprise in a certification-compliant mode, see the SafeGuard Enterprise

Manual for certification-compliant operation.

Avoid sleep mode

On SafeGuard Enterprise protected endpoints, encryption keys might be accessible to attackers in certain sleep modes where the endpoint's operating system is not shut down properly and background processes are not terminated. Protection is enhanced when the operating system is always shut down or hibernated properly.

Train users accordingly or consider centrally disabling sleep mode on endpoints that are unattended or not in use:

■

Avoid sleep (stand-by/suspend) mode as well as hybrid sleep mode. Hybrid sleep mode combines hibernation and sleep. Setting an additional password prompt after resume does not provide full protection.

■

Avoid locking desktops and switching off monitors or closing laptop lids as modes of protection when not followed by a proper shut down or hibernation. Setting an additional password prompt after resume does not provide sufficient protection.

■

Always shut down or hibernate endpoints. SafeGuard Power-on Authentication is always activated the next time the computer is used, thus providing full protection.

Note: It is important that the hibernation file resides on an encrypted volume. Typically it resides on C:\.

You can configure the appropriate power management settings centrally using Group Policy

Objects or locally through the Power Options dialog on the endpoint's Control Panel. Set the Sleep button action to Hibernate or Shut down.

Implement a strong password policy

Implement a strong password policy and force password changes at regular intervals, particularly for endpoint logon.

Passwords should not be shared with anyone nor written down.

Train users to choose strong passwords. A strong password follows these rules:

■

It is long enough to be secure: A minimum of 10 characters is recommended.

233

SafeGuard Enterprise

■

■

■

It contains a mixture of letters (upper and lower case), numbers and special characters/symbols.

It does not contain a commonly used word or name.

It is hard to guess but easy to remember and type accurately.

Do not disable SafeGuard Power-on Authentication

SafeGuard Power-on Authentication provides additional logon protection on the endpoint. With

SafeGuard Full Disk Encryption, it is installed and enabled by default. For full protection, do not disable it. For more information, see Sophos knowledgebase article 110282 .

Protect against code injection

Code injection, for example DLL pre-loading attacks might be possible when an attacker is able to place malicious code, for example executables, in directories that may be searched for legitimate code by the SafeGuard Enterprise encryption software. To mitigate this threat:

■

Install middleware loaded by the encryption software, for example token middleware in directories that are inaccessible to external attackers. These are typically all sub-folders of the

Windows and Program Files directories.

■

The PATH environment variable should not contain components that point to folders accessible to external attackers (see above).

■

Regular users should not have administrative rights.

Encryption best practices

■

Ensure that all drives have a drive letter assigned.

Only drives that have a drive letter assigned are considered for disk encryption/decryption.

Consequently, drives without a drive letter assigned may be abused to leak confidential data in plaintext.

To mitigate this threat: Do not allow users to change drive letter assignments. Set their user rights accordingly. Regular Windows users do not have this right by default.

■

Apply Fast Initial Encryption cautiously.

SafeGuard Enterprise offers Fast Initial Encryption to reduce the time for initial encryption of volumes by only accessing the space that is actually in use. This mode leads to a less secure state if a volume has been in use before it was encrypted with SafeGuard Enterprise. Due to their architecture, Solid State Disks (SSD) are affected even more than regular hard disks.

This mode is disabled by default. For more information, see Sophos knowledgebase article

113334 .

■

■

Only use algorithm AES-256 for data encryption.

Use SSL/TLS (SSL version 3 or above) for protection of the client/server communication.

For further information, see

Securing transport connections with SSL (page 46).

234

administrator help

■

Prevent uninstallation.

To provide extra protection for endpoints you can prevent local uninstallation of SafeGuard

Enterprise in a Specific machine settings policy. Set Uninstallation allowed to No and deploy the policy on the endpoints. Uninstallation attempts are cancelled and the unauthorized attempts are logged.

If you use a demo version, make sure that you set Uninstallation allowed to Yes before the demo version expires.

Apply Sophos Tamper Protection to endpoints using Sophos Endpoint Security and Control.

7.2 Working with multiple database configurations (Multi

Tenancy)

The SafeGuard Management Center allows the use of multiple database configurations (Multi

Tenants). If you want to use this feature, you need to enable it during installation. For further

information, see Installation

(page 11).

With Multi Tenancy, you can configure different SafeGuard Enterprise Database configurations and maintain them for one instance of the SafeGuard Management Center. This is particularly useful, if you want to maintain different configurations for different domains, organizational units or company locations.

Prerequisite: The feature Multi Tenancy must have been installed by a Complete installation.

The SafeGuard Management Center initial configuration must have been carried out.

To ease configuration, you can:

■

Create several database configurations.

■

Select previously created database configurations.

■

Delete database configurations from the list.

■

Import a previously created database configuration from a file.

■

Export a database configuration to be reused later.

7.2.1 Create further database configurations

Prerequisite: The feature Multi Tenancy must have been installed with an installation of type

Complete. SafeGuard Management initial configuration must have been carried out, see Start initial SafeGuard Management Center configuration (page 35).

Note: You need to set up a separate SafeGuard Enterprise Server instance per database.

To create a further SafeGuard Enterprise Database configuration after initial configuration:

1. Start the SafeGuard Management Center. The Select Configuration dialog is displayed.

2. Click New. The SafeGuard Management Center Configuration Wizard starts automatically.

235

SafeGuard Enterprise

3. The Wizard guides you through the necessary steps of creating a new database configuration.

Select the options as required. The new database configuration is generated.

4. To authenticate at the SafeGuard Management Center you are prompted to select the security officer name for this configuration and to enter their certificate store password. Click OK.

The SafeGuard Management Center is launched and connected to the new database configuration.

The next time the SafeGuard Management Center is started, the new database configuration can be selected from the list.

7.2.2 Configure additional instances of the SafeGuard Management Center

You can configure additional instances of the SafeGuard Management Center to give security officers access for carrying out administrative tasks on different computers. SafeGuard

Management Center can be installed on any computer on the network from which the databases can be accessed.

SafeGuard Enterprise manages the access rights to the SafeGuard Management Center in its own certificate directory. This directory must contain all certificates for all security officers authorized to log on to the SafeGuard Management Center. Logging on to the SafeGuard Management

Center then requires only the password to the certificate store.

1. Install SGNManagementCenter.msi on a further computer with the required features.

2. Start SafeGuard Management Center on the computer. The Configuration Wizard is launched and guides you through the necessary steps.

3. On the Welcome page, click Next.

4. On the Database Server Connection page, under Database Server, select the required SQL database instance from the list. All database servers available on your computer or network are displayed. Under Authentication, activate the type of authentication to be used to access this database server instance. If you select Use SQL Server Authentication with the following

credentials, enter the SQL user account credentials that your SQL administrator has created.

Click Next.

5. On the Database Settings page, click Select an available database and select the relevant database from the list. Click Next.

6. In SafeGuard Management Center Authentication, select an authorized person from the list. If Multi Tenancy is enabled, the dialog shows the configuration the user will log on to. Enter and confirm the password for the certificate store.

A certificate store is created for the current user account and is protected by this password.

You only need this password for any subsequent logon.

7. Click OK.

You see a message that the certificate and private key have not been found or cannot be accessed.

8. To import the data, click Yes, and then click OK. This starts the import process.

9. In Import authentication key file, click [...] and select the key file. Enter the password for

key file. Enter the password for the certificate store previously defined in Cert. store password

or token PIN. Select Import to certificate store, or select Copy to token to store the certificate on a token.

10. Enter the password once more to initialize the certificate store.

236

administrator help

Certificates and private keys are now contained in the certificate store. Logging on to the SafeGuard

Management Center then requires the password to the certificate store.

7.2.3 Connect to an existing database configuration

To work with an existing SafeGuard Enterprise Database configuration:

1. Start the SafeGuard Management Center.

The Select Configuration dialog is displayed.

2. Select the required database configuration from the drop-down list and click OK.

The selected database configuration is connected to the SafeGuard Management Center and becomes active.

3. To authenticate at the SafeGuard Management Center, you are prompted to select the security officer name for this configuration and to enter their certificate store password. Click OK.

The SafeGuard Management Center is launched and connected to the selected database configuration.

7.2.4 Export a configuration to a file

To save or reuse a database configuration, you can export it to a file:

1. Start the SafeGuard Management Center.

The Select Configuration dialog is displayed.

2. Select the respective configuration from the list and click Export...

3. To secure the configuration file, you are prompted to enter and confirm a password that encrypts the parts configuration file. Click OK.

4. Specify a file name and storage location for the exported configuration file *.SGNConfig.

If this configuration already exists, you are asked if you want to overwrite the existing configuration.

The database configuration file is saved to the specified storage location.

7.2.5 Import a configuration from a file

To use or change a database configuration, you can import a previously created configuration into the SafeGuard Management Center. There are two ways to do so:

■

■ with the SafeGuard Management Center (for Multi Tenancy) by double-clicking the configuration file (for Single and Multi Tenancy).

7.2.6 Import a configuration with the SafeGuard Management Center

1. Start the SafeGuard Management Center.

The Select Configuration dialog is displayed.

237

SafeGuard Enterprise

2. Click Import..., locate the required configuration file and click Open.

3. Enter the password for the configuration file defined during the export and click OK.

The selected configuration is displayed.

4. To activate the configuration, click OK.

5. To authenticate at the SafeGuard Management Center, you are prompted to select the security officer name for this configuration and to enter their certificate store password. Click OK.

The SafeGuard Management Center is opened and connected to the imported database configuration.

7.2.7 Import a configuration by double-clicking the configuration file (Single and Multi Tenancy)

Note: This task is available in the Single Tenancy and Multi Tenancy mode.

You can also export a configuration and distribute it to several security officers. The security officers then only need to double-click the configuration file to open a fully configured SafeGuard

Management Center.

This is useful when you use SQL authentication for the database and want to avoid that every administrator knows the SQL password. In this case, you only need to enter it once, create a configuration file and distribute it to the respective security officers’ computers.

Prerequisite: The initial configuration of the SafeGuard Management Center must have been

carried out. For details, see Setting up SafeGuard Management Center (page 33).

1. Start the SafeGuard Management Center.

2. Select Options from the Tools menu and select the Database tab.

3. Enter or confirm the credentials for the SQL Database Server connection.

4. Click Export configuration to export this configuration to a file.

5. Enter and confirm a password for the configuration file.

6. Enter a file name and select a storage location.

7. Distribute this configuration file to the security officers’ computers. Let them know the password for this file as well as the certificate store password needed to authenticate at the SafeGuard

Management Center.

8. The security officers just need to double-click the configuration file.

9. They are prompted to enter the password for the configuration file.

10. To authenticate at the SafeGuard Management Center, they are prompted to enter their certificate store password.

The SafeGuard Management Center starts with the imported configuration. This configuration is the new default configuration.

7.2.8 Fast switching of database configurations

To ease administrative tasks for several tenants, the SafeGuard Management Center allows for fast switching of database configurations.

238

administrator help

Note: This task is also available in Single Tenancy mode.

1. In the SafeGuard Management Center, select Change configuration... from the File menu.

2. Select the database you want to switch to from the drop-down list and click OK.

The SafeGuard Management Center is automatically restarted with the selected configuration.

7.3 SafeGuard Management Center - advanced

7.3.1 Warning when company certificate expires

At logon the SafeGuard Management Center starts to display a warning six months before the company certificate will expire and prompts you to renew it and deploy it on the endpoints. Without a valid company certificate an endpoint cannot connect to the server.

You can renew the company certificate at any time. Even if the company certificate has already expired. An expired company certificate will also be indicated by a message box. For information

on how to renew the company certificate, see Renew the company certificate (page 283).

7.3.2 Log on in Single Tenancy mode

1. Start the SafeGuard Management Center from the product folder of the Start menu. A logon dialog is displayed.

2. Log on as MSO (Master Security Officer) and enter the certificate store password specified during initial configuration. Click OK.

The SafeGuard Management Center is opened.

Note: If you enter an incorrect password, an error message is displayed and a delay will be imposed for the next logon attempt. The delay period is increased with each failed logon attempt.

Failed attempts are logged.

7.3.3 Log on in Multi Tenancy mode

The logon process to the SafeGuard Management Center is extended when you have configured several databases (Multi Tenancy), see

Working with multiple database configurations (Multi

Tenancy)

(page 235).

1. Start the SafeGuard Management Center from the product folder of the Start menu. The Select

Configuration dialog is displayed.

2. Select the database configuration you want to use from the drop-down list and click OK.

The selected database configuration is connected to the SafeGuard Management Center and becomes active.

3. To authenticate at the SafeGuard Management Center, you are prompted to select the security officer name for this configuration and enter their certificate store password. Click OK.

The SafeGuard Management Center is opened and connected to the selected database configuration.

239

SafeGuard Enterprise

Note: If you enter an incorrect password, an error message is displayed and a delay is imposed for the next logon attempt. The delay period is increased with each failed logon attempt. Failed attempts are logged.

7.3.4 Search for users, computers and groups in the SafeGuard Enterprise

Database

To display objects in the Find Users, Computers and Groups dialog, you need Read only or

Full access rights for the relevant objects.

Note: When you search for objects, you only get the search results within the areas (domain) for which you have been granted access as a security officer. Only a Master Security Officer can successfully perform a root search process.

In Users and Computers, you can search for objects using different filters. For example, you can easily identify duplicates that may have been caused by an AD synchronization process with the Duplicate users and computers filter. This filter shows all computers with the same name in one domain and all users with the same name, logon name or pre-2000 logon name in one domain.

To search for objects:

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the Users and Computers navigation area, select the required container.

3. In the SafeGuard Management Center menu bar, click Edit > Find.

The Find Users, Computers and Groups dialog is displayed.

4. Select the required filter from the Find drop-down list.

5. In the In field, the selected container is displayed.

You can change this by selecting a different option from the drop-down list.

6. If you search for a specific object, enter the required search name in the Search Name field.

7. With the Clear results after each search check box, specify whether results should be cleared after each search process.

8. Click Find now.

The results are displayed in the Find Users, Computers and Groups dialog. If you click on one of the results in this dialog, the relevant entry is marked in the Users and Computers tree structure.

If you have searched for duplicates for example, you can now easily delete them.

7.3.5 Display object properties in Users and Computers

To display object properties, you need Full access or Read only rights for the objects concerned.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the navigation window of Users and Computers, right-click the required object and select

Properties.

The properties of the selected object are displayed. If you have Read only access rights for the relevant object, the properties information is greyed out in the dialog and you cannot edit them.

240

administrator help

7.3.6 Disabling policy deployment

As a security officer, you can disable the deployment of policies to the endpoints. To do so, click the Enable/disable policy deployment button in the SafeGuard Management Center toolbar or select Enable/disable policy deployment from the Edit menu. After disabling policy deployment, no policies are sent to the endpoints. To reverse the disabling of policy deployment, click the button or select the command again.

Note: To disable policy deployment, a security officer needs the right "Enable/disable policy deployment". By default, this right has been assigned to the predefined roles Master Security

Officer and Security Officer, but it can also be assigned to new user-defined roles.

7.3.7 Rules for assigning and analyzing policies

The management and analysis of policies is carried out according to the rules described in this section.

7.3.7.1 Assign and activate policies

To enable a policy to be implemented for a user/computer, you need to assign it to a container object (root nodes, domain, OU, BuiltIn container or workgroup). For the policy assigned to the user/computer to become effective, when you assign a policy anywhere in the hierarchy, all computers (authenticated computers) and all users (authenticated users) are activated automatically

(assignment without activation is not enough). All users and all computers are combined into these groups.

7.3.7.2 Policy inheritance

Policies can only be passed on between container objects. Policies can be activated within a container provided it contains no further container objects (at group level). Inheritance between groups is not possible.

7.3.7.3 Policy inheritance hierarchy

Where policies are assigned along a hierarchy chain, the policy closest to a target object

(user/computer) is the highest ranking. This means that as the distance to the target object increases a policy will be superseded by any policies that are closer.

7.3.7.4 Direct assignment of policies

The user/computer obtains a policy which is assigned directly to the container object in which it is located (membership as a user of a group located in another container object is not sufficient).

The container object did not inherit this policy!

7.3.7.5 Indirect assignment of policies

The user/computer obtains a policy which the container object it is located in (membership as a user of a group located in another container object is not sufficient) has inherited from a higher-ranking container object.

241

SafeGuard Enterprise

7.3.7.6 Activate/deactivate policies

For a policy to be effective for a computer/user, it has to be activated at group level (policies can only be activated at group levels). It makes no difference if this group is in the same container object or not. All that matters is that the user or computer has been directly or indirectly (through inheritance) assigned to the policy.

If a computer or user is outside an OU or inheritance line and is a member of a group which is inside this OU, this activation does not apply to this user/computer. Because there is no valid assignment for this user or computer (directly or indirectly). The group was, indeed, activated but an activation can only apply to users and machines for which there is also a policy assignment.

This means that the activation of policies cannot go beyond container boundaries if there is no direct or indirect policy assignment for that object.

A policy becomes effective when it has been activated for user groups or computer groups. The user groups and then the computer groups are analyzed (authenticated users and authenticated computers are also groups). Both results are OR-linked. If this OR-link gives a positive value for the computer/user relationship, the policy applies.

Note: If more than one policy is active for an object, the individual policies are, while complying with the rules described, merged. This means that the actual settings for an object can be composed of multiple different policies.

A group can have the following activation settings:

■

Activated

A policy has been assigned. The group is displayed in the activation area of the SafeGuard

Management Center.

■

Not activated

A policy has been assigned. The group is not in the activation area.

If a policy is assigned to a container, the activation setting for a group (activated) determines whether that policy for that container feeds into the calculation of the resulting policy.

Inherited policies cannot be controlled by these activations. Block policy inheritance would have to be set at the more local OU so the more global policy cannot be effective here.

7.3.7.7 User/group settings

Policy settings for users (shown in black in the SafeGuard Management Center) take priority over policy settings for computers (shown in blue in the SafeGuard Management Center). If user settings are specified in a policy for computers, those settings are overridden by the policy for the user.

Note: Only the user settings are overridden. If a policy for users also includes machine settings

(shown in blue), they are not overridden by a user policy!

Example 1:

If password length 4 has been defined for a computer group, the user group is assigned value 3 for the same setting and this user is subject to password length 3 on a computer in the computer group.

Example 2:

242

administrator help

If a server interval of 1 minute is defined for a user group, and the value 3 for a machine group, value 3 is used because value 1 minute is a machine setting which was defined in a policy for users.

7.3.7.8 Contradictory encryption policies

Two policies (P1 and P2) are created. File-based encryption for drive E:\ was defined for P1, and volume-based encryption for drive E:\ was defined for P2. P1 is assigned the OU FBE-User and

P2 the OU VBE-User.

Case 1: A user from OU FBE-User logs on first to the Client W7-100 (container computer). Drive

E:\ is encrypted with file-based encryption. If a user from the OU VBE-User then logs on to Client

W7-100, drive E:\ will be encrypted with volume-based encryption. If both users have the same key, both can access the drives or files.

Case 2: A user from OU VBE-User logs on first to the computer W7-100 (container computer).

The drive is encrypted with volume-based encryption. If, now, a user from OU FBE-User logs on and has the same key as users from OU VBE-User, drive E:\ will be encrypted with file-based encryption within the volume-based encryption (the volume-based encryption is kept). However, if the user from OU FBE-User does not have the same key, they cannot access drive E:\.

7.3.7.9 Priority within an assignment

Within an assignment, the policy with the highest priority (1) ranks above a policy with a lesser priority.

Note: If a policy with a lesser priority, but with the property No Override is assigned to the same level as a higher ranking policy, this policy will take priority despite its lower ranking.

7.3.7.10 Priority within a group

Within a group, the policy with the highest priority (1) ranks above a policy with a lesser priority.

7.3.7.11 Status indicators

Setting status indicators allows the standard rules for policies to be changed.

■

Block policy inheritance

Set for containers for which you do not want higher-ranking policies to apply (right-click the object in the Properties navigation window).

If you do not want a container object to inherit a policy from a higher object, select Block

Policy Inheritance to prevent this. If Block Policy Inheritance has been selected for a container object it will not be affected by higher-ranking policy settings (exception: No Override activated when policy was assigned).

■

No Override

Set during assignment process this policy cannot be overridden by another policy.

The further away the policy assignment with No Override is from the target object, the stronger the effect of this policy will be for all the lower-ranking container objects. This means that a higher ranking container subject to No Override overrides the policy settings of a lower ranking

243

SafeGuard Enterprise container. So, for example a domain policy can be defined and its settings cannot be overridden, even if Block policy inheritance has been set for an OU!

Note: If a policy with a lesser priority but which has been designated No Override is assigned to the same level as a higher ranking policy, this policy will take priority despite its lower ranking.

7.3.7.12 Settings in policies

7.3.7.12.1 Replay Machine Settings

You can find this setting under:

Policy Items > policy of the type General Settings > Loading of Settings > Policy Loopback.

If you select Replay Machine Settings in the field Policy Loopback of a policy of the type

General Settings and the policy comes from a computer (Replay Machine Settings does not affect user policies), this policy is replayed at the end of the analysis. This then overrides any user settings and the machine settings apply. All machine settings inherited directly or indirectly by the machine (including policies which have not been applied by the Replay Machine Settings policy loopback) are rewritten.

7.3.7.12.2 Ignore User

You can find this setting under:

Policy Items > policy of the type General Settings > Loading of Settings > Policy Loopback.

If you select Ignore User for a policy for a computer in the field Policy Loopback of a policy of the type General Settings and the policy comes from a machine, only the machines settings are analyzed. User settings are not analyzed.

7.3.7.12.3 No Loopback

You can find this setting under:

Policy Items > policy of the type General Settings > Loading of Settings > Policy Loopback.

No Loopback describes the standard behavior. User policies take priority over computer policies.

7.3.7.12.4 Analyze the settings "Ignore User" and "Replay Machine Settings"

If there are active policy assignments, the machine policies are analyzed and consolidated first.

If, with the Policy Loopback option, this amalgamation of individual policies results in the value

Ignore User, the policies that would have been fixed for the user will not be analyzed. This means that the same policies apply both for the user and for the machine.

If, after merging the individual machine policies, the value with the Policy Loopback attribute is

Replay Machine Settings, the user policies are merged with the machine policies. After the merge, the machine policies are rewritten and, where appropriate, override settings from the user policies. If a setting is present in both policies, the machine policy value overrides the user policy value.

If the consolidation of the individual machine policies results in the standard value (No Policy

Loopback), user settings take priority over machine settings.

7.3.7.12.5 Order of the execution of policies

Ignore User Computers

244

administrator help

Replay Machine Settings Computer -> User -> Computer. The first "machine execution" is required for the policies which are written before user logon (for example background image at logon).

No Loopback (standard setting): Computer -> User

7.3.7.13 Other definitions

The decision as to whether it is a user or machine policy depends on the policy's origin. A user object "brings" a user policy, while a computer "brings" a computer policy. The same policy can be a machine or a user policy, depending on the perspective.

■

User policy

Any policy provided by the user for analysis. If a policy is implemented through only one user, the machine-related settings of that policy are not applied, this means that computer-related settings do not apply. Default values do.

■

Computer policy

Any policy provided by the machine for analysis. If a policy is implemented through just one computer, the user-specific settings for this policy are also applied! The computer policy therefore represents a policy "for all users".

7.3.8 Inventory and status data

SafeGuard Enterprise reads an extensive amount of inventory and status data from the endpoints.

This data shows the current global state of each computer. The data is displayed in the SafeGuard

Management Center in Users and Computer in the Inventory tab.

As a security officer, you can view, export and print out inventory and status data. For example, you can create compliance reports to show that endpoints have been encrypted. Wide-ranging sort and filter features are available to help you select the relevant data.

The Inventory provides for example the following data about each machine:

■

The policy applied.

■

■

The last server contact.

The encryption status of all media.

■

The POA status and type.

■

The installed SafeGuard Enterprise modules.

■

The WOL status.

■

User data.

245

SafeGuard Enterprise

7.3.8.1 Mac endpoints in the inventory

The Inventory provides status data for Macs managed in the SafeGuard Management Center.

For further information, see

Inventory and status data of Macs (page 112)

7.3.8.2 View inventory data

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the navigation window, click the relevant container (domain, workgroup or computer) on the left-hand side.

3. In the action area, switch to the Inventory tab on the right-hand side.

4. In the Filter area, select the filter to be applied on the inventory display, see

Filter inventory data

(page 246).

Note: If you are selecting a particular computer, you receive the inventory data as soon as you switch to the Inventory tab. The Filter area is not available here.

5. In the Filter area, click the magnifier icon.

The inventory and status data appears in a summarized table for all the machines in the container selected. The tabs Drives, Users and Features are also available for each machine.

By clicking a column header you can sort the inventory data based on the values of the selected column. The context menu for each column offers a number of features for sorting, grouping and customizing the display. Depending on your access rights, items in the inventory are shown in different colors:

■

■

■

Items for objects for which you have Full access rights are shown in black.

Items for objects for which you have Read only access rights are shown in blue.

Items for objects for which you have no access rights are greyed out.

7.3.8.3 Show hidden columns

Some columns in the inventory data display are hidden by default.

1. In the inventory data display, right-click the column header bar.

2. From the context menu, select Runtime Column Customization.

The Customization window is displayed showing the hidden columns.

3. Drag the required column from the Customization window to the column header bar.

The column is shown in the inventory data display. To hide it again, drag it back to the

Customization window.

7.3.8.4 Filter inventory data

When working from an OU, filters can be defined to limit the display based on a particular criteria.

The following fields are available for defining filters in the Filter area of the Inventory tab:

246

administrator help

Field

Computer name

Including subcontainers

Show last modified

Description

To display the inventory and status data for a particular computer, enter the computer's name in this field.

Activate this field, if you want to include subcontainers in the display.

Use this field to specify the number of last changes to be displayed.

You can also use the Filter Editor to create user-defined filters. You can open the Filter Editor from the context menu for each column. In the Filter Builder window, you can define your own filters and apply them to the column concerned.

7.3.8.5 Refresh inventory data

The endpoints usually send an update of the inventory data when the data have changed.

The Request Inventory Refresh command can be used to manually request a refresh of the computer's current inventory data. This command is available for a particular computer or for all the computers in a node (optionally including sub-nodes) from the context menu and the Actions menu in the SafeGuard Management Center menu bar. The command can also be selected using the context menu for the list entries.

If you select this command or click the Request Inventory Refresh icon in the toolbar, the relevant computers send their current inventory data.

As is the case with other areas in the SafeGuard Management Center, you can use the Refresh command to refresh the display.You can select this command from the context menu for individual computers or all the computers in a node and from the View menu in the menu bar. You can also use the Refresh double-headed arrow icon in the toolbar to refresh the display.

7.3.8.6 Overview

The individual columns in the overview show the following information.

Note: Some columns are hidden by default. You can customize the display to show them. For further information, see

Show hidden columns

(page 246).

Column

Machine name

Domain

Domain Pre 2000

User name (owner)

Explanation

Shows the computer's name.

Shows the computer domain name.

Shows the pre-Windows 2000 domain name.

Shows the user name of the computer's owner, if available.

247

SafeGuard Enterprise

Column Explanation

First name

Last name

Email address

Other registered users

Operating system

Last server contact

Shows the owner's first name, if available.

Shows the owner's last name, if available.

Shows the owner's Email address, if available

Shows the names of other registered users of the computer, if available.

Shows the computer's operating system.

Shows when (date and time) the computer communicated last with the server.

Last policy received

Encrypted drives

Unencrypted drives

POA type

POA

Shows when (date and time) the computer received the last policy.

Shows the computer's encrypted drives.

Shows the computer's unencrypted drives.

Specifies whether the computer is a native SafeGuard Enterprise endpoint, a BitLocker endpoint with SafeGuard Challenge/Response, a BitLocker endpoint with native recovery mechanism, a FileVault 2 endpoint or an endpoint with a self-encrypting Opal-compliant hard drive.

Specifies whether SafeGuard Power-on Authentication is activated for the computer.

Specifies whether Wake on LAN is activated for the computer.

WOL

Modification date

Refresh requested

Shows the date when the inventory data changed due to an inventory refresh request or the computer sending new inventory data.

Shows the date of the last refresh request. The value displayed in this field will be deleted, when the request is processed by the computer.

Parent DSN

Shows the Distinguished Name of the container object the computer is subordinated to. This column is only displayed, if the field Including

subcontainers has been activated in the Filter area.

Current Company certificate

Specifies whether the computer uses the current company certificate.

7.3.8.7 Drives tab

The Drives tab shows the inventory and status data for the drives on the computer concerned.

248

administrator help

Column

Drive name

Label

Type

State

Algorithm

Explanation

Shows the name of the drive.

Shows the label of a Mac drive.

Shows the drive type, for example Fixed, Removable Medium or

CD-ROM/DVD.

Shows the encryption state of a drive.

Note: If SafeGuard BitLocker management is installed on an endpoint Not prepared may be displayed as the encryption state of a drive. This indicates that the drive currently cannot be encrypted with BitLocker since necessary preparations have not been done yet. This only applies to managed endpoints since unmanaged endpoints cannot report inventory data.

For prerequisites to manage and encrypt BitLocker drives see

Prerequisites for managing BitLocker on endpoints (page 142).

The encryption state of an unmanaged endpoint can be checked with the command line tool SGNState. For details see the SafeGuard

Enterprise Tools guide.

For encrypted drives, this field shows the algorithm used for encryption.

7.3.8.8 Users tab

The Users tab shows the inventory and status data for the users on the computer.

Column

User name

Distinguished Name

User is owner

User is locked

SGN Windows user

Explanation

Shows the user name of the user.

Shows the DNS name for the user, for example:

CN=Administrator,CN=Users,DC=domain,DC=mycompany,DC=net

Indicates whether the user is defined as the computer's owner.

Indicates whether the user is locked.

Indicates whether the user is an SGN Windows user. An SGN Windows user is not added to the SafeGuard POA, but has a key ring for accessing encrypted files, just as a SGN user. You can activate the registration of SGN Windows users on endpoints by policies of the type

Specific Machine Settings.

249

SafeGuard Enterprise

7.3.8.9 Features tab

The Features tab provides an overview of all the SafeGuard Enterprise modules installed on the computer.

Column

Module name

Version

Explanation

Shows the name of the SafeGuard Enterprise module installed.

Shows the software version of the SafeGuard Enterprise module installed.

7.3.8.10 Company certificate tab

The Company Certificate tab shows the properties of the currently used company certificate and indicates whether a newer company certificate is available.

Column

Subject

Serial

Issuer

Valid from

Valid to

Newer company certificate available

Explanation

Shows the distinguished name of the subject of the company certificate.

Shows the serial number of the company certificate.

Shows the distinguished name of the issuer of the company certificate.

Shows date and time when the company certificate becomes valid.

Shows date and time when the company certificate expires.

Indicates whether a newer company certificate than the endpoint's current one is available.

7.3.8.11 Creating inventory data reports

As a security officer, you can create inventory data reports in different formats. For example, you can create compliance reports to show that endpoints have been encrypted. Reports can be printed or exported to a file.

7.3.8.11.1 Print inventory reports

1. In the SafeGuard Management Center menu bar, click File.

2. You can either print the report directly or display a print preview.

The print preview provides various features, for example for editing the page layout (header and footer etc.).

■

To get a print preview, select Print > Preview.

250

administrator help

■

To print the document without a print preview, select Print.

7.3.8.11.2 Export inventory reports to files

1. In the SafeGuard Management Center menu bar, click File.

2. Select Print > Preview.

The inventory report Preview is displayed.

The preview provides various features, for example for editing the page layout (header and footer etc.).

3. In the toolbar of the Preview window, select the drop-down list of the Export Document... icon.

4. Select the required file type from the list.

5. Specify the required export options and click OK.

The inventory report is exported to a file of the file type specified.

7.4 SafeGuard Enterprise Security Officers

SafeGuard Enterprise can be administered by one or more security officers. The role-based management of SafeGuard Enterprise allows splitting administration among several users. Any user may be assigned one or more roles. To enhance security, additional authorization of an action can be assigned to an officer's role.

During initial configuration of the SafeGuard Management Center, a top-level administrator, the

Master Security Officer (MSO), with all the rights and a certificate is created by default, see Create the Master Security Officer (MSO)

(page 37). The MSO certificate by default expires after 5 years and can be renewed in the Security Officers section of the Management Center. Further security officers can be assigned for specific tasks such as helpdesk or auditing.

In the SafeGuard Management Center navigation area, you can arrange security officers hierarchically to reflect your company's organizational structure. However, this does not imply any hierarchy in terms of rights and roles.

Note: Two security officers must not use the same Windows account on the same computer.

Otherwise it is not possible to separate their access rights properly. Additional authentication is more secure when security officers must authenticate with cryptographic tokens/smartcards.

7.4.1 Security officer roles

For easy operation, SafeGuard Enterprise offers predefined security officer roles with a variety of functions. Security officers with the necessary rights can define new roles from a list of actions/rights and assign them to particular security officers.

The following types of roles are provided:

■

Master Security Officer (MSO) role

■

Predefined roles

■

Customized roles

251

SafeGuard Enterprise

7.4.1.1 Master Security Officer

After installing SafeGuard Enterprise, a Master Security Officer (MSO) is created by default during initial configuration of the SafeGuard Management Center. The Master Security Officer is the top-level security officer, possesses all rights and is able to access all objects (similar to a Windows administrator). The Master Security Officer rights cannot be modified.

There may be several Master Security Officers created for one instance of the SafeGuard

Management Center. We strongly recommend to create at least one additional MSO for security reasons. Additional MSOs may be deleted, but there must always remain one user with the role of MSO who has been explicitly created as MSO in the SafeGuard Enterprise Database.

A Master Security Officer can delegate tasks to another person. There are two ways to do this:

■

A new security officer can be created in Security Officers.

■

A user or all members of a container imported from the Active Directory and visible in the

SafeGuard Management Center in the root directory can be promoted to security officer in

Users and Computers.

One or more roles and domains can then be assigned to them. For example, a user may be assigned the role of Supervising Officer plus the role of Helpdesk Officer.

However, the Master Security Officer can also create custom roles and assign them to particular users.

7.4.1.1.1 Export the Master Security Officer certificate

To back up the Master Security Officer certificate of the MSO logged on to the SafeGuard

Management Center:

1. In the SafeGuard Management Center menu bar, select Tools > Options.

2. Select the Certificates tab and click Export in the Certificate of <administrator> section.

3. You are prompted to enter a password for securing the exported file. Enter a password, confirm it and click OK.

4. Enter a file name and storage location for the file to be exported and click OK.

The Master Security Officer certificate of the currently logged on MSO is exported as a .p12 file to the defined location and can be used for recovery purposes.

7.4.1.2 Predefined roles

In the SafeGuard Management Center, the following security officer roles (apart from the MSO) are predefined. The assignment of rights to these predefined roles cannot be changed. For example, if a predefined role has the right to "Create policy items and policy groups", this right cannot be deleted from the role. Neither can a new right be added to a predefined role. Additional officer authentication however, may be assigned to predefined roles at any time.

■

Supervising Officer

Supervising Officers can see their own node in the Security Officers area and have the right to manage security officers belonging to their node.

■

Security Officer

252

administrator help

Security Officers have extensive rights including SafeGuard Enterprise configuration, policy and key management, permissions for monitoring and recovery.

■

Helpdesk Officer

Helpdesk Officers have the rights to perform recovery actions. Additionally, they can view most function areas of the SafeGuard Management Center.

■

Audit Officer

To monitor SafeGuard Enterprise, Audit Officers may display most function areas of the

SafeGuard Management Center.

■

Recovery Officer

Recovery Officers have the rights to repair the SafeGuard Enterprise Database.

7.4.1.3 Customized roles

As a security officer with the required rights, you can define new roles from a list of actions/rights and assign them to an existing or new security officer. As with predefined roles, you may enable the additional officer authentication for a function of the role any time.

When you assign a new role, note the following regarding additional authentication:

Note: If a user has two roles with the same rights and additional authentication is assigned to one of the roles, this automatically applies to the other role.

A security officer with the required rights may add or delete rights to or from a custom role. Unlike predefined roles, custom roles can even be deleted as required. If the role is deleted, it is no longer assigned to any user. If a user only has one role assigned and this role is deleted, the user can no longer log on at the SafeGuard Management Center.

Note: The role and the actions defined within it determine what a user may and may not do. This is also true if the user has been assigned more than one role. After the user has logged on to the

SafeGuard Management Center only those areas are activated and displayed that are needed for the respective role. This also applies to the scripts and API areas. It is therefore important to always activate the view in which the respective actions are defined. Actions are sorted by function area and hierarchically structured. This structure shows which actions are required before certain other actions can be performed.

7.4.1.4 Additional officer authentication

Additional officer authentication (also referred to as two persons rule) may be assigned to specific actions of a role. This means that the user of this role is only permitted to perform a certain action if a user of another role is present and confirms it. Each time the user performs this action another user has to confirm it.

Additional authentication may be assigned to both predefined and custom roles. As soon as there is at least one other officer with the same role, the own role can also be selected.

The role which is to perform the additional authorization must have been assigned to a user and there need to be at least two security officers in the SafeGuard Enterprise Database. Once additional authentication is required for an action, it is required even if the user owns another role that does not require additional authentication for this action.

253

SafeGuard Enterprise

If an officer without the right to change the additional authentication creates a role, settings for additional authentication of the new role will be pre-filled to match those set for the creating officer.

7.4.2 Create a role

Prerequisite: To create a new role, you need the right to display and create security officer roles.

To assign additional authentication you need the right to "Change additional authentication settings".

1. In the SafeGuard Management Center, select Security Officers.

2. Right-click Custom Roles and select New > New custom role.

3. In New custom role, enter a name and description for the role.

4. Assign the actions to this role: Select the check boxes next to the required action in the Enabled column.

Actions are sorted by function area and hierarchically structured. This structure shows which actions are required before certain other actions can be performed.

5. If required, assign Additional officer authentication: Click the default setting None and select the required role from the list.

If an officer without the right to change the additional authentication creates a role, then the additional authentication is prefilled depending on the additional authentication set for the officer's roles.

6. Click OK.

The new role is displayed in the navigation window under Custom Roles. When you click the role, the permitted actions are displayed in the action area on the right.

7.4.3 Assign a role to a security officer

Prerequisite: To assign a role, you need the right to display and modify security officers.

1. Select the respective officer in the navigation window.

Their properties are displayed in the action area on the right.

2. Assign the required roles by selecting the relevant boxes next to the available roles.

Predefined roles are displayed in bold.

3. Click the double-headed arrow symbol Refresh in the toolbar.

The role is assigned to the security officer.

Note: Complex customized roles may cause slight performance issues in using the SafeGuard

Management Center.

7.4.4 Displaying officer and role properties

Prerequisite: To get an overview of the security officer properties or the role assignment, you need the right to display security officers and security officer roles.

254

administrator help

To display security officer and role properties:

1. In the SafeGuard Management Center, click Security Officers.

2. In the navigation area on the left, double-click the object you want to get an overview of.

The information displayed in the action area on the right depends on the object selected.

7.4.4.1 Display MSO properties

The general and modification information of the MSO is displayed.

7.4.4.2 Display security officers properties

The general and modification information for the security officer is displayed.

1. In Properties, select the Actions tab to display a summary of actions permitted and the roles assigned to the security officer.

7.4.4.3 Display security officers rights and roles

A summary of actions of all roles assigned to the security officer is displayed. The tree view shows what actions are required before certain other actions can be performed. Additionally, the assigned roles can be displayed.

1. In the <Security officer name> properties dialog, on the Actions tab, select an action to display all assigned roles that contain this action.

2. Double-click a role in the Assigned roles with selected action list. The <Security officer

name> properties dialog is closed and the role's properties are displayed.

7.4.4.4 Display role properties

The general and modification information for the role are displayed.

1. In Properties, select the Assignment tab to display the security officers assigned to this role.

7.4.4.5 Display role assignment

1. In the <Role name> Properties, on the Assignment tab, double-click a security officer. The

Properties dialog is closed and the security officer's general data and roles are displayed.

7.4.5 Modifying a role

You can do the following:

■

Modify additional authentication only.

■

Modify all properties of the role.

The icon next to the roles shows which action is available:

255

SafeGuard Enterprise

Icon Description

The role can be modified (add/remove actions).

Additional authentication can be changed.

Both modifications are available.

Note: Predefined roles and the actions assigned to them cannot be modified. If additional authentication is activated, it can be modified for any role, even for predefined roles.

7.4.5.1 Modify additional authentication only

Prerequisite: To assign additional authentication, you need the right to display security officer roles and to "Change additional authentication settings".

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window under Custom Roles, click the role you want to change. In the action area on the right, click the required setting in the Additional security officer authentication column and select a different role from the list.

Predefined roles are displayed in bold.

3. Click the Save icon in the toolbar to save your changes to the database.

Additional officer authentication has been changed for this role.

7.4.5.2 Modify all properties of a role

Prerequisite: To change a custom role, you need the right to display and modify security officer roles. To reassign additional authentication, you also need the right to "Change additional authentication settings".

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window under Custom Roles, right-click the role you want to change and select Modify custom role.

3. Change the properties as required. Change additional authentication properties by clicking the value in this column and selecting the required role.

4. Click the Save icon in the toolbar to save your changes to the database.

The role has been modified.

256

administrator help

7.4.6 Copy a role

To create a new role that has similar properties as an existing role, you can use the existing role as a template for the new role. You can select a predefined or custom role as a template.

Prerequisite: You can only use existing roles as templates, if the currently authenticated security officer has all the rights contained in the specific role template. So, this function may be disabled for officers with a limited set of actions.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window, right-click the role you want to copy and select New > New copy

of role. In New custom role, all properties of the existing role are already preselected.

3. Enter a new name for this role and change the properties as required.

4. Click the Save icon in the toolbar to save your changes to the database.

The new role is created.

7.4.7 Delete a role

Note: Predefined roles cannot be deleted.

Prerequisite: To delete a role, you need the right to display and delete security officer roles.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window under Custom Roles, right-click the role you want to delete and select Delete. Depending on the role's properties a corresponding warning message will be displayed.

Note: When you delete a role, all security officers this role is assigned to lose it. If the role is the only one assigned to a security officer, the security officer can no longer log on to the

SafeGuard Management Center unless a superior security officer assigns a new role to the security officer. If the role is used for additional authentication, the MSO will be requested to perform additional authentication.

3. To delete the role, click Yes in the warning message.

4. Click the Save icon in the toolbar to save your changes to the database.

The role is deleted from the navigation window and from the database.

7.4.8 Create a Master Security Officer

Prerequisite: To create a new Master Security Officer, you need the right to display and create security officers.

Note: A quick way of creating new Master Security Officers is to promote a Security Officer. For further information, see

Promoting security officers

(page 263).

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window, right-click the Master Security Officers node and select New >

New Master Security Officer.

257

SafeGuard Enterprise

3. Make the relevant entries in New master security officer:

Field/check box

Enabled

Name

Description

Cell phone

E-Mail

Token logon

Description

The security officer can be deactivated until further notice. This means that the security officer is in the system, but they cannot log on to the SafeGuard

Management Center yet. They can only log on and perform their administrative tasks when another security officer activates them.

Enter the name of the security officer as given in the certificates created by

SafeGuard Enterprise in cn =. The security officer is also displayed under this name in the SafeGuard Management Center navigation window. This name must be unique.

Maximum value: 256 characters

Optional

Maximum value: 256 characters

Optional

Maximum value: 128 characters

Optional

Maximum value: 256 characters

The logon can be done in the following way:

No token The security officer may not log on with a token. They have to log on by entering the logon information (user name/password).

Optional Logon can be either with a token or by entering the logon information.

The security officer is free to choose.

Mandatory A token has to be used to log on. To do this, the private key that belongs to the security officer's certificate must be on the token.

258

administrator help

Field/check box

Certificate

Certificate

Description

A security officer always needs a certificate to log on to the SafeGuard

Management Center. The certificate can either be created by SafeGuard

Enterprise or an existing one can be used. If token logon is essential, the certificate has to be added to the security officer's token.

Create:

The certificate and key file are created and saved in a selected location. Enter and confirm a password for the .p12 key file. The .p12 file must be available to the security officer when logging on. The certificate created is automatically assigned to the security officer and displayed in Certificate. If SafeGuard

Enterprise password rules are used, rules in the Active Directory should be deactivated.

Note: Max. length of path and file name: 260 characters. When creating a security officer, the certificate's public part is sufficient. When logging on to the

SafeGuard Management Center, however, the certificate's private section (the key file) is also required. If it is not available in the database, it must be available to the security officer (for example on a memory stick) and may be stored in the certificate store during logon.

Import:

An existing certificate is used which is assigned to the security officer during import. If the import is from a .p12 key file, the certificate's password must be known.

If a PKCS#12 certificate container is selected, all certificates are loaded into the list of assignable certificates. The certificate is then assigned after the import, by selecting the certificate from the drop-down list.

4. Click OK to confirm.

The new Master Security Officer is displayed in the navigation window under the Master Security

Officers node. Their properties can be displayed by selecting the respective security officer in the navigation window. The MSO can log on to the SafeGuard Management Center with the name displayed.

7.4.9 Create a security officer

Prerequisite: To create a security officer, you need the right to display and create security officers.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window right-click the security officer’s node where you want to locate the new security officer and select New > New Security Officer.

259

SafeGuard Enterprise

3. Make the relevant entries in the New security officer dialog:

Field/check box

Enabled

Name

Description

Cell phone

E-Mail

Validity

Token logon

Description

The security officer can be deactivated until further notice. This means that the security officer is in the system, but they cannot log on to the

SafeGuard Management Center yet. They can only log on and perform their administrative tasks when another security officer activates them.

Enter the name of the security officer as provided in the certificates created by SafeGuard Enterprise in cn =. The security officer is also displayed under this name in the SafeGuard Management Center navigation window. This name must be unique.

Maximum value: 256 characters

Optional

Maximum value: 256 characters

Optional

Maximum value: 128 characters

Optional

Maximum value: 256 characters

Select from when and to when (date) the security officer should be able to log on to the SafeGuard Management Center.

The logon can be done in the following way:

No token The security officer may not log on with a token. They have to log with their credentials (user name/password).

Optional Logon can be either with a token or with the credentials. The security officer is free to choose.

Mandatory A token has to be used to log on. To do this, the private key that belongs to the security officer's certificate must be on the token.

260

administrator help

Field/check box

Certificate

Description

A security officer always needs a certificate to log on to the SafeGuard

Management Center. The certificate can either be created by SafeGuard

Enterprise or an existing one can be used. If token logon is essential, the certificate has to be added to the security officer's token.

Create:

The certificate and key file are created as new and saved in a selected location. Enter and confirm a password for the .p12 key file. The .p12 file must be available to the security officer when logging on. The certificate created is automatically assigned to the security officer and displayed in

Certificate. If SafeGuard Enterprise password rules are used, rules in the Active Directory should be deactivated.

Note: Max. length of path and file name: 260 characters. When creating a security officer, the certificate's public part is sufficient. When logging on to the SafeGuard Management Center, however, the certificate’s private section (the key file) is also required. If it is not available in the database, it must be available to the security officer (for example on a memory stick) and may be stored in the certificate store during logon.

Certificate Import:

An existing certificate is used which is assigned to the security officer during import. If the import is from a .p12 key file, the certificate's password must be known.

If a PKCS#12 certificate container is selected, all certificates are loaded into the list of assignable certificates. The certificate is then assigned after the import, by selecting the certificate from the drop-down list.

Security Officer Roles Roles

Predefined or custom roles can be assigned to the security officer. The rights associated with each role are displayed under Action Permitted in the action area when clicking the respective role or when right-clicking the security officer and selecting Properties, Actions. More than one role can be assigned to a user.

4. Click OK to confirm.

The new security officer is displayed in the navigation window under the respective Security

Officers node. Their properties can be displayed by selecting the respective security officer in the navigation window. The security officer can log on to the SafeGuard Management Center with the name displayed. Next you need to assign directory objects/domains to the security officer so they can perform their tasks.

261

SafeGuard Enterprise

7.4.10 Assigning directory objects to a security officer

For security officers to be able to perform their tasks they need to have access rights to directory objects. Access rights can be granted to domains, organizational units (OUs) and user groups as well as to the ".Auto registered" node under the Root directory.

In Users and Computers, you can change the access rights of another security officer if you have full access for the relevant container and are responsible for the security officer in question.

You cannot change your own access rights. If you assign a security officer to a directory object for the first time, the security officer inherits your access rights for this container.

Note: You cannot grant higher access rights than your own access rights to other security officers.

Prerequisite: If you want to grant/deny a security officer the right to access and manage directory objects, you need the "Users and Computers" rights "Display security officers access rights" and

"Grant/deny access rights to directory". In addition, you need Full access rights for the relevant directory objects.

1. In the SafeGuard Management Center, select Users and Computers.

2. In the navigation window on the left, select the required directory objects.

Note: The navigation tree only shows the directory objects you have access rights for. If you have Full access rights, the object is displayed in black. Objects with Read only access are displayed in blue. A node that is greyed out cannot be accessed but is still shown, if there are nodes below that you have access to.

3. In the action area on the right, click the Access tab.

4. To assign rights for the selected objects, drag the required officer from the far right into the

Access table.

5. In the Access Rights column, select the rights you want to grant the security officer for the selected objects:

■

■

■

Full Access

Read only

Denied

To unassign the rights granted for the selected objects, drag the security officer back to the

Officers table.

6. Click the Save icon in the toolbar to save the changes to the database.

The selected objects are available to the relevant security officer.

Note: If two security officers are working on the same SafeGuard Enterprise Database at the same time and one is changing access rights, a message is displayed to inform the other security officer and any unsaved changes are lost. If a security officer loses the access rights for a node completely, access is no longer granted and a relevant message is displayed. The navigation window is refreshed accordingly.

7.4.10.1 View security officer rights for directory objects

The access rights assigned to security officers for directory objects are displayed in the Access tab of the relevant objects in Users and Computers.

262

administrator help

Note: The Access tab only shows the access rights for containers you have access rights for.

Likewise, it only shows the security officers you are responsible for.

The Access tab shows the following information:

■

■

■

■

■

The Officers column shows the types and names of the security officers assigned to the directory objects.

The Assigned by column shows the security officer who has assigned the access rights.

The Assignment Date

The Access Rights column shows the rights granted: Full Access, Denied or Read only.

The Origin column shows the full name of the node where the access right was assigned to the corresponding officer. For example: If the right was assigned to a parent node of the directory object selected, the parent node is displayed here. In this case, the security officer has inherited the access right for the selected directory object by the assignment to its parent node.

■

The Status column shows how the security officer has received the access right:

■

Inherited (blue text color): The access right has been inherited from a parent node.

■

■

Overwritten (brown text color): The access right has been inherited from a parent node, but changed at the selected node by direct assignment.

Directly assigned (black text color): The access right has been assigned directly at the selected node.

For inherited rights, you can display a tooltip in the Status column showing the origin of the relevant right.

7.4.11 Promoting security officers

You may do the following:

■

Promote a user to security officer in the Users and Computers area.

■

Promote a security officer to Master Security Officer in the Security Officers area.

7.4.11.1 Prerequisites for promoting a user

A security officer with the required rights can promote users to security officers and assign roles to them.

Security officers created in this way can log on to the SafeGuard Management Center with their

Windows credentials or their token/smartcard PIN. They can operate and be administrated just like any other security officers.

The following prerequisites must be met:

■

Users to be promoted must have been imported from an Active Directory and need to be visible in the SafeGuard Management Center Users and Computers area.

■

To enable a promoted user to log on to the SafeGuard Management Center as a security officer, a user certificate is required.You can create this certificate when you promote the user,

263

SafeGuard Enterprise see

Promote a user to security officer (page 264). For logon with the Windows credentials, the

.p12 file containing the private key must exist in the SafeGuard Enterprise Database. For logon with token or smartcard PIN, the .p12 file containing the private key must reside on the token or smartcard.

Note: If you create the certificate when you promote a user, they have to use the certificate password to log on to the SafeGuard Management Center. They have to enter the certificate password although they are prompted for the Windows password. This is also true when logging on to the SafeGuard Enterprise Web Help Desk.

7.4.11.2 Promote a user to security officer

Prerequisite: To promote a user, you need to be a Master Security Officer or a security officer with the required rights.

1. In the SafeGuard Management Center, select Users and Computers.

2. Right-click the user you want to promote to security officer and select Make this user a

Security Officer.

3. The next step depends on whether a user certificate is available for the selected user.

■

If a user certificate has already been assigned to this user, the Select role(s) dialog is displayed. Continue with step 4.

■

If no user certificate is available, a message is displayed asking you whether a self-signed key pair should be created for this user. Click Yes and enter and confirm a password in the Password for new certificate dialog. Now the Select role(s) dialog is displayed.

4. In the Select role(s) dialog, select the required roles and click OK.

The user is now promoted and displayed in the Security Officers area with their user name.

Their properties can be displayed by selecting the respective officer in the navigation window. If the user's private key is stored in the database, No token is activated. If the user's private key resides on the token or smartcard, Optional is activated.

You may drag-and-drop the security officer to the required position in the Security Officers tree view if required.

The security officer can log on to the SafeGuard Management Center with the name displayed.

7.4.11.3 Promote a security officer to Master Security Officer

Prerequisite: To promote a security officer, you need the right display and modify security officers.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window, right-click the security officer you want to promote and select Promote

to Master Security Officer.

3. If the promoted officer has children you are prompted to select a new parent node for the children.

The security officer is promoted and displayed under the Master Security Officers node. As a

Master Security Officer, the promoted officer will receive all rights to all objects and thus lose all assigned roles and all individually granted domain access in Users and Computers.

264

administrator help

7.4.12 Demote Master Security Officers

Prerequisite: To demote Master Security Officers to security officers you need to be a Master

Security Officer.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window, right-click the Master Security Officer you want to demote and select

Demote to security officer.

3. You are prompted to select a parent node for the officer and to assign at least one role.

The security officer is demoted and displayed under the selected Security Officers node. The demoted officer loses all rights to all objects and only receive those rights that are assigned to their role(s). A demoted officer does not have any rights on domains. You need to individually grant domain access rights in the Users and Computers area under the Access tab.

7.4.13 Change the security officer certificate

Prerequisite: To change the certificate of a security officer or Master Security Officer, you need the right to display and modify security officers.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window, click the security officer you want to change the certificate for. The current certificate assigned is displayed in the action area on the right in the Certificates field.

3. In the action area, click the Certificates drop-down list and select a different certificate.

4. Click the Save icon in the toolbar to save the changes to the database.

7.4.14 Arrange security officers in the tree view

Security officers can be hierarchically arranged in the Security Officers navigation window to reflect the company's organizational structure.

The tree view can be arranged for all security officers, except for Master Security Officers. MSOs are displayed in a flat list under the MSO node. The security officers node contains a tree view where each node represents a security officer. However, this does not imply any hierarchy in terms of rights and roles.

Prerequisite: To move a security officer in the tree view you need the right to display and modify security officers.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window, drag-and-drop the officer you want to move to the respective node.

All children of the selected officer will also be moved.

7.4.15 Fast switching of security officers

For your convenience, you may quickly restart the SafeGuard Management Center, to log on as a different officer.

1. In the SafeGuard Management Center, select File > Change Officer. The SafeGuard

Management Center is restarted and the logon dialog is displayed.

265

SafeGuard Enterprise

2. Select the security officer you want to use to log on to the SafeGuard Management Center and enter their password. If you are working in Multi Tenancy mode, you are logged on to the same database configuration.

The SafeGuard Management Center is restarted displaying the view assigned to the logged on officer.

7.4.16 Delete a security officer

Prerequisite: To delete a security officer or Master Security Officer, you need the right to display and delete security officers.

1. In the SafeGuard Management Center, select Security Officers.

2. In the navigation window, right-click the security officer or Master Security Officer you want to delete and select Delete. Note that you cannot delete the officer you are logged on with.

3. If the officer has children, you are prompted to select a new parent node for the children.

The officer is deleted from the database.

Note: A Master Security Officer explicitly created as an officer and not only promoted to security officer must always remain in the database. If a user promoted to security officer is deleted from the database, their user account is deleted from the database as well.

Note: If the officer to be deleted has been assigned a role that includes additional authentication and the officer is the only one this role is assigned to, the officer will be deleted nonetheless. It is assumed that the Master Security Officer will be able to take over additional authorization.

7.5 Managing the organizational structure

The organizational structure can be reflected in the SafeGuard Management Center in two ways:

■

You can import an existing organizational structure into the SafeGuard Enterprise Database, for example through an Active Directory.

■

You can manually create your organizational structure by creating workgroups and domains along with a structure for managing policy items.

7.5.1 Importing from Active Directory

You can import an existing organizational structure into the SafeGuard Enterprise Database through an Active Directory.

Note: An initial import is triggered by the SafeGuard Management Center Configuration Wizard.

When running the wizard, you may skip this step and you can manually configure your Active

Directory import later.

We recommend that you create one dedicated Windows service account that is used for all import and synchronization tasks. For more information, see Sophos knowledgebase article 107979 .

With the SafeGuard Management Task Scheduler, you can create periodic tasks for automatic synchronization between Active Directory and SafeGuard Enterprise. Your product delivery contains a predefined script template for this purpose. For further information, see

Scheduling tasks (page 305) and

Predefined scripts for periodic tasks

(page 311).

266

administrator help

Note: We recommend that you divide the import of more than 400,000 objects from AD into multiple operations. This may not be possible if there are more than 400,000 objects in a single organizational unit.

7.5.1.1 Security officer access rights and Active Directory import

You need to make sure you have the appropriate access rights when importing the organizational structure. The following information tells you about the access rights requirements.

■

If you add an Active Directory connection to a domain that already exists, the following applies:

■

If you have Full access rights for the domain (DNS), the directory connection credentials are updated.

■

If you have Read only rights or less for the domain (DNS), the credentials are not updated, but you can use existing credentials for synchronization purposes.

■

■

■

For Active Directory import and synchronization, the access rights to a container or a domain are projected to the domain tree you import or synchronize. If you do not have Full access rights for a sub-tree, it cannot be synchronized. If a sub-tree cannot be modified, it is not shown in the synchronization tree.

Regardless of your security officer access rights for directory objects, you can import a new domain from the Active Directory, if it does not exist in the SafeGuard Enterprise Database yet. You and your superior security officers will be granted Full access rights to the new domain automatically.

If you select a sub-container for synchronization, synchronization has to be done all the way up to the root. In the synchronization tree, all relevant containers are selected automatically, even if there are any containers above the sub-container that are Read only or Denied according to your access rights. If you deselect a sub-container, you also may have to deselect containers up to the root, depending on your access rights.

If a group with Read only or Denied access is included in a synchronization process, the following happens:

■

The group's memberships are not updated.

■

■

If the group was deleted in the Active Directory, it will not be deleted from the SafeGuard

Enterprise Database.

If the group was moved in the Active Directory however, it will be moved within the

SafeGuard Enterprise structure. This includes moving the group to a container that you do not have Full access rights for.

If a container with Read only or Denied access is included in the synchronization because it is on the way up to the root and the container contains a group with Full access, this group will be synchronized. Groups with Read only or Denied access will not.

7.5.1.2 Import or synchronize the organizational structure

Note: If you want to update the organizational structure in Management Center, start with step

4.

1. In the SafeGuard Management Center, select Tools > Options.

2. Select the Directory tab and click Add.

267

SafeGuard Enterprise

3. In LDAP Authentication, do the following: a) For Server name or IP, enter the NetBIOS name of the domain controller or its IP address.

b) For User Credentials, enter your Windows user name and password for the environment.

c) Click OK.

Note: For Windows single computers, a directory must be shared to enable a connection through LDAP.

4. Click Users and Computers.

5. In the left-hand navigation window, click the root directory Root [filter is active].

6. In the action area on the right, select the Synchronize tab.

7. Select the required directory from the Directory DSN list and click the magnifier icon (top right).

A graphical representation of the Active Directory structure of the organizational units (OU) in your company is displayed.

8. Check the organizational units (OU) to be synchronized. You do not need to import the entire contents of the Active Directory.

9. To also synchronize memberships, select the check box Synchronize memberships.

10. To also synchronize the user enabled state, select the check box Synchronize user enabled

state.

11. When you synchronize disabled user accounts from Active Directory, they are disabled in

SafeGuard Enterprise as well. For security reasons, re-enabling the account in Active Directory and synchronizing it again does not enable the user account in SafeGuard Enterprise automatically. To synchronize these accounts as well, you have to activate the Synchronize

user enabled state option.

12. At the bottom of the action area, click Synchronize.

When synchronizing users and their group memberships, the membership to a "primary group" is not synchronized as it is not visible for the group.

The domains are synchronized. Synchronization details are displayed. Click on the message displayed in the status bar beneath the buttons on the left to view a synchronization protocol.

Click on the protocol, to copy it to the clipboard and paste it into an e-mail or file.

Note: If elements have been moved from one subtree to another in Active Directory, both subtrees have to be synchronized with the SQL database. Synchronizing just one subtree will result in deleting instead of moving the objects.

7.5.1.3 Import a new domain from an Active Directory

1. In the left-hand navigation window, click the root directory Root [filter is active].

2. Select File > New > Import domain from Active Directory.

3. In the action area on the right, select Synchronize.

4. Select the required directory from the Directory DSN list and click the magnifier icon (top right).

A graphical representation of the Active Directory structure of the organizational units (OU) in your company is displayed.

268

administrator help

5. Check the domain to be synchronized and click Synchronize at the bottom of the navigation area.

Note: If elements have been moved from one subtree to another in Active Directory, then both subtrees have to be synchronized with the SQL database. Synchronizing just one subtree results in deleting instead of moving the objects.

Note: AD synchronization does not synchronize the pre-Windows 2000 (NetBIOS) name of the domain, if the Domain Controller is configured with an IP address. Configure the Domain Controller to use the server name (NetBIOS or DNS) instead. The client (on which the AD synchronization is running) must be either part of the domain, or it must be able to resolve the DNS name to the target Domain Controller.

7.5.1.4 Import users and computers from Active Directory on container level

If you already have an existing organizational structure in the SafeGuard Management Center and if you have the right to import directory objects, you can import users and computers from

Active Directory on the container level. Only new or moved users or computers of the selected container and its subcontainers will be synchronized.

1. In the SafeGuard Management Center, click Users and Computers.

2. In the left-hand navigation window, right-click on the container whose users and computers you want to synchronize.

3. In the context menu, click on New and then on Import users and computers from Active

directory.

The Import Users and Computers from Active Directory dialog is displayed and the import starts.

The result of the import will be listed. Name, logon name, and the status of the imported users and computers are shown. Status can be Imported or Moved.

4. Click Close.

The users and computers are displayed in the left-hand navigation window.

7.5.1.5 Search and import users and computers

Note: To do this, you must have the right to import directory objects.

If you already have an existing organizational structure in the SafeGuard Management Center you can search for Active Directory users and computers and import them directly into the organizational structure.

1. In the navigation area of the SafeGuard Management Center, click Users and Computers.

2. In the Users and Computers navigation area, click the root directory Root [filter is active].

3. In the SafeGuard Management Center menu bar, click Edit > Find.

The Find Users, Computers and Groups dialog is displayed.

4. Select the Active Directory tab.

5. Select the required filter from the Find drop-down list.

6. On the In drop-down list, select the domain in which you want to search.

269

SafeGuard Enterprise

7. If you search for a specific user or computer, enter the required name in the Search Name field.

8. Click Find now.

The search result is displayed on the Active Directory tab. All new objects have a check box on the left-hand side.

9. Select the objects you want to import.

10. Click on Import selected.

The objects are imported and displayed in the left-hand navigation window.

11. Click Close.

7.5.2 Creating workgroups and domains

Security officers with the necessary rights can manually create workgroups or domains along with a structure for managing policy items. It is also possible to assign policies and/or encryption policies to local users.

You only have to manually create domains, if you do not want to or you cannot import a domain from an Active Directory (AD), for example because there is no AD available.

7.5.2.1 Register as a new user

For information on users logging on to SafeGuard Enterprise for the first time, see

SafeGuard

Power-on Authentication (POA) (page 177).

When a new user logs on to SafeGuard Enterprise once their endpoint has contacted the

SafeGuard Enterprise Server, they are registered and automatically displayed in the Users and

Computers area of the SafeGuard Management Center under their respective domain or workgroup.

The directory for these users/computers (.Auto registered) is automatically created under the root directory and under each domain/workgroup. It cannot be renamed nor moved. Objects in this directory cannot be moved manually either. When the organizational unit (OU) is synchronized with the next contact to the SafeGuard Enterprise Database, the object is moved to the respective

OU. Otherwise it remains under the .Auto registered directory of their domain/workgroup.

As a security officer you can then manage the auto-registered objects as usual.

Note: Local users cannot log on to SafeGuard Enterprise with an empty password. Local users who log on to SafeGuard Enterprise with an empty password remain guest users and are not saved to the database. If Windows Autologon is activated for these users, logon is denied. For a successful logon at SafeGuard Enterprise, a new password must be created in this case and

Windows Autologon must be deactivated in the registry of the endpoint.

Note: Microsoft accounts are always handled as SafeGuard Enterprise guest users.

7.5.2.2 Examples for auto-registration

Below you find two examples for the behavior of auto-registered objects.

Users/computers not part of an Active Directory

270

administrator help

In a company, not all user or computer objects may necessarily be part of an Active Directory

(AD), for example local users. A company may have one or several workgroups so that an AD is not needed.

This company wants to deploy SafeGuard Enterprise and then add policies to its user/computer objects. Therefore the company's organizational structure is created manually in the SafeGuard

Management Center as follows:

The objects remain in the .Auto registered folder. They can be properly managed with the

SafeGuard Management Center by applying policies to the .Auto registered folder.

SafeGuard Enterprise Database and Active Directory out of sync

A user is already part of the company's Active Directory (AD). But the SafeGuard Enterprise

Database and the AD are out of sync. The user (User 1) logs on to SafeGuard Enterprise and is automatically displayed in the SafeGuard Management Center Users and Computers area under the domain that is provided with the logon (Domain 1).

The user is now part of the .Auto registered folder. The object can be properly managed with the

SafeGuard Management Center by applying policies to the .Auto registered folder.

Upon the next synchronization between the AD and the SafeGuard Enterprise Database User 1 is automatically moved to their organizational unit (Users).

For policies to become active for User 1, they must be assigned to the organizational unit Users from now on.

271

SafeGuard Enterprise

7.5.2.3 Keys and certificates for auto-registered objects

For each auto-registered object, a certificate is generated as required by the server.

A local user gets two keys:

■ the key to the .Auto registered container

■ the private key generated as required by the server

Local users neither get any other keys for their assigned container nor a root key.

Workgroups do not get a key.

7.5.2.4 Policies for auto-registered objects

For auto-registered objects, policies can be created without any restrictions.

Local users are added to the "Authenticated Users" group. Computers are added to the

"Authenticated Computers" group. The policies activated for these groups apply accordingly.

7.5.2.5 Create workgroups

Security officers with the required rights can create a container under the root directory which represents a Windows workgroup. Workgroups do not have a key. They cannot be renamed.

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation window on the left, right-click Root [Filter is active] and select New > Create

new workgroup (auto registration).

3. Under Common information, do the following: a) Enter a Full name for the workgroup.

b) Optionally you can add a description.

c) The object type is displayed in the Connection state field, in this case Workgroup.

d) To prevent policy inheritance, you can select Block Policy Inheritance.

e) Click OK.

The workgroup is created. The default .Auto registered directory is automatically created under the workgroup container. It cannot be renamed or deleted.

7.5.2.6 Delete workgroups

To delete workgroups you need Full access rights for the workgroup concerned. Members assigned to the workgroup are also deleted. They are automatically re-registered at next logon.

To delete a workgroup, you need Full access rights for all objects involved.

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation window on the left, right-click the workgroup you want to delete and select

Delete.

3. Click Yes to confirm.

272

administrator help

The workgroup is deleted. Any members are also deleted.

Note: If you do not have Full access rights for all members of the workgroup, deleting the workgroup fails and an error message is displayed.

7.5.2.7 Create a new domain

Security officers with the required rights can create a new domain under the root directory. You only have to create a new domain, if you do not want to or you cannot import a domain from the

Active Directory (AD) (for example because there is no AD available).

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation window on the left, right-click Root [Filter is active] and select New > Create

new domain (auto registration).

3. Under Common information, enter the following information about the domain controller.

All two name entries must be correct. Otherwise the domain will not be synchronized.

a) Full name: For example computer name.domain.com or the IP address of the domain controller b) Distinguished name (read-only): DNS name, for example

DC=computername3,DC=domain,DC=country

c) A domain description (optional) d) Netbios name: Name of the domain controller e) The object type is displayed under Connection state, in this case Domain.

f) To prevent policy inheritance, you can select Block Policy Inheritance.

g) Click OK.

The new domain is created. Users and/or computers are automatically assigned to this domain during auto-registration. The default .Auto registered directory is automatically created under the domain container. It cannot be renamed or deleted.

7.5.2.8 Rename a domain

Security officers with the required rights can rename a domain and define additional properties.

You need Full access rights for the relevant domain.

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation window on the left, right-click the domain you want to rename and select

Properties.

3. In Common information under Full name, change the domain name and the description.

4. You can change the name of the domain controller in Netbios name.

5. You can also define the Wake on LAN mode for automatic restart in the Container Settings tab.

6. Click OK to confirm.

The changes are now saved.

273

SafeGuard Enterprise

7.5.2.9 Delete a domain

Security officers with the required rights can delete domains. To delete a domain, you need Full

access rights for the domain concerned.

Note: Members assigned to the domain are also deleted.

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation window on the left, right-click the domain you want to delete and select Delete.

3. Click Yes.

The domain is deleted. Any members are also deleted.

Note: If you have less than Full access rights for all members of the domain, deleting the domain fails and an error message is displayed.

7.5.2.10 Delete auto registered computers

When an auto-registered computer is deleted, all local users of this computer are also deleted.

They are automatically re-registered the next time they log on to this computer.

7.5.2.11 Filter for local objects

7.5.2.11.1 Users and Computers

In Users and Computers, you can filter the view in the navigation area on the left according to local users or search for specific local users.

1. In the SafeGuard Management Center, click Users and Computers.

2. In the bottom left of the navigation window, click Filter.

3. Select Local User as Type. If you are looking for a specific user, enter the name of this user.

4. Click the magnifier icon.

The Users and Computers view is filtered according to the criteria.

Note: Microsoft accounts are always handled as SafeGuard Enterprise guest user.

7.5.2.11.2 Log events for users, computers or workgroups

Successful/unsuccessful registrations of users, computers or workgroups are logged. You can view a list of these events in the SafeGuard Management Center under Reports in the Event viewer.

7.6 Keys and Certificates

When importing the directory structure, SafeGuard Enterprise in its default setting automatically generates keys for:

■

■

Domains

Containers/OUs and assigns them to the corresponding objects. Computer and user keys are generated as required.

Keys for groups

274

administrator help

In its default setting, SafeGuard Enterprise does not automatically generate keys for groups. This behavior is deactivated by default. As a security officer, you can change this behavior on the Keys tab by selecting Tools > Options. If Groups is checked on the Keys tab, SafeGuard Enterprise automatically generates group keys, when the database is synchronized. At the bottom of the

Synchronization tab it is indicated for which items keys are generated when synchronization is performed.

Keys cannot be deleted! They are retained permanently in the SafeGuard Enterprise Database.

The first time an endpoint is started, SafeGuard Enterprise generates a computer key for that endpoint (defined machine key).

Note: The defined machine key is only generated when volume-based encryption is installed on the endpoint.

Each user obtains all their keys at logon from their user key ring. The user key ring comprises the following:

■

■ the keys of the groups of which the user is a member the keys of the overall Container/OUs of the groups of which the user is a member.

The keys in the user key ring determine the data which that user can access. The user can only access data for which they have a specific key.

Note: To avoid showing too many unused group keys in the user's key ring, you can specify keys to be hidden. For further information, see

Hide keys

(page 277).

To display all keys for a user, click Users and Computers and select the Keys tab.

To display all keys, click Keys and Certificates in the SafeGuard Management Center and select

Keys. You can generate lists for Assigned Keys and Inactive Keys.

Note: The Assigned Keys list only shows the keys assigned to objects for which you have Read

only or Full access rights. The Keys view shows the number of all available keys, regardless of your access rights. The Assigned Keys list shows the number of keys visible according to your access rights.

1. Click Users and Computers to open the display.

2. The keys of a selected object are displayed in the action area and in the respective views.

3. The display in the action area depends on what is selected in the navigation area. All keys assigned to the selected object are displayed.

4. Under Available Keys, all available keys are displayed. Keys already assigned to the selected object are grayed out. Select Filter to switch between keys already assigned to an object

(active) and keys not yet assigned to an object (inactive).

After the import, each user receives a number of keys which can be used for data encryption.

7.6.1 Keys for data encryption

Users are assigned keys for the encryption of specific volumes when defining policies of the type

Device Protection.

In a policy of the type Device Protection, you can specify the setting Key to be used for

encryption for each media.

275

SafeGuard Enterprise

Here you decide which keys a user can or must use for encryption:

■

Any key in user key ring

After users have logged on to Windows, they can select the keys they would like to use to encrypt a particular volume. A dialog is displayed in which users can select the required key.

■

Any key in user key ring, except user key

Users may not use their own personal key to encrypt data.

■

Any group key in user key ring

Users may only select one of the group keys in their user key ring.

■

Defined machine key

The defined machine key is the unique key generated exclusively for this computer by

SafeGuard Enterprise during the first startup. The user has no other options. A defined machine key is typically used for the boot and system partition and for drives on which Documents and

Settings are located.

■

Defined key on list

This option allows you to define a specific key which the user must use for encryption. To specify a key for a user in this way, you must define a key under Defined key for encryption.

This option is displayed once you select Defined key on list.

Click the [...] button next to Defined key for encryption to display a dialog in which you can specify a key. Make sure that the user also has the corresponding key.

Mark the selected key and click OK. The selected key will be used for encryption on the endpoint computer.

7.6.1.1 Assign keys in Users and Computers

To assign keys to users, you need Full access rights for the relevant object.

To assign a new key to users:

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation area, select the required object (for example user, group or container).

3. Right-click in the Keys tab and select Assign new key from the context menu.

4. In the Assign New Key dialog: a) Enter a Symbolic name and Description for the key.

b) To hide the key in the user's key ring, select the Hide key check box.

5. Click OK.

The key is assigned and displayed in the Key tab.

276

administrator help

7.6.1.2 Hide keys

To avoid showing too many unused group keys in a user's key ring on the endpoint, you can define keys to be hidden. Keys which are not shown in the user’s key ring can still be used to access encrypted files, but not to encrypt new ones.

To hide keys:

1. In the SafeGuard Management Center, click Keys and Certificates.

2. In the navigation area, click Keys and select Assigned Keys.

The Assigned Keys view is displayed showing the Hide Key column.

3. There are two ways to specify that keys are to be hidden:

■

Select the check box in the Hide Key column for the required key.

■

Select one or several keys and right-click to open a context menu.

Select Hide Key From User.

4. Save your changes to the database.

The specified keys are not shown in the user's key ring.

For information on displaying the user's key ring on the endpoint, see the SafeGuard Enterprise

user help, chapter System Tray Icon and tool tips.

Note: If a policy specifies a hidden key to be used for encryption, the Hide Key setting does not affect encryption on the endpoint.

7.6.2 Personal Keys for file-based encryption by File Encryption

A Personal Key is a special type of encryption key that is created for a specific user and cannot be shared with other users. A Personal Key that is active for a specific user is called an active

Personal Key. Active Personal Keys cannot be assigned to other users.

In File Encryption policies, you can define encryption rules that use the placeholder Personal

Key instead of a key name. For such rules, the encryption key to be used is the active Personal

Key of the user.

When you define an encryption rule for the path C:\encrypt to be encrypted with the Personal

Key, different keys are used for different users.You can thereby ensure that information in specific folders is private for users. For further information see

Location-based File Encryption

(page 150).

If a File Encryption rule defines a Personal Key to be used for encryption, Personal Keys are created automatically for the relevant users, if they do not have active Personal Keys yet.

As a security officer with the required rights, you can create Personal Keys for selected users or all users in selected groups in the SafeGuard Management Center. You can also demote active

Personal Keys, for example when a user leaves the company.

7.6.2.1 Automatic creation of Personal Keys

If a File Encryption rule defines a Personal Key to be used for encryption and the user does not have an active Personal Key yet, the SafeGuard Enterprise Server automatically creates it. During

277

SafeGuard Enterprise the timeframe between policy receipt on the endpoint and the required active Personal Key becoming available, the user is not allowed to create new files in the folders covered by the File

Encryption rule.

For initial deployment of File Encryption policies with encryption rules using Personal Keys to a larger group of users (hundreds or more) who do not have active Personal Keys yet, we recommend to create Personal Keys in the SafeGuard Management Center (see

Create Personal Keys for multiple users (page 278)). This reduces the load on the SafeGuard Enterprise Server.

7.6.2.2 Create a Personal Key for a single user

To create a Personal Key, you need the rights Create keys and Assign keys. In addition, you need Full access rights for the object involved. To replace an active Personal Key, you need the right Manage Personal Keys.

1. In the SafeGuard Management Center, select Users and Computers.

2. In the navigation area, select the required user.

3. Right-click in the Keys tab and select Assign new key from the context menu.

4. In the Assign new key dialog: a) Enter a description for the Personal Key.

b) To hide the Personal Key in the user's key ring, select Hide key.

5. Depending on whether you are creating a Personal Key for a user who does not have an active

Personal Key yet, or for a user who does, the Assign new key dialog shows different check boxes. Select the check box displayed, to define the newly created key as a Personal Key:

■

■

Personal Key: This check box is displayed for users who do not have an active Personal

Key yet.

Replace active Personal Key: This checkbox is displayed for users who already have an active Personal Key.

6. Click OK.

The Personal Key is created for the selected user. In the Key tab, the key is shown as the Active

Personal Key for the user. For a user who already had an active Personal Key before, the existing key is demoted and the user receives the new one. The demoted Personal Key remains in the user's key ring. The active Personal Key cannot be assigned to other users.

7.6.2.3 Create Personal Keys for multiple users

To create Personal Keys, you need the rights Create keys and Assign keys. In addition, you need Full access rights for the objects involved. To replace existing active Personal Keys, you need the right Manage Personal Keys.

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation area, right-click the node for which you want to create Personal Keys:

■

■

■ a domain node, the .Auto registered node in the root or in domains or an Organizational Unit node.

3. From the context menu, select Create Personal Keys for users.

278

administrator help

4. In the Create Personal Key for Users dialog: a) Enter a description for the Personal Keys.

b) To hide the Personal Keys in the users' key rings, select Hide key.

c) To replace existing active Personal Keys with the new ones, select Replace existing active

Personal Keys.

5. Click OK.

The Personal Keys are created as for all users in the selected node. In the Key tab, the keys are shown as Active Personal Keys for the users. If users already had active Personal Keys before and you have selected Replace existing active Personal Keys, the existing keys are demoted and the users receive new ones. The demoted Personal Keys remain in the users' key rings. The individual active Personal Keys cannot be assigned to other users.

7.6.2.4 Demote active Personal Keys

To demote active Personal Keys manually, you need the rights Modify Keys and Manage

Personal Keys. By default, the right Manage Personal Keys has been assigned to the predefined role Master Security Officer, but it can also be assigned to new user-defined roles. In addition, you need Full access rights for the object involved.

You can demote active Personal Keys manually, for example if a user leaves the company.

Provided that you have the right Manage Personal Keys you can assign the demoted Personal

Key of this user to other users to give them read-only access to files encrypted with this key. But they cannot use this key for encrypting files.

Note: This cannot be undone. A demoted Personal Key can never become an active Personal

Key for any user again.

1. In the SafeGuard Management Center, select Users and Computers.

2. In the navigation area, select the required user.

3. In the Key tab, right-click the required Active Personal Key and select Demote Personal

Key from the context menu.

The key is demoted. It is still a Personal Key, but cannot be used as an active Personal Key anymore. If a File Encryption rule defines a Personal Key to be used for encryption and the user does not have an active Personal Key, the SafeGuard Enterprise Server automatically creates it.

7.6.3 Certificates

■

■

A user can only have one certificate assigned. If this user certificate is stored on a token, then users can only log on to their endpoint using this token (cryptographic token - Kerberos).

Note that, when importing a user certificate, the certificate's public and private sections are both imported. If only the public part is imported, only token authentication is supported.

■

The combination of CA certificates and CRL (Certificate Revocation List) must match. Otherwise users cannot log on to the respective endpoints. Please check that the combination is correct.

SafeGuard Enterprise does not carry out this check!

279

SafeGuard Enterprise

■

If Certification Authority (CA) certificates are deleted in the database and you do not wish to use them again, you should remove these certificates manually from the local store of all administrator computers.

SafeGuard Enterprise can then only communicate with expired certificates if old and new keys are present on the same token.

■

CA certificates cannot be obtained from a token and stored in the database or certificate store.

If you use CA certificates, they need to be available as files, not just on a token. The same applies to CRLs.

■

Certificates generated by SafeGuard Enterprise are signed with SHA-1 or SHA-256 for verification. SHA-256 provides enhanced security and is used by default with first-time installations. If SafeGuard Enterprise 6 or earlier endpoints still need to be managed or when upgrading from a previous version, SHA-1 is used by default.

■

Certificates provided by the customer and imported into SafeGuard Enterprise are currently not verified according to RFC3280. For example, we do not prevent using signature certificates for encryption purposes.

■

The logon certificates for security officers must be located in the “MY”certificate store.

Note: The Assigned Certificates list in Keys and Certificates only shows the certificates assigned to objects for which you have Read only or Full access rights. The Certificate view indicates the number of all available certificates, regardless of your access rights. The Assigned

Certificates list shows the number of certificates available according to your access rights.

To modify certificates, you need Full access rights to the container the users resides in.

7.6.3.1 Import CA certificates and Certificate Revocation Lists

If CA certificates are in use, import the complete CA hierarchy including all CRLs into the SafeGuard

Database. CA certificates cannot be obtained from tokens, but need to be available as files so that you can import them into the SafeGuard Enterprise Database. This also applies to Certificate

Revocation Lists (CRL).

1. In the SafeGuard Management Center, click Keys and Certificates.

2. Select Certificates and click the Import CA certificates icon in the toolbar. Browse for the

CA certificate files you want to import.

The imported certificates are displayed in the work area on the right.

3. Select Certificates and click the Import CRL icon in the toolbar. Browse for the CRL files you want to import.

The imported CRLs are displayed in the work area on the right.

4. Check that CA and CRL are correct and match. CA certificates must match the CRL before users can log on to the computers concerned. SafeGuard Enterprise does not carry out this check.

7.6.3.2 Change algorithm for self-signed certificates

Prerequisites: All SafeGuard Enterprise components must have version 6.1 or later.

280

administrator help

Certificates generated by SafeGuard Enterprise, such as the company, machine, security officer and user certificates are signed with hash algorithm SHA-256 by default during the first-time installation for enhanced security.

When upgrading from SafeGuard Enterprise 6 or earlier, hash algorithm SHA-1 is automatically used for self-signed certificates. You can manually change it to SHA-256 for enhanced security after the upgrade is completed.

Note: Only change the algorithm to SHA-256 if all SafeGuard Enterprise components and endpoints have been upgraded to the current version. SHA-256 is not supported in mixed environments where for example SafeGuard Enterprise 6 endpoints are managed by the SafeGuard

Management Center 7. If you have a mixed environment, you must not carry out this task and must not change the algorithm to SHA-256.

Changing the algorithm for self-signed certificates involves the following steps:

■

Changing the hash algorithm.

■

■

■

■

Creating a Certificate Change Order (CCO).

Creating a configuration package including the CCO.

Restarting the SafeGuard Enterprise (database) servers.

Distributing and deploying the configuration packages on the endpoints.

To change the algorithm for self-signed certificates:

1. In the SafeGuard Management Center menu bar, select Tools > Options.

2. On the General tab, under Certificates, select the required algorithm from Hash algorithm

for generated certificates and click OK.

3. On the Certificates tab, under Request, click Update. In Update Company certificate, enter a name for the CCO and specify a backup path. Enter a password for the P12 file and retype it. Optionally enter a comment and click Create.

4. Confirm when prompted that this change cannot be reverted and that all configuration packages created after this company certificate update need this CCO included to work on already installed endpoints.

5. Confirm when prompted that the update was successful and that a CCO to be included in all configuration packages has been created. Click OK.

6. On the Tools menu, click Configuration Package Tool.

7. Select the required type of endpoint configuration package: Managed client packages or

Standalone client packages.

8. Click Add Configuration Package and enter a name of your choice for the configuration package.

9. Select the CCO you created beforehand.

10. Make further selections as appropriate.

11. Specify an output path for the configuration package (MSI).

12. Click Create Configuration Package.

The configuration package (MSI) has now been created in the specified directory.

13. Restart all SafeGuard Enterprise (database) servers.

14. Distribute and deploy this package to the SafeGuard Enterprise protected endpoints.

281

SafeGuard Enterprise

All certificates generated by SafeGuard Enterprise are signed with the new algorithm. For more information, see Sophos knowledgebase article 116791 .

7.6.4 Exporting company and Master Security Officer certificates

In a SafeGuard Enterprise installation, the following two items are critical and must be backed up in a safe location:

■

The company certificate stored in the SafeGuard Database.

■

The Master Security Officer (MSO) certificate residing in the certificate store of the computer on which the SafeGuard Management Center is installed.

You can export both certificates in form of .p12 files for backup purposes. To restore installations, you can import the relevant company and security officer certificate as .p12 files and use them when you set up a new database. This avoids restoring the whole database.

Note: We recommend that you carry out this task right after initial configuration of the SafeGuard

Management Center.

7.6.4.1 Export the company certificates

Note: Only Master Security Officers are entitled to export company certificates for backup purposes.

1. In the SafeGuard Management Center menu bar, select Tools > Options.

2. Select the Certificates tab and click Export in the Company Certificate section.

3. You are prompted to enter a password for securing the exported file. Enter a password, confirm it and click OK.

4. Enter a file name and storage location for the file and click OK.

The company certificate is exported as a .p12 file to the defined location and can be used for recovery purposes.

7.6.4.2 Export the Master Security Officer certificate

To back up the Master Security Officer certificate of the MSO logged on to the SafeGuard

Management Center:

1. In the SafeGuard Management Center menu bar, select Tools > Options.

2. Select the Certificates tab and click Export in the Certificate of <administrator> section.

3. You are prompted to enter a password for securing the exported file. Enter a password, confirm it and click OK.

4. Enter a file name and storage location for the file to be exported and click OK.

The Master Security Officer certificate of the currently logged on MSO is exported as a .p12 file to the defined location and can be used for recovery purposes.

282

administrator help

7.7 Company Certificate Change Orders

Company Certificate Change Orders (CCOs) are used in the following cases:

■

To renew the company certificate in case it will expire soon.

Renewing the company certificate is possible for managed and unmanaged endpoints but can only be triggered from the management console.

■

To move unmanaged endpoints to a different environment, for example if you have two different Sophos SafeGuard environments and want to merge them into one Sophos SafeGuard environment where always one of the two environments has to be the target environment.

This is done by exchanging the company certificate of the endpoints of one environment with the company certificate of the target environment.

Note: Only Master Security Officers are allowed to create CCOs. To give other security officers the permission to create CCOs, the MSO must create a custom role and assign the right to

Manage CCOs to this role.

7.7.1 Renew the company certificate

A company certificate that is about to expire can be renewed in SafeGuard Management Center.

At logon, the SafeGuard Management Center starts to display a warning six months before the company certificate expires. Without a valid company certificate an endpoint cannot connect to the server. Renewing the company certificate involves three steps:

■

■

Creating a Certificate Change Order (CCO).

Creating a configuration package including the CCO.

■

Restarting the servers and distributing and deploying the configuration packages on the endpoints.

To renew a company certificate:

1. In the SafeGuard Management Center menu bar, select Tools > Options.

2. Select the Certificates tab and click Update in the Request section.

3. In the Update Company certificate dialog, enter a name for the CCO and specify a backup path. Enter a password for the P12 file and retype it. Optionally enter a comment and click

Create.

4. Confirm when prompted that this change cannot be reverted and that all configuration packages created after this company certificate update need this CCO included to work on already installed endpoints.

5. Confirm when prompted that the update was successful and that a CCO to be included in all configuration packages has been created. Click OK.

6. On the Tools menu, click Configuration Package Tool.

7. Select Managed client packages.

8. Click Add Configuration Package and enter a name of your choice for the configuration package.

9. Assign a Primary Server (the Secondary Server is not necessary).

283

SafeGuard Enterprise

10. Select the CCO you created beforehand to update the company certificate.

11. Select the Transport Encryption mode defining how the connection between SafeGuard

Enterprise Client and SafeGuard Enterprise Server is to be encrypted, either SafeGuard transport encryption or SSL encryption.

The advantage of SSL is that it is a standard protocol and that a faster connection can be achieved than when using SafeGuard transport encryption. SSL encryption is selected by default. For further information on how to secure transport connections with SSL, see

Securing transport connections with SSL

(page 46).

12. Specify an output path for the configuration package (MSI).

13. Click Create Configuration Package.

If you have selected SSL encryption as the Transport Encryption mode, the server connection is validated. If the connection fails, a warning message is displayed.

The configuration package (MSI) has now been created in the specified directory. Make sure that you restart all SGN servers.You now need to distribute and deploy this package to the SafeGuard

Enterprise managed endpoints.

7.7.2 Replace the company certificate

Replacing the company certificate is necessary when you want to move an endpoint from one standalone environment to a different one. The endpoint to be moved needs to have the company certificate of the environment it is to be moved to. Otherwise the endpoint does not accept policies of the new environment.

The following prerequisites must be met:

Decide which is your source and which is your target Management Center environment. The source Management Center is the one you used for creating the configuration packages for the endpoints that are to be moved. The target Management Center is the one the endpoints will be moved to.

To replace the company certificate:

1. Open the target Management Center and select Tools > Options.

2. Select the Certificates tab and click the Export button under Company Certificate.

3. Enter and confirm a password for the certificate backup when prompted and select a destination directory and file name when prompted.

The company certificate is exported (cer file).

4. Open the source Management Center and select Tools > Options.

5. Then select the Certificates tab and click Create... in the Request section.

6. In the Create CCO dialog, browse for the target company certificate you exported in the target

Management Center (step 1). Make sure that it is the desired certificate.

7. Click Create and select a destination directory and file name for the .cco file. Confirm that you want to place a Company Certificate Change Order. Please note that a CCO is not linked to specific endpoints. Using a CCO any client of the source environment can be moved.

8. In the target Management Center, import the CCO created in the source Management Center.

9. On the Tools menu, click Configuration Package Tool and select the CCOs tab.

10. Click Import.

284

administrator help

11. In the Import CCO dialog, select the CCO you created in the source Management Center and enter a CCO name and optionally a description. Click OK.

12. In the target Management Center, create a configuration package.

13. On the Tools menu, click Configuration Package Tool > Standalone client packages and add a new configuration package.

14. Select the imported CCO from the drop-down menu in the CCO column.

15. Specify a location under Configuration Package output path.

16. Click Create Configuration package.

The configuration package is created on the specified location.

17. Install this configuration package on all endpoints you want to move from the source environment to the target environment.

7.7.3 Managing Company Certificate Change Orders

In the SafeGuard Management Center, on the Tools menu, click Configuration Package Tool.

All created CCOs are displayed on the CCOs tab.

Detailed information on the selected CCO are displayed in the lower part of the dialog.

If the CCO was created for updating the company certificate, the Source company certificate is the one to be renewed. If the CCO was created to move endpoints, renew the company certificate of the environment the endpoints are being moved to.

The Destination company certificate is the new company certificate if the CCO was created for updating the company certificate or the company certificate of the environment the endpoints are being moved to.

Below the certificate details, you can see the tasks the selected CCO can be used for.

Note: For managing CCOs you need the right to Manage CCOs.

7.7.3.1 Import

When creating configuration packages, in order to select the CCO created by a different management tool to change the company certificate, you must first import it.

Clicking Import... opens a dialog in which you can select and name the CCO. The name you enter here is displayed on the CCOs tab of the Configuration Package Tool.

7.7.3.2 Export

Using the Export functionality, CCOs stored in the database can be exported and are then available as .cco files.

7.8 Licenses

To use SafeGuard Enterprise with the SafeGuard Management Center as a live system, you need a valid license. In the SafeGuard Enterprise Database for example, a valid license is a prerequisite for sending policies to the endpoints. The appropriate token licenses are also required for token management.

285

SafeGuard Enterprise

You can obtain license files from your sales partner. These files must be imported into the

SafeGuard Enterprise Database after installation.

The license file contains among other information:

■

The number of licenses purchased per module.

■

The name of the licensee.

■

A specified tolerance limit for exceeding the number of licenses.

If the number of available licenses or the tolerance limit is exceeded, relevant warning/error messages are displayed when you start the SafeGuard Management Center.

In the Users and Computers area, the SafeGuard Management Center provides an overview of the license status of the installed SafeGuard Enterprise system. The license status display is available in the Licenses tab of the root node, for domains, OUs, container objects and workgroups.

Here, security officers find detailed information about the license status. If they have sufficient rights, they can import licenses into the SafeGuard Enterprise Database.

7.8.1 License file

The license file you receive for importing into the SafeGuard Enterprise Database is an .XML file with a signature. The file includes the following information:

■

Company name

■

Additional information (for example, department, subsidiary)

■

Date issued

■

Number of licenses per module

■

Token license information

■

License expiration date

■

License type (demo or full license)

■

Signature with license signature certificate

7.8.2 Token licenses

To manage tokens or smartcards, the appropriate token licenses are required. If the appropriate licenses are not available, you cannot create policies for tokens in the SafeGuard Management

Center.

7.8.3 Evaluation licenses

The evaluation license file can be used for evaluation. These licenses are only valid for a certain period of time and have an expiration date, but there are no functional restrictions.

286

administrator help

Note: These licenses must not be used for normal working operation.

After you installed the SafeGuard Management Center and completed the configuration wizard,

you can import the test license you downloaded, see Import license files (page 289).

As long as you do not import a license file, you will be prompted to do so when you start the

SafeGuard Management Center.

7.8.3.1 Test license files

When you download the product you can download a test license file as well. This evaluation license (named SafeGuard Enterprise Evaluation License) includes five licenses for each module and has a time limit of two years as of the release date of the SafeGuard Enterprise version in question.

7.8.3.2 Individual demo license files

If you need more licenses than included in the default license file for evaluation, you can also obtain a demo license customized to your specific needs. To obtain an individual demo license file, please contact your sales partner. This type of demo license is also subject to a time limit.

The license is also restricted to the number of licenses per module agreed upon with your sales partner.

When you start the SafeGuard Management Center, a warning message indicates that you are using demo licenses. If the number of available licenses specified in the demo license is exceeded, or if the time limit is reached, an error message is displayed.

7.8.4 License status overview

To display the license status overview:

1. In the SafeGuard Management Center navigation area, click Users and Computers.

2. In the navigation window on the left-hand side, click the root node, the domain, the OU, the container object or the workgroup.

3. In the action area, switch to the Licenses tab.

The license status is displayed.

The display is divided into three areas. The upper area shows the name of the customer for whom the license has been issued, plus the issue date.

The middle area provides license details. The individual columns contain the following information:

Column

Status (icon)

Feature

Purchased Licenses

Explanation

An icon shows the license status (validity, warning message, error message) for the module in question.

Shows the installed module.

Shows the number of licenses purchased for the installed module.

287

SafeGuard Enterprise

Column

Used Licenses

Expires

Type

Tolerance Limit

Explanation

Shows the number of licenses used for the installed module.

Shows the license's expiration date.

Shows the license type, demo or regular license.

Shows the tolerance limit specified for exceeding the number of purchased licenses.

If you display the Licenses tab for a domain/OU, the overview shows the status based on the computer in the relevant branch.

Beneath this overview are details of the licensed token modules.

In the lower area, a message with a status-specific background color (green = valid, yellow = warning, red = error) and an icon show the global status of the license regardless of the domain or OU selected. If this area shows a warning or error message, it also shows information on how to regain a valid license status.

The icons shown in the Licenses tab mean the following:

Valid license

Warning

A license for a module enters warning state if the license limit is exceeded.

the license expired.

Error

A license for a module enters error state if the tolerance limit is exceeded.

the license has expired more than a month ago.

To refresh the license status overview, click Recount used licenses.

288

administrator help

7.8.5 Import license files

Prerequisite: To import a license file into the SafeGuard Enterprise Database, a security officer needs the right "Import license file".

1. In the SafeGuard Management Center, click Users and Computers.

2. In the navigation window on the left-hand side, click the root node, the domain or the OU.

3. In the action area, switch to the Licenses tab.

4. Click the Import license file... button.

A window opens where you can select the license file.

5. Select the license file you want to import, and click Open.

The Apply license? dialog is displayed showing the license file contents.

6. Click Apply license.

The license file is imported into the SafeGuard Enterprise Database.

After you have imported the license file, the module licenses purchased are marked with the license type regular. Any modules which no licenses were purchased for and which the evaluation license (default license file) or individual demo licenses are used for will be marked with the license type demo.

Note: Whenever a new license file is imported, only those modules that are included in that license file are affected. All other module license information is retained as it was retrieved from the database. This import functionality simplifies the evaluation of additional modules after purchase.

7.8.6 License exceeded

In your license file, a tolerance value has been set for exceeding the number of licenses purchased and the license validity period. If the number of available licenses per module or the validity period is exceeded, first of all a warning message is displayed. This does not impact the system's live operation and there is no restriction on functionality.You can review the license status and upgrade or renew your license. The tolerance value is usually set to 10% of the number of licenses purchased (the minimum value is 5, the maximum value is 5,000).

If the tolerance value is exceeded, an error message is displayed. In this case, functionality is restricted. The deployment of policies to the endpoints is disabled. This cannot be manually reversed in the SafeGuard Management Center. The license has to be upgraded or renewed before you can use all the functions again. Apart from disabling policy deployment, the functional restriction does not have an impact on the endpoints. Policies assigned remain active. Clients can also be uninstalled.

The following sections describe how the system behaves if licenses are exceeded and how to overcome the functional restriction.

7.8.6.1 Invalid license: Warning

If the number of available licenses is exceeded, a warning message is displayed when you start the SafeGuard Management Center.

289

SafeGuard Enterprise

The SafeGuard Management Center opens and displays the license status overview in the

Licenses tab in the Users and Computers area.

A warning message tells you that the license is invalid. With the detailed information shown about the license file you can identify the module for which the number of available licenses has been exceeded. This license status can be changed by extending, renewing or upgrading the license.

7.8.6.2 Invalid license: Error

If the tolerance value for the number of licenses or the period of validity set in the license is exceeded, the SafeGuard Management Center displays an error message.

In the SafeGuard Management Center, the deployment of policies to endpoint computers is disabled.

An error message is displayed in the Licenses tab in the Users and Computers area.

With the detailed information shown about the license file you can identify the module for which the number of available licenses has been exceeded.

To overcome the functionality restriction, you can:

■

Redistribute licenses

To make licenses available, you can uninstall the software on unused endpoints and thereby remove them from the SafeGuard Enterprise Database.

■

Upgrade/renew licenses

Contact your sales partner to get your license upgraded or renewed. You will receive a new license file for importing into the SafeGuard Enterprise Database.

■

Import a new license file

If you have renewed or upgraded your license, you need to import the license file into the

SafeGuard Enterprise Database. This newly imported file replaces the invalid license file.

As soon as you redistribute licenses or import a valid license file, the functional restriction is reversed and the system runs normally again.

7.9 Tokens and smartcards

Note: Tokens and smartcards cannot be configured for Mac OS X endpoints.

SafeGuard Enterprise provides enhanced security by supporting tokens and smartcards for authentication. Token/smartcards can store certificates, digital signatures and biometric details.

Token authentication is based on the principle of a two-stage authentication: A user has a token

(ownership), but can only use the token, if they know the specific token password (knowledge).

When a token or smartcard is used, users only need the token and a PIN for authentication.

Note: From SafeGuard Enterprise's perspective, smartcards and tokens are treated in the same way. So the terms “token” and “smartcard” refer to the same thing in the product and in the help.

The use of tokens and smartcards needs to be enabled in the license, see

Token licenses (page

286).

290

administrator help

Note: Windows 8 and later offers a feature called virtual smartcard. A virtual smartcard simulates the functionality of a physical smartcard using the TPM chip as basis, but cannot be used with

SafeGuard Enterprise.

Tokens are supported in SafeGuard Enterprise:

■ in the SafeGuard Power-on Authentication (not applicable for Windows 8 and Windows 8.1)

■ at operating system level

■ to log on to the SafeGuard Management Center

When a token is issued to a user in SafeGuard Enterprise, data such as the manufacturer, type, serial number, logon data and certificates are stored in the SafeGuard Enterprise Database.

Tokens are identified by the serial number and then recognized in SafeGuard Enterprise.

There are significant benefits:

■

You know which tokens are in circulation and which users they are assigned to.

■

You know when they were issued.

■

If a token is lost, the security officer can identify it and block it. This prevents the misuse of data.

■

The security officer can nevertheless use Challenge/Response to temporarily allow logon without a token, for example, if a user has forgotten the PIN.

Note: With SafeGuard volume-based encryption this recovery option is not supported with cryptographic token logon (Kerberos).

7.9.1 Token types

The term "token" refers to all technologies used and does not depend on a particular form of the device. This includes all devices that can store and transfer data for the purpose of identification and authentication, like smartcards and USB tokens.

SafeGuard Enterprise supports the following types of tokens/smartcards for authentication:

■

Non-cryptographic

Authentication at the SafeGuard POA and Windows is based on user credentials (user

ID/password) stored on the token.

■

Cryptographic - Kerberos

Authentication at the SafeGuard POA and Windows is based on certificates stored on the token.

Note: Cryptographic tokens cannot be used for unmanaged endpoints.

7.9.1.1 Cryptographic tokens - Kerberos

With cryptographic tokens, the user is authenticated at the SafeGuard POA by the certificate stored on the token. To log on to the system, users only have to enter the token PIN.

291

SafeGuard Enterprise

Note: Cryptographic tokens cannot be used for unmanaged endpoints.

You have to provide users with fully issued tokens. For further information, see Configure token use (page 294).

Basic certificate requirements:

■

Algorithm: RSA

■

■

Key length: minimum 1024

Key usage: data encipherment or key encipherment.

Note: In case of logon problems with a Kerberos token, neither Challenge/Response nor Local

Self Help is available for logon recovery. Only the Challenge/Response procedure using Virtual

Clients is supported. It enables users to regain access to encrypted volumes on their endpoints.

7.9.2 Components

To use tokens/smartcards with SafeGuard Enterprise, the following is required:

■

Token/smartcard

■

■

Token/smartcard reader

Token/smartcard driver

■

Token/smartcard middleware (PKCS#11 module)

USB tokens

Like smartcards, USB tokens consist of a smartcard and a smartcard reader, both units being located in a single casing. The use of USB tokens requires a USB port.

7.9.2.1 Token/smartcard readers and drivers

■

Windows

On the Windows operating system level, PC/SC-compatible card readers are supported. The

PC/SC interface regulates the communication between computer and smartcard. Many of these card readers are already part of the Windows installation. Smartcards require PKCS#11 compatible smartcard drivers if they are to be supported by SafeGuard Enterprise.

■

SafeGuard Power-on Authentication

With SafeGuard Power-on Authentication, the PC/SC interface is supported which regulates the communication between PC and smartcard. The supported smartcard drivers are a fixed implementation and users may not add other drivers. The appropriate smartcard drivers have to be enabled by means of a policy in SafeGuard Enterprise.

The interface for smartcard readers is standardized and many card readers have a USB interface or an ExpressCard/54 interface and implement the CCID standard. In SafeGuard

Enterprise, this is a prerequisite to be supported with SafeGuard Power-on Authentication.

Plus, on the driver side, the PKCS#11 module has to be supported.

292

administrator help

7.9.2.2 Supported tokens/smartcards with SafeGuard Power-on Authentication

SafeGuard Enterprise supports a wide range of smartcards/smartcard readers, USB tokens plus respective drivers and middleware with SafeGuard Power-on Authentication. With SafeGuard

Enterprise, tokens/smartcards which support 2.048-bit RSA operations are supported.

As support for tokens/smartcards is enhanced from release to release, the tokens and smartcards supported in whatever is the current version of SafeGuard Enterprise are listed in the Release

Notes.

7.9.2.3 Supported middleware

The middleware in the list below is supported by the relevant PKCS#11 module. PKCS#11 is a standardized interface for connecting cryptographic tokens/smartcards to different software. Here, it is used for the communication between cryptographic token/smartcard, the smartcard reader and SafeGuard Enterprise. For more information, see Sophos knowledgebase article 112781 .

Manufacturer

ActivIdentity

AET

Aladdin

A-Trust

Charismatics

Gemalto

IT Solution GmbH

Nexus

RSA

Sertifitseerimiskeskus AS

Siemens

ATOS

FNMT

Middleware

ActivClient, ActivClient (PIV)

SafeSign Identity Client eToken PKI Client a.sign Client

Smart Security Interface

Gemalto Access Client, Gemalto Classic Client, Gemalto .NET

Card

IT Solution trustWare CSP+

Nexus Personal

RSA Authentication Client 2.x, RSA Smart Card Middleware

3.x

Estonian ID Card

CardOS API TC-FNMT

CardOS API TC-FNMT

Módulo PCKS#11 TC-FNMT TC-FNMT

293

SafeGuard Enterprise

Manufacturer

T-Systems

Unizeto

Middleware

NetKey 3.0

proCertum

Licenses

Note that the use of the respective middleware for the standard operating system requires a license agreement with the relevant manufacturer. For information on how to obtain the licenses, see Sophos knowledgebase article 116585 .

For Siemens licenses, contact

Atos IT Solutions and Services GmbH

Otto-Hahn-Ring 6

81739 Muenchen

Germany

The middleware is set in a SafeGuard Enterprise policy of the type Specific Machine Settings under Custom PKCS#11 Settings in the field PKCS#11 Module for Windows or PKCS#11

Module for Power-on Authentication. The relevant configuration package must also be installed on the computer on which the SafeGuard Management Center is running.

7.9.3 Configure token use

Carry out these steps if you want to provide tokens to the following users for authentication:

■

Users of managed endpoints

■

Security officers of the SafeGuard Management Center

1. Initialize empty tokens.

For further information, see

Initialize a token

(page 295).

2. Install the middleware.

For further information, see

Install middleware (page 295).

3. Activate the middleware.

For further information, see

Activate middleware

(page 296).

4. Issue tokens for users and security officers.

For further information, see

Issuing a token (page 296).

5. Configure the logon mode.

For further information, see

Configuring logon mode

(page 298).

6. Configure further token settings, for example syntax rules for PINs.

For further information, see Managing PINs

(page 302) and

Managing tokens and smartcards

(page 303).

294

administrator help

7. Assign certificates and keys to tokens/users.

For further information, see

Assigning certificates (page 299).

You can also use tokens that have data from a different application for authentication, provided that there is enough storage space for the certificates and logon information on them.

For easy token administration, SafeGuard Enterprise offers the following features:

■

Display and filter token information

■

Initialize, change, reset and block PINs

■

Read and delete token data

■

Block tokens

Note: To issue and manage tokens or modify data on issued tokens you need Full access rights to the relevant users. The Issued Tokens view only shows tokens for users for whom you have

Read only or Full access rights.

7.9.4 Preparing for token use

To prepare for token/smartcard support in SafeGuard Enterprise:

■

Initialize empty tokens.

■

■

Install the middleware.

Activate the middleware.

7.9.4.1 Initialize a token

Before an "empty", unformatted token can be used, it needs to be prepared for use (initialized) according to the instructions provided by the token manufacturer. When it is initialized, basic information, for example the standard PIN, is written to it. This is done with the token manufacturer's initialization software.

For further information, refer to the token manufacturer concerned.

7.9.4.2 Install middleware

Install the correct middleware, both on the computer with SafeGuard Management Center installed

as well as on the relevant endpoint, if not already done. For supported middleware, see Supported middleware (page 293).

Restart the computers where you installed the new middleware.

Note: If you install Gemalto .NET Card or Nexus Personal middleware, you also need to add their installation path to the PATH environment variable of your computer's System Properties.

■

Default installation path for Gemalto .NET Card:

C:\Program Files\Gemalto\PKCS11 for .NET V2 smart cards

■

Default installation path for Nexus Personal:

C:\Program Files\Personal\bin

295

SafeGuard Enterprise

7.9.4.3 Activate middleware

You need to assign the correct middleware in form of the PKCS#11 module by defining a policy in the SafeGuard Management Center. You should do this both for the computer which the

SafeGuard Management Center is running on and for the endpoint. Only then can SafeGuard

Enterprise communicate with the token. You can define the setting for PKCS#11 module, using a policy, as follows.

Prerequisite: The middleware is installed on the relevant computer and the token has been initialized. The SafeGuard Enterprise Client configuration package must also be installed on the computer on which the SafeGuard Management Center is running.

1. In the SafeGuard Management Center, click Policies.

2. Create a new policy of the type Specific Machine Settings or select an existing policy of this type.

3. In the work area on the right-hand side, select the appropriate middleware under Token

support settings > Module Name. Save the settings.

4. Assign the policy.

SafeGuard Enterprise can now communicate with the token.

7.9.5 Issuing a token

When a token is issued in SafeGuard Enterprise, data which is used for authentication is written on the token. This data consists of credentials and certificates.

In SafeGuard Enterprise, tokens can be issued for these user roles:

■

Tokens for end users of managed endpoints

■

Tokens for security officers (SO)

Both user and security officers (SO) can access the token. The user is the one who should use the token. Only the user can access private objects and keys. The SO can only access public objects, but can reset the user's PIN.

7.9.5.1 Issue a token or smartcard to a user

Prerequisites:

■

■

■

The token must be initialized and the relevant PKCS#11 module must be activated.

The SafeGuard Enterprise Client configuration package must also be installed on the computer on which the SafeGuard Management Center is running.

You need Full access rights for the relevant user.

1. In the SafeGuard Management Center, click Users and Computers.

2. Connect the token to the USB interface. SafeGuard Enterprise reads in the token.

3. Select the user for whom the token is to be issued, and open the Token Data tab in the work area on the right-hand side.

296

administrator help

4. In the Token Data tab, do the following: a) Select the User ID and Domain of the relevant user and enter your Windows Password.

b) Click Issue Token.

The Issue Token dialog is displayed.

5. Select the appropriate slot for the token from the Available slots drop-down list.

6. Issue a new User PIN and repeat the entry.

7. Under SO PIN, enter the standard PUK received from the manufacturer or the PIN issued when the token was initialized.

Note: If you only fill in the User PIN (required) field, the user PIN must match the PIN which was issued when the token was initialized. In this case, you do not have to repeat the user

PIN and enter an SO PIN.

8. Click Issue token now.

The token is issued, the logon information written on the token and the token information saved in the SafeGuard Enterprise Database. You can display the data in the Token area in the Token

Information tab.

7.9.5.2 Issue a token or smartcard to a security officer

When SafeGuard Enterprise is installed for the first time, the first security officer (SO) can issue a token for themselves and specify the logon mode. For all other security officers, tokens are issued in the SafeGuard Management Center.

Prerequisite:

■

The token must be initialized and the relevant PKCS#11 module must be activated.

■

You need the rights to make entries for the SO.

1. In the SafeGuard Management Center, click Security Officers.

2. Connect the token to the USB interface. SafeGuard Enterprise reads in the token.

3. In the navigation window on the left, mark Security Officer and select New > New security

officer from the context menu.

The New security officer dialog is displayed.

4. With the Token logon field, specify the type of logon for the SO:

■

To enable the SO to authenticate either with or without a token, select Optional.

■

To make token logon mandatory for the SO, select Mandatory.

With this setting, the private key remains on the token. The token must always be plugged in, or the system will need to be restarted.

5. Next you specify the SO certificate.

■

To create a new certificate, click the Create button next to the Certificate drop-down list.

Enter the password for the certificate twice and click OK to confirm it.

Specify the location for saving the certificate.

297

SafeGuard Enterprise

■

To import certificates, click the Import next to the Certificate drop-down list and open the relevant certificate file.

Searching is first done in a certificate file, then on the token. The certificates may remain in whatever the storage location is.

6. Under Roles, activate the roles that are to be assigned to the SO.

7. Confirm the entries with OK.

The SO is created, the token is issued, the logon data is written on the token (depending on the setting), and the token information is saved in the SafeGuard Enterprise Database. You can display the data in the Token area in the Token Information tab.

7.9.6 Configuring logon mode

There are two ways for end users of logging on with a token. A combination of both logon methods is possible.

■

Logging on with user ID/password

■

Logging on with token

When logging on with token/smartcard, you can either select the non-cryptographic method or the Kerberos (cryptographic) method.

As a security officer, you specify the logon mode to be used in a policy of the type Authentication.

If you select the token logon option Kerberos:

■

You need to issue a certificate in a PKI and store it on the token. This certificate is imported as a user certificate into the SafeGuard Enterprise Database. If an automatically generated certificate already exists in the database, it is replaced by the imported certificate.

7.9.6.1 Enable SafeGuard POA autologon with default token PINs

A default token PIN that is distributed by policy enables automatic user logon at the SafeGuard

Power-on Authentication. This avoids the need to issue each single token separately and enables users to automatically log on at the SafeGuard Power-on Authentication without any user interaction.

When a token is used at logon and a default PIN is assigned to the computer, the user is passed through at the SafeGuard Power-on Authentication without having to enter a PIN.

As a security officer you can set the specific PIN in a policy of the type Authentication and assign it to different computers or computer groups, for example to all computers residing in the same location.

To enable autologon with a default token PIN:

1. In the SafeGuard Management Center, click Policies.

2. Select a policy of the type Authentication.

3. Under Logon Options in Logon mode, select Token.

298

administrator help

4. In PIN used for autologon with token, specify the default PIN to be used for autologon. PIN rules do not need to be observed in this case.

Note: This setting is only available if you select Token as possible Logon Mode.

5. In Pass through to Windows set Disable pass-through to Windows. If you do not select this setting when a default PIN is specified, you will not be able to save the policy.

If you want to enable the Pass through to Windows option, you can later create another policy of the type Authentication with this option enabled and assign it to the same computer group, so that the RSOP has both policies active.

6. Optionally specify further token settings.

7. Save your settings and assign the policy to the relevant computers or computer groups.

If the autologon on the endpoint has been successful, Windows is started.

If the autologon on the endpoint has failed, the user is prompted to enter the token PIN at the

SafeGuard Power-on Authentication.

7.9.7 Assigning certificates

Not only logon information but also certificates can be written to a token. Just the private part of the certificate (.p12 file) can be saved on the token. However, users then can only log on with the token. We recommend that you use PKI certificates.

You can assign authentication data to tokens as follows:

■ by generating certificates directly on the token

■ by assigning data which is already on the token

■ by importing certificates from a file

Note: CA certificates cannot be obtained from a token and stored in the database or certificate store. If you use CA certificates, these need to be available as files and not just on a token. This also applies to CRLs (Certificate Revocation List). Moreover, the CA certificates must match the

CRL before users can log on to the computers concerned. Check that the CA and corresponding

CRL are correct. SafeGuard Enterprise does not carry out this check! SafeGuard Enterprise can then only communicate with expired certificates if old and new keys are present on the same card.

7.9.7.1 Generate certificates from tokens

To generate certificates from tokens, you need Full access rights for the relevant user.

You can generate new certificates straight from the token if, for example, there is no certificate structure present.

Note: If only the private part of the certificate is written on to the token, the user can only access their private key with the token. The private key then only resides on the token. If the token is lost, the private key can no longer be accessed.

Prerequisite: The token is issued.

1. In the SafeGuard Management Center, click Users and Computers.

299

SafeGuard Enterprise

2. Plug the token into the USB interface.

SafeGuard Enterprise reads in the token.

3. Mark the user for whom a certificate is to be generated, and open the Certificate tab in the work area on the right-hand side.

4. Click Generate and assign certificate by token. Note that the length of the key must match the size of the token.

5. Select the slot and enter the token PIN.

6. Click Create.

The token generates the certificate and assigns it to the user.

7.9.7.2 Assign token certificates to a user

Prerequisites:

■

■

The token is issued.

You have Full access rights for the relevant user.

To assign a certificate available on the token to a user:

1. In the SafeGuard Management Center, click Users and Computers.

2. Plug the token into the USB interface.

SafeGuard Enterprise reads in the token.

3. Select the user to whom you want to assign a certificate, and open the Certificate tab in the work area on the right-hand side.

4. Click the Assign a certificate from a token icon in the SafeGuard Management Center toolbar.

5. Select the relevant certificate from the list and enter the token's PIN.

6. Click OK.

The certificate is assigned to the user. A user can only have one certificate assigned.

7.9.7.3 Change a user's certificate

You can change or renew certificates required for logon by assigning a new certificate in the

SafeGuard Management Center. The certificate is assigned as a standby certificate alongside the existing certificate. By logging on with the new certificate, the user changes the certificate on the endpoint.

Note: If users have lost their tokens or tokens have been compromised, do not exchange tokens by assigning new certificates as described here. Otherwise problems may occur. For example, the old token certificate may still be valid for Windows logon. As long as the old certificate is still valid, logon to Windows is still possible and the computer can be unlocked. Instead, block the token to prevent logon.

Standby certificates can be used in the following cases:

■

Change (cryptographic) token generated certificates.

■

Switch from auto-generated certificates to token-generated certificates.

300

administrator help

■

Switch from user name/password authentication to cryptographic token (Kerberos) authentication.

Prerequisites:

■

The new token is issued.

■

Only one certificate is assigned to the user.

■

You have Full access rights for the relevant user.

To change a user's certificate for token logon:

1. In the SafeGuard Management Center, click Users and Computers.

2. Plug the token into the USB interface.

SafeGuard Enterprise reads in the token.

3. Select the user for whom you want to change the certificate and open the Certificate tab in the work area on the right-hand side.

4. On the toolbar, click the appropriate icon for the action you want to perform.

5. Select the relevant certificate and enter the token's PIN.

6. Click OK.

7. Provide the user with the new token.

The certificate is assigned to the user as a standby certificate. This is indicated by a tick in the

Standby column of the user's Certificates tab.

After synchronization between the endpoint and the SafeGuard Enterprise Server, the status dialog on the endpoint indicates that it is Ready for certificate change.

The user now has to initiate a certificate change on the endpoint computer. For further information, see the SafeGuard Enterprise user help.

After the user has changed the certificate on the endpoint the certificate is also renewed on the

SafeGuard Enterprise Server during the next synchronization. This removes the old token from the user's Certificates tab in the SafeGuard Management Center. The new token becomes the standard token for the user.

Note: In the SafeGuard Management Center, both certificates can be deleted separately. If only a standby certificate is available, the next certificate is assigned as the standard certificate.

7.9.7.4 Import certificate from a file onto the token

Prerequisite: The token is issued.

You need to select this procedure for a token with Kerberos support for managed endpoints. The certificate must be recognized by SafeGuard Enterprise and added to the token. If there is already an auto-generated certificate, the imported certificate will overwrite it.

To add the private part of the certificate (.p12 file) from a file to the token:

1. In the SafeGuard Management Center, click Tokens.

2. Plug the token into the USB interface.

SafeGuard Enterprise reads in the token.

301

SafeGuard Enterprise

3. Mark the token to which you want to add the private part of the certificate and, in the work area on the right, open the Logon Information & Certificates tab.

4. Click the P12 to token icon in the SafeGuard Management Center toolbar.

5. Select the relevant certificate file.

6. Enter the token PIN and the password for the .p12 file and click OK to confirm.

The private part of the certificate is added to the token. Now you need to assign it to a user, see

Assign token certificates to a user

(page 300). Users can then only log on with this token.

7.9.8 Managing PINs

As a security officer, you can change both the user PIN and the SO PIN, and also force the user

PIN to be changed. This is usually required when a token is first issued. You can also initialize

PINs (issue them as new and block them).

Note: To initialize, change and block PINs, you need Full access rights for the relevant users.

You can use policies to specify other PIN options for the endpoint.

Note: When you change a PIN, note that some token manufacturers specify their own PIN rules which may contradict SafeGuard Enterprise PIN rules. So it may not be possible to change a PIN in the way you want, even if it complies with the SafeGuard Enterprise PIN rules. You should always refer to the token manufacturer's PIN rules. These are displayed in the Token area under

Token Information in the SafeGuard Management Center.

PINs are managed in the SafeGuard Management Center under Tokens. The token is plugged in and marked in the navigation window on the left.

7.9.8.1 Initialize user PIN

Prerequisites:

■

■

The SO PIN must be known.

You need Full access rights for the relevant user.

1. In the SafeGuard Management Center toolbar, click the Initialize user PIN icon.

2. Enter the SO PIN.

3. Enter the new user PIN, repeat the entry and click OK to confirm.

The user PIN is initialized.

7.9.8.2 Change an SO PIN

Prerequisite: The previous SO PIN must be known.

1. In the SafeGuard Management Center toolbar, click the Change SO PIN icon.

2. Enter the old SO PIN.

3. Enter the new SO PIN, repeat the entry and click OK.

The SO PIN has been changed.

302

administrator help

7.9.8.3 Change a user PIN

Prerequisite:

■

■

The user PIN must be known.

You need Full access rights for the relevant user.

1. In the SafeGuard Management Center toolbar, click the Change user PIN icon.

2. Enter the old and the new user PIN, repeat the new user PIN, and click OK.

The user PIN is changed. If you have changed the PIN for another user, inform them about the change.

7.9.8.4 Force PIN change

To force a PIN change, you need Full access rights for the relevant user.

1. In the SafeGuard Management Center toolbar, click the Force PIN change icon.

The next time the user logs on with the token, they have to change their user PIN.

7.9.8.5 PIN history

The PIN history can be deleted. To do this, click the Delete PIN history icon in the SafeGuard

Management Center toolbar.

7.9.9 Managing tokens and smartcards

In the Tokens area of the SafeGuard Management Center, the security officer can:

■

Get an overview of tokens and certificates that have been issued.

■

■

■

Filter overviews.

Block tokens for authentication

Read or delete the data on a token.

7.9.9.1 Display token/smartcard information

As a security officer, you can display information about all or individual tokens that have been issued. You can also filter overviews.

Prerequisite: The token must be plugged in.

1. In the SafeGuard Management Center, click Tokens.

303

SafeGuard Enterprise

2. To display information about an individual token, select the relevant token in the navigation area under Token Slots.

The manufacturer, type, serial number, hardware details and PIN rules are displayed under

Token Information. You can also see which user the token is assigned to.

Note: Under Token Slots, issued tokens are displayed regardless of your access rights to the relevant users, so you can see, if the token is in use or not. If you have no or Read only access rights to the assigned user, all token data in the Token Information and Credentials

and Certificates tabs are greyed out and you cannot manage this token.

3. To display an overview on tokens, select Issued Tokens. You can display all the tokens that have been issued or filter the overview by user.

The token's serial number, the assigned users and the issue date are displayed. You can also see if the token is blocked.

Note: The Issued Tokens view shows the tokens for all users you have Read only or Full

access rights for.

7.9.9.2 Block token or smartcard

As a security officer you can block tokens. This is for example useful if a token has been lost.

To block a token, you need Full access rights for the relevant user.

1. In the SafeGuard Management Center, click Tokens.

2. In the navigation area on the left, select Issued Tokens on the left of the navigation area.

3. Select the token to be blocked and click the Block token icon in the SafeGuard Management

Center toolbar.

The token is blocked for authentication and the assigned user can no longer use it to log on. The token can only be unblocked with the SO PIN.

7.9.9.3 Delete token/smartcard information

As a security officer, you can delete the information that has been written on the token by

SafeGuard Enterprise.

Prerequisite:

■

The token must be plugged in.

■

You need Full access rights for the relevant user.

1. In the SafeGuard Management Center, click Tokens.

2. In the navigation area on the left, select the token concerned under Token Slots.

3. In the SafeGuard Management Center toolbar, click the Wipe token icon.

4. Enter the SO Pin that was assigned to the token and click OK to confirm.

All data managed by SafeGuard Enterprise is deleted. Certificates remain on the token.

The user PIN is reset to 1234.

Deleted tokens are thus automatically deleted from the list of issued tokens.

304

administrator help

7.9.9.4 Read token/smartcard information

As a security officer you can read the data on the token by using the user PIN.

Prerequisite:

■

■

The token must be plugged in. The security officer must know the PIN. Or it must be initialized,

see Initialize user PIN (page 302).

You need Read only or Full access rights for the relevant user.

1. In the SafeGuard Management Center, click Tokens.

2. On the left of the navigation area select the relevant token under Token Slots and select the

Credentials & Certificates tab.

3. Click the Get user credentials icon and enter the user PIN for the token.

The data on the token is displayed.

7.10 Scheduling tasks

The SafeGuard Management Center offers the Task Scheduler to create and schedule periodic tasks based on scripts. The tasks are automatically run by a service on the SafeGuard Enterprise

Server to execute the scripts specified.

Periodic tasks are for example useful for

■ automatic synchronization between Active Directory and SafeGuard Enterprise.

■ automatic deletion of event logs.

For these two procedures, predefined script templates are available with SafeGuard Enterprise.

You can use these scripts as they are or modify them according to your requirements. For further

information, Predefined scripts for periodic tasks (page 311).

As a security officer with the required rights, you can specify scripts, rules and intervals for tasks in the Task Scheduler.

Note: Make sure that the appropriate SQL permissions are set for the account that is used to run the SafeGuard Enterprise Task Scheduler. For more information, see Sophos knowledgebase article 113582 .

Note: The API cannot process more than one task at the same time. If you use more than one account per task, this will lead to database access violations.

7.10.1 Create a new task

To create tasks in the Task Scheduler, you need the security officer rights Use task scheduler and Manage tasks.

1. In the menu bar of the SafeGuard Management Center, select Tools > Task Scheduler.

The Task Scheduler dialog is displayed.

305

SafeGuard Enterprise

2. Click the Create... button.

The New task dialog is displayed.

3. In the Name field, enter a unique task name.

If the task name is not unique, a warning is displayed when you click OK to save the task.

4. In the drop-down list of the SGN Server field, select the server the task should run on.

The drop-down list only shows servers for which scripting is allowed. You allow scripting for a specific server when you register it in the Configuration Package Tool in the SafeGuard

Management Center.

If you select None, the task is not executed.

5. Click the Import... button next to the Script field.

The Select script file to import dialog is displayed.

Note: Two predefined scripts are available in the Script Templates directory of your SafeGuard

Management Center installation. The Select script file to import dialog automatically shows

this directory. For further information, see Predefined scripts for periodic tasks (page 311).

In the Task Scheduler, you can import, export and edit scripts. For further information, see

Working with scripts in the Task Scheduler (page 309).

6. Select the script you want to run with the task and click OK.

If the script selected is empty, the OK button in the dialog remains disabled and a warning symbol is displayed.

7. In the Start Time field, specify when the task should be run on the selected server.

The start time displayed is rendered using the local time of the computer on which the

SafeGuard Management Center is running. Internally, the start time is stored as Coordinated

Universal Time (UTC). This allows tasks to be executed at the same moment, even if servers are in different time zones. All servers use the current time of the database server to determine when to start tasks. To allow better monitoring of tasks, the database reference time is displayed in the Task Scheduler dialog.

8. Under Recurrence, specify how often the task should be run on the selected server.

■

To run the task once, select One time and specify the required Date.

■

To run the task daily, select Daily followed by Every day (including Saturday and Sunday) or Every weekday (Monday - Friday).

■

To run the task weekly, select Weekly and specify the required day of the week.

■

To run the task monthly, select Monthly and specify the required day of the month in a range from 1 to 31. To run the task at the end of each month, select Last from the drop-down list.

After you have filled in all mandatory fields, the OK button becomes available.

9. Click OK.

The task is saved in the database and displayed in the Task Scheduler overview. It is run on the selected server according to the schedule specified.

306

administrator help

7.10.2 The Task Scheduler overview display

After you have created tasks to be run on a SafeGuard Enterprise Server, they are displayed in the Task Scheduler dialog you open by selecting Tools > Task Scheduler.

This dialog shows the following columns for each task:

Column

Task Name

SGN Server

Schedule

Next Run Time

Last Run Time

Last Run Result

Description

Shows the unique task name.

Indicates on which server the task is executed.

Shows the schedule specified for the task with recurrence and time.

Shows the next time the task will be executed (date and time). If there are no more run times specified for the task, this column shows None.

Shows the last time the task was executed (date and time). If it has not been executed yet, this column shows

None.

Shows the result of the last task run:

Success

The task's script was executed successfully.

Failure

Execution of the task has failed. An error number is shown, if available.

Running

The script is running.

Insufficient Rights

The task has failed due to insufficient rights for script execution.

Aborted

The execution of the task was aborted because the execution time exceeded 24 hours.

Lost control

Control of the task's script execution was lost, for example because the SGN scheduler service was stopped.

307

SafeGuard Enterprise

Column Description

Script is corrupt

The script to be executed is corrupt.

The script was deleted in the meantime

While the task was queued for execution, the corresponding script was removed from the

SafeGuard Enterprise Database.

Runtime errors

A runtime error was detected during the processing of the scheduler service.

Under the columns, the following buttons are displayed:

Button

Create...

Delete

Properties

Refresh

Description

Click this button to create a new task.

Click this button to delete a selected task.

Click this button to display the <task name>

properties dialog for a selected task. In this dialog, you can edit the task or import, export and edit scripts.

Click this button to refresh the task list in the Task

Scheduler dialog. If another user has added or deleted tasks in the meantime, the task list is updated.

All servers use the current time of the database server to determine when to start tasks. Therefore, to allow better monitoring of tasks, the time of the database server is displayed here. It is rendered using the local time zone of the computer on which the SafeGuard Management Center runs.

7.10.3 Edit tasks

To edit tasks in the Task Scheduler, you need the security officer rights Use task scheduler and Manage tasks.

1. In the menu bar of the SafeGuard Management Center, select Tools > Task Scheduler.

The Task Scheduler dialog is displayed showing an overview on the scheduled tasks.

308

administrator help

2. Select the required task and click the Properties button.

The <task name> properties dialog is displayed showing the task properties.

3. Make the required changes.

Note: The task name must be unique. If you change the name to an existing task name, an error message is displayed.

4. Click OK.

The changes become effective.

7.10.4 Delete tasks

To delete tasks from the Task Scheduler, you need the security officer rights Use task scheduler and Manage tasks.

1. In the menu bar of the SafeGuard Management Center, select Tools > Task Scheduler.

The Task Scheduler dialog is displayed showing an overview of the scheduled tasks.

2. Select the required task.

The Delete button becomes available.

3. Click the Delete button and confirm that you want to delete the task.

The task is removed from the Task Scheduler overview dialog and will no longer be run on the

SafeGuard Enterprise Server.

Note: If the task has been started in the meantime, it is removed from the Task Scheduler overview dialog, but it will still be completed.

7.10.5 Working with scripts in the Task Scheduler

With the Task Scheduler you can import, edit and export scripts. To work with scripts in the Task

Scheduler, you need the security officer rights Use Task scheduler and Manage tasks.

7.10.5.1 Import scripts

To specify a script to be executed by a task, the script must be imported.You can import the script when you first create the task. You can also import scripts for existing tasks.

1. In the menu bar of the SafeGuard Management Center, select Tools > Task Scheduler.

The Task Scheduler dialog is displayed showing an overview on the scheduled tasks.

2. Select the required task and click the Properties button.

The <task name> properties dialog is displayed showing the task properties.

309

SafeGuard Enterprise

3. Click the Import... button next to the Script field.

The Select script file to import dialog is displayed.

Note: Two predefined scripts are available in the Script Templates directory of your SafeGuard

Management Center installation. The Select script file to import dialog automatically shows

this directory. For further information, see Predefined scripts for periodic tasks (page 311).

4. Select the script you want to import and click OK.

The script name is displayed in the Script field.

5. Click OK.

If the script has already been imported, you are prompted to confirm that you want to overwrite the old script.

If the size of the file to be imported exceeds 10 MB, an error message is displayed and the import process is rejected.

The script is saved in the database.

7.10.5.2 Edit scripts

1. In the menu bar of the SafeGuard Management Center, select Tools > Task Scheduler.

The Task Scheduler dialog is displayed showing an overview on the scheduled tasks.

2. Select the required task and click the Properties button.

The <task name> properties dialog is displayed showing the task properties.

3. Click the Edit drop-down button next to the Script field.

The drop-down list shows all editors available for editing the script.

4. Select the editor you want to use.

The script is opened in the selected editor.

5. Make your changes and save them.

The editor is closed and the <task name> properties dialog is displayed again.

6. Click OK.

The changed script is saved in the database.

7.10.5.3 Export scripts

1. In the menu bar of the SafeGuard Management Center, select Tools > Task Scheduler.

The Task Scheduler dialog is displayed showing an overview on the scheduled tasks.

2. Select the required task and click the Properties button.

The <task name> properties dialog is displayed showing the task properties.

310

administrator help

3. Click the Export... button besides the Script field.

A Save as dialog is displayed.

4. Select the file location for saving the script and click Save.

The script is saved to the specified file location.

7.10.5.4 Predefined scripts for periodic tasks

The following predefined scripts are available with SafeGuard Enterprise:

■

ActiveDirectorySynchronization.vbs

You can use this script for automatic synchronization between Active Directory and SafeGuard

Enterprise.

■

EventLogDeletion.vbs

You can use this script for automatic event log deletion.

The scripts are installed automatically in the Script Templates subfolder of the SafeGuard

Management Center installation.

To use these scripts in periodic tasks, import them into the Task Scheduler and make the necessary parameter changes before you use them.

7.10.5.4.1 Predefined script for Active Directory synchronization

You can import an existing organizational structure into the SafeGuard Enterprise Database from

an Active Directory. For further information, see Import or synchronize the organizational structure

(page 267).

After you have imported the directory structure, you can schedule a periodic task for automatic synchronization between the Active Directory and SafeGuard Enterprise. For this task, you can use the predefined script ActiveDirectorySynchronization.vbs.

The script synchronizes all existing containers in the SafeGuard Enterprise Database with an

Active Directory.

Before you use the script in a periodic task, you can edit the following parameters:

Parameter

logFileName synchronizeMembership

Description

Specify a path for the script log file. This parameter is mandatory. If it is empty or invalid, synchronization does not work and an error message is displayed. By default, this parameter is empty. If a log file already exists, new logs are appended to the end of the file.

Set this parameter to 1 to also synchronize memberships. If this parameter is set to 0, memberships are not synchronized.

The default setting is 1.

311

SafeGuard Enterprise

Parameter

synchronizeAccountState

Description

Set this parameter to 1 to also synchronize the user enabled state. If this parameter is set to 0, the user enabled state is only synchronized at first synchronization. The default setting is 0.

Note: Make sure that you have the necessary access rights for Active directory synchronization and that the appropriate SQL permissions are set for the account that is used to run the SafeGuard

Enterprise Task Scheduler. For more information, see Security officer access rights and Active

Directory import (page 267). For information on how to set the Active Directory access rights, see

Sophos knowledgebase article 107979 . For information on how to set the SQL permissions, see

Sophos knowledgebase article 113582 .

Once the rights are set correctly, apply the changes and restart the service: Switch to the server hosting the SafeGuard Enterprise web page. Open the Services interface by clicking Start> Run

> Services.msc. Right-click SafeGuard

®

Scheduler Service and click All Tasks > Restart.

Note: We recommended that you synchronize the Active Directory in a timely moderate interval, maximum twice a day so that server performance is not significantly decreased. New objects will be displayed in the SafeGuard Management Center under .Auto registered between these intervals where they can be managed just as normal.

7.10.5.4.2 Predefined script for automatic event log deletion

Events logged in the SafeGuard Enterprise Database are stored in the EVENT table. For further information on logging, see

Reports (page 315).

With the Task Scheduler, you can create a periodic task for automatic event log deletion. For this task, you can use the predefined script EventLogDeletion.vbs.

The script deletes events from the EVENT table. If you specify the relevant parameter, it also moves events to the backup log table EVENT_BACKUP leaving a defined number of latest events in the EVENT table.

Before you use the script in a periodic task, you can edit the following parameters:

Parameter

maxDuration maxCount keepBackup

Description

With this parameter, you specify how long (in days) events should be kept in the EVENT table. The default is 0. If this parameter is set to 0, there is no time limit for events kept in the EVENT table.

With this parameter, you specify how many events should remain in the EVENT table. The default is 5000. If this parameter is set to 0, there is no limit for the number of events to be kept in the EVENT table.

With this parameter, you specify whether deleted events should be backed up in the EVENT_BACKUP table. The default is 0. If this parameter is set to 0, events are not backed

312

administrator help

Parameter Description up. Set this parameter to 1 to create a backup of deleted events.

Note: If you use the script to move events from the EVENT table to the backup log table, event connection no longer applies. To activate event connection while also using the stored procedure for event cleanup does not make sense. For further information, see

Connection of logged events

(page 321).

7.10.6 Restrictions concerning registered servers

When you register servers in the Configuration Package Tool in the SafeGuard Management

Center, it is possible to register more than one server template with the same machine certificate.

But you can only install one template at a time on the real machine.

If the Scripting allowed check box is selected for both servers, the Task Scheduler displays both servers for selection in the SGN Server drop-down list of the New task dialog and the <task

name> properties dialog. The Task Scheduler cannot determine which of the two templates was installed on the machine.

To avoid this, do not select the check box Scripting allowed for templates that are not installed on the server. Also, avoid duplicate templates with the same machine certificate.

For further information on registering servers, see the SafeGuard Enterprise installation guide.

7.10.7 Task Scheduler log events

Events concerning task execution can be logged to provide useful information, for example for troubleshooting. You can define the following events to be logged:

■

Scheduler task executed successfully

■

Scheduler task failed

■

Scheduler service thread stopped due to an exception.

The events include the script console output to facilitate troubleshooting.

For further information on logging, see Reports

(page 315).

7.11 Auditing

7.11.1 Log events for BitLocker

Events reported by the BitLocker Client are logged, just as for any other SafeGuard Enterprise

Client. It is not especially mentioned that the event refers to a BitLocker Client. The events reported are the same as for any SafeGuard Enterprise Client.

313

SafeGuard Enterprise

7.11.2 Log events for users, computers or workgroups

Successful/unsuccessful registrations of users, computers or workgroups are logged. You can view a list of these events in the SafeGuard Management Center under Reports in the Event viewer.

7.11.3 Log events for service account lists

Actions performed regarding service account lists are reported by the following log events:

SafeGuard Management Center

■

■

Service account list <name> created

Service account list <name> modified

■

Service account list <name> deleted

SafeGuard Enterprise protected endpoint

■

Windows user <domain/user name> logged on at <timestamp> to machine <domain/workstation name> as SGN service account.

■

■

New service account list <name> imported.

Service account list <name> deleted.

7.11.4 Track files accessed in cloud storage

You can track files accessed in cloud storage by using the Reports function of the SafeGuard

Management Center. Files accessed can be tracked regardless of any encryption policies applied to them.

In a policy of the type Logging you can define the following:

■

To log an event when a file or directory is created on a removable media device.

■

■

To log an event when a file or directory is renamed on a removable media device.

To log an event when a file or directory is deleted from a removable media device.

For further information, see

File access report for removable media and cloud storage

(page 319).

7.11.5 Track files accessed on removable media

You can track files accessed on removable media by using the Reports function of the SafeGuard

Management Center. Files accessed can be tracked regardless of any encryption policy applying to files on removable media.

In a policy of the type Logging you can define the following:

■

An event to be logged when a file or directory is created on a removable media device.

■

■

An event to be logged when a file or directory is renamed on a removable media device.

An event to be logged when a file or directory is deleted from a removable media device.

314

administrator help

For further information, see

File access report for removable media and cloud storage

(page 319).

7.11.6 Reports

Recording security-related incidents is a prerequisite for detailed system analysis. The events logged facilitate the exact tracking of processes on a specific workstation or within a network. By logging events, you can for example verify security breaches committed by third parties. By using the logging functionality, administrators and security officers can also detect errors in granting user rights and correct them.

SafeGuard Enterprise logs all endpoint activities and status information as well as administrator actions and security-related events and saves them centrally. The logging functionality records events triggered by installed SafeGuard products. The type of logs is defined in policies of the type Logging. This is also where you specify the output and saving location for the logged events: the Windows Event Log of the endpoint or the SafeGuard Enterprise Database.

As a security officer with the necessary rights, you can view, print and archive status information and log reports displayed in the SafeGuard Management Center. The SafeGuard Management

Center offers comprehensive sorting and filter functions which are very helpful when selecting the relevant events from the information available.

Automated analyses of the log database, for example with Crystal Reports or Microsoft System

Center Operations Manager, are also possible. SafeGuard Enterprise protects the log entries against unauthorized manipulation using signatures on the client and on the server side.

Depending on the logging policy, events of the following categories can be logged:

■

Authentication

■

■

Administration

System

■

■

■

■

Encryption

Client

Access control

For SafeGuard Data Exchange, you can track files accessed on removable media by logging the relevant events. For further information on this report type, see

File access report for removable media and cloud storage

(page 319).

■

For SafeGuard Cloud Storage, you can track files accessed in your cloud storage by logging the relevant events. For further information on this report type, see

File access report for removable media and cloud storage

(page 319).

7.11.6.1 Application scenarios

The SafeGuard Enterprise logging functionality is a user-friendly and comprehensive solution for recording and analyzing events. The following examples show typical application scenarios for

SafeGuard Enterprise Reports.

315

SafeGuard Enterprise

7.11.6.1.1 Central monitoring of endpoints within a network

The security officer wants to be informed about critical events (for example, unauthorized data access, a number of failed logon attempts within a specified time frame) on a regular basis. Using a logging policy, the security officer can configure logging processes to log all security-related events occurring on the endpoints in a local log file. This log file is transferred to the SafeGuard

Enterprise Database by the SafeGuard Enterprise Server after a number of events has been reached. The security officer can retrieve, view and analyze the events in the Event Viewer of the SafeGuard Management Center. The processes performed on different endpoints can be audited without staff being able to influence logging.

7.11.6.1.2 Monitor mobile users

In general, mobile users are not constantly connected to the company network. Sales representatives may for example disconnect their notebooks for a meeting. As soon as they log on to the network again, the SafeGuard Enterprise events logged during the offline period are transferred. The logging functionality provides an exact overview on the user's activities during the time that the computer was not connected to the network.

7.11.6.2 Prerequisite

Events are handled by the SafeGuard Enterprise Server. If you want to activate reports on computers on which no SafeGuard Enterprise client is installed (SafeGuard Management Center computers or the SafeGuard Enterprise Server itself), you need to make sure that events are sent to the SafeGuard Enterprise Server. You therefore have to install a client configuration package on the computer. By doing so, the computer is activated as a client at the SafeGuard Enterprise

Server and the Windows or SafeGuard Enterprise logging functionality is enabled.

For further information on client configuration packages, see Working with configuration packages

(page 92).

7.11.6.3 Destinations for logged events

There are two possible destinations for logged events: the Windows Event Viewer or the SafeGuard

Enterprise Database. Only events related to a SafeGuard product are written to the relevant destination.

The output destinations for events to be logged are specified in the logging policy.

7.11.6.3.1 Windows Event Viewer

Events for which you define the Windows Event Viewer as a destination in the logging policy are logged in the Windows Event Viewer. The Windows Event Viewer can be used to display and manage logs for system, security and application events. You can also save these event logs.

For these procedures, an administrator account for the relevant endpoint is required. In the

Windows Event Viewer, an error code is displayed instead of a descriptive event text.

Note: A prerequisite for viewing SafeGuard Enterprise events in the Windows Event Viewer is that a client configuration package is installed on the endpoint.

Note: This chapter describes the processes of viewing, managing and analyzing event logs in the SafeGuard Management Center. For further information on the Windows Event Viewer, refer to your Microsoft Documentation.

316

administrator help

7.11.6.3.2 SafeGuard Enterprise Database

Events for which you define the SafeGuard Enterprise Database as a destination in the logging policy are collected in a local log file in the local cache of the relevant endpoint in the following directory: auditing\SGMTranslog. Log files are submitted to a transport mechanism which transfers them to the database through the SafeGuard Enterprise Server. By default, the file is submitted as soon as the transport mechanism has successfully established a connection to the server. To limit the size of a log file, you can define a maximum number of log entries in a policy of the type

General Settings. The log file will be submitted to the transport queue of the SafeGuard Enterprise

Server when the number of entries specified has been reached. The events logged in the central database can be displayed in the SafeGuard Enterprise Event Viewer or File Tracking Viewer.

As a security officer, you need the relevant rights to view, analyze and manage the events logged in the database.

7.11.6.4 Configure logging settings

Report settings are defined in two policies:

■

General Settings policy

In a General Settings policy, you can specify a maximum number of logged entries after which the log file containing the events destined for the central database is to be transferred to the

SafeGuard Enterprise Database. This reduces the size of the individual log files to be transferred. This setting is optional.

■

Logging policy

The events to be logged are specified in a logging policy. In this policy, a security officer with the required policy rights defines which events will be logged to which output destination.

7.11.6.4.1 Define the number of events for feedback

1. Click the Policies button in the SafeGuard Management Center.

2. Create a new General Settings policy or select an existing one.

3. Under Logging in the Feedback after number of events field, specify the maximum number of events for a log file.

4. Save your settings.

After assigning the policy, the number of events specified applies.

7.11.6.4.2 Select events

1. In the SafeGuard Management Center, select the Policies.

2. Create a new Logging policy or select an existing one.

In the action area on the right-hand side under Logging, all predefined events which can be logged are displayed. By default, the events are grouped by Level, for example Warning or

Error. But you can change the grouping. By clicking on the column headers you can sort the events by ID, Category etc.

317

SafeGuard Enterprise

3. To specify that an event is to be logged in the SafeGuard Enterprise Database, select the event by clicking in the column showing the database icon Log events in database. For events to be logged in the Windows Event Viewer, click in the column showing the event log icon Log in event log.

By clicking repeatedly you can deselect the event or set it to null. If you do not define a setting for an event, the relevant default value applies.

4. For all events selected, a green check mark is displayed in the relevant column. Save your settings.

After assigning the policy the selected events are logged in the relevant output destination.

Note: For a list of all events available for logging, see

Events available for reports

(page 325).

7.11.6.5 View logged events

As a security officer with the necessary rights, you can view the events logged in the central database in the SafeGuard Management Center Event Viewer.

To retrieve the entries logged in the central database:

1. In the navigation area of the SafeGuard Management Center, click Reports.

2. In the Reports navigation area, select Event Viewer.

3. In the Event Viewer action area on the right-hand side, click the magnifier icon.

All events logged in the central database are shown in the Event Viewer.

The individual columns show the following information concerning the events logged:

Column

ID

Event

Category

Application

Computer

Computer domain

User

Description

Shows a number identifying the event.

Shows an event text, this means a description of the event.

Classification of the event by the source, for example Encryption,

Authentication, System.

Shows the software area the event originated from, for example

SGMAuth, SGBaseENc, SGMAS.

Shows the name of the computer on which the logged event occurred.

Shows the domain of the computer on which the logged event occurred.

Shows the user who was logged on at the time of the event.

318

administrator help

Column

User domain

Log time

Description

Shows the domain of the user who was logged on at the time of the event.

Shows the system date and system time at which the event was logged on the endpoint.

By clicking the relevant column headers you can sort the events by Level, Category etc.

In addition, the context menu of the relevant columns offers a number of functions for sorting, grouping and customizing the Event Viewer.

By double-clicking an entry in the Event Viewer you can display event details concerning the logged event.

7.11.6.5.1 Apply filters to the SafeGuard Enterprise Event Viewer

The SafeGuard Management Center offers comprehensive filter functions. Using these functions you can quickly retrieve the relevant events from the events displayed.

The Filter area of the Event Viewer offers the following fields for defining filters:

Field

Categories

Error level

Show last

Description

Using this field you can filter the Event Viewer according to the source classification (for example Encryption, Authentication, System) shown in the Category column. Select the required categories from the drop-down list of the field.

Using this field you can filter the Event Viewer according to the

Windows event classification (for example warning, error) shown in the Level column. Select the required levels from the drop-down list of the field.

In this field, you can define the number of events to be displayed. The events logged last will be displayed (by default the last 100 events).

In addition, you can create user-defined filters using the Filter Editor. You can display the Filter

Editor from the context menu of the individual report columns. In the Filter Builder window you can define filters and apply them to the relevant column.

7.11.6.6 File access report for removable media and cloud storage

For SafeGuard Data Exchange and SafeGuard Cloud Storage, you can track files accessed on removable media or in your cloud storage. Regardless of any encryption policy applying to files stored on removable media or cloud storage, events can be logged for the following:

■

A file or directory is created on a removable media device or in cloud storage.

319

SafeGuard Enterprise

■

■

A file or directory is renamed on a removable media device or in cloud storage.

A file or directory is deleted from a removable media device or in cloud storage.

File access tracking events can be viewed in the Windows Event Viewer or in the SafeGuard

Enterprise File Tracking Viewer depending on the destination you specify when you define the logging policy.

7.11.6.6.1 Configure file access tracking

1. In the SafeGuard Management Center, select Policies.

2. Create a new Logging policy or select an existing one.

In the action area on the right-hand side under Logging, all predefined events which can be logged are displayed. By clicking on the column headers you can sort the events by ID,

Category etc.

3. To activate file access tracking select the following log events depending on your requirements:

■ for files stored on removable media:

■

ID 3020 File tracking for removable media: a file has been created.

■

ID 3021 File tracking for removable media: a file has been renamed.

■

ID 3022 File tracking for removable media: a file has been deleted.

■ for files stored in cloud storage:

■

ID 3025 File tracking for cloud storage: a file has been created.

■

ID 3026 File tracking for cloud storage: a file has been renamed.

■

ID 3027 File tracking for cloud storage: a file has been deleted.

To specify that an event is to be logged in the SafeGuard Enterprise Database, select the event by clicking in the column showing the database icon Log events in database. For events to be logged in the Windows Event Viewer, click in the column showing the event log icon Log in event log.

For all events selected, a green check mark is displayed in the relevant column.

4. Save your settings.

After assigning the policy, file access tracking is activated and the selected events are logged in the relevant output destination.

Note: Be aware that enabling file access tracking significantly increases the server load.

7.11.6.6.2 View file access tracking events

To view file access tracking logs, you need the right Display file tracking events.

1. In the navigation area of the SafeGuard Management Center, click Reports.

2. In the Reports navigation area, select File Tracking Viewer.

3. In the File Tracking Viewer action area on the right-hand side, click the magnifier icon.

All events logged in the central database are shown in the File Tracking Viewer. The display is identical to the Event Viewer display. For further details, see

View logged events (page 318).

320

administrator help

7.11.6.7 Print reports

You can print the event reports displayed in the SafeGuard Management Center Event Viewer or File Tracking Viewer from the File menu in the menu bar of the SafeGuard Management

Center.

■

■

To display a print preview before printing the report, select File > Print Preview. The print preview offers different functions, for example for exporting the relevant document into a number of output formats (for example .PDF) or editing the page layout (for example header and footer).

To print the document without a print preview, select File > Print.

7.11.6.8 Connection of logged events

The events destined for the central database are logged in the EVENT table of the SafeGuard

Enterprise Database. For this table, integrity protection can be applied. The events can be logged as a connected list in the EVENT table. Due to the connection, each entry in the list is dependent on the previous entry. If an entry is removed from the list, this is evident and can be verified by an integrity check.

To enhance performance, the connection of events in the EVENT table is deactivated by default.

You can activate the connection of logged events to check integrity (see Check the integrity of logged events

(page 321)).

Note: When the connection of logged events is deactivated, integrity protection does not apply to the EVENT table.

Note: Too many events may lead to performance issues. For further information on how to avoid performance issues by cleaning up events, see

Scheduled event cleanup by script

(page 322).

7.11.6.8.1 Activate the connection of logged events

1. Stop web service SGNSRV at the Web Server.

2. Delete all events from the database and create a backup during deletion (see Delete selected or all events (page 322)).

Note: If you do not delete all old events from the database, the connection will not work correctly as the remaining old events did not have it activated.

3. Set the following registry key to 0 or delete it:

HKEY_LOCAL_MACHINE\SOFTWARE\Utimaco\SafeGuard Enterprise DWORD:

DisableLogEventChaining = 0

4. Restart the web service.

The connection of logged events is activated.

Note: To deactivate the connection of events again, set the registry key to 1.

7.11.6.9 Check the integrity of logged events

Prerequisite: To check the integrity of logged events, the concatenation of events in the EVENT table has to be activated.

1. In the SafeGuard Management Center, click the Reports.

321

SafeGuard Enterprise

2. In the SafeGuard Management Center menu bar, select Actions > Check integrity.

A message shows information about the integrity of the events logged.

Note: If the connection of events is deactivated, an error is returned.

7.11.6.10 Delete selected or all events

1. In the SafeGuard Management Center, click Reports.

2. In the Event Viewer, select the events to be deleted.

3. To delete selected events, select Actions > Delete events or click the Delete events icon in the toolbar. To delete all events, select Actions > Delete all events or click the Delete all

events icon in the toolbar.

4. Before deleting the selected events, the system displays the Back up events as window for creating a backup file (see

Create a backup file (page 322)).

The events are deleted from the event log.

7.11.6.11 Create a backup file

When you are deleting events, you can create a backup file of the report displayed in the SafeGuard

Management Center Event Viewer.

1. When you select Actions > Delete events or Actions > Delete all events the Back up events

as window for creating a backup file is displayed before events are deleted.

2. To create an .XML backup file of the event log, enter a file name and a file location and click

OK.

7.11.6.12 Open a backup file

1. In the SafeGuard Management Center, click Reports.

2. In the SafeGuard Management Center menu bar, select Actions > Open backup file.

The Open Event Backup window is displayed.

3. Select the backup file to be opened and click Open.

The backup file is opened and the events are shown in the SafeGuard Management Center Event

Viewer. To return to the regular view of the Event Viewer, click the Open backup file icon in the toolbar again.

7.11.6.13 Scheduled event cleanup by script

Note: The SafeGuard Management Center offers the Task Scheduler to create and schedule periodic tasks based on scripts. The tasks are automatically run by a service on the SafeGuard

Enterprise Server to execute the scripts specified.

For automatic and efficient cleanup of the EVENT table, four SQL scripts are available in the

\tools directory of your SafeGuard Enterprise software delivery:

■

spShrinkEventTable_install.sql

■

ScheduledShrinkEventTable_install.sql

322

administrator help

■

spShrinkEventTable_uninstall.sql

■

ScheduledShrinkEventTable_uninstall.sql

The two scripts

spShrinkEventTable_install.sql

and

ScheduledShrinkEventTable_install.sql

install a stored procedure and a scheduled job at the database server. The scheduled job runs the stored procedure at defined regular intervals. The stored procedure moves events from the EVENT table to the backup log table

EVENT_BACKUP leaving a defined number of latest events in the EVENT table.

The two scripts

spShrinkEventTable_uninstall.sql

and

ScheduledShrinkEventTable_uninstall.sql

uninstall the stored procedure and the scheduled job. These two scripts also delete the EVENT_BACKUP table.

Note: If you use the stored procedure to move events from the EVENT table to the backup log table, event connection no longer applies. To activate connection while also using the stored procedure for event cleanup does not make sense. For further information, see

Connection of logged events

(page 321).

7.11.6.13.1 Create the stored procedure

The script

spShrinkEventTable_install.sql

creates a stored procedure which moves data from the EVENT table to a backup log table EVENT_BACKUP. If the EVENT_BACKUP table does not exist, it is created automatically.

The first line is "USE SafeGuard". If you have selected a different name for your SafeGuard

Enterprise database, modify the name accordingly.

The stored procedure leaves the

<n>

latest events in the EVENT table and moves the rest of the events to the EVENT_BACKUP table. The number of events to be left in the EVENT table is specified by a parameter.

To execute the stored procedure, initiate the following command in SQL Server Management

Studio (New Query):

exec spShrinkEventTable 1000

This command example moves all events except for the latest 1000 events.

7.11.6.13.2 Create a scheduled job for running the stored procedure

To automatically clean up the EVENT table at regular intervals, you can create a job at the SQL

Server. The job can be created with the script

ScheduledShrinkEventTable_install.sql

or using the SQL Enterprise Manager.

Note: The scheduled job does not work on SQL Express databases. For the job to be executed, the SQL Server Agent has to be running. As there is no SQL Server Agent on SQL Server Express installations jobs are in this case not supported.

■

The script has to be executed in the msdb. If you have selected a different name for your

SafeGuard Enterprise Database than SafeGuard, modify the name accordingly.

/* Default: Database name 'SafeGuard' change if required*/

SELECT @SafeGuardDataBase='SafeGuard'

■

You can also specify the number of events to be left in the EVENT table. The default is 100,000.

/* Default: keep the latest 100000 events, change if required*/

323

SafeGuard Enterprise

SELECT @ShrinkCommand='exec spShrinkEventTable 100000'

■

You can specify whether a job run is to be logged in the NT Event Log.

exec sp_add_job

@job_name='AutoShrinkEventTable',

@enabled=1,

@notify_level_eventlog=3

The following values are available for parameter

notify_level_eventlog

:

Value

1

0

3

2

Result

Log every time the job runs.

Log if the job fails.

Log if the job was carried out successfully.

Do not log job run in NT Event Log.

■

You can specify how often the job run should be repeated in case it fails.

exec sp_add_jobstep

■

@retry_attempts=3

This example defines 3 job run attempts in case of failure.

■

@retry_interval=60

This example defines a retry interval of 60 minutes.

■

You can specify a time schedule for running the job.

exec sp_add_jobschedule

■

@freq_type=4

This example defines that the job is run daily.

■

@freq_interval=1

This example defines that the job is run once per day.

■

@active_start_time=010000

This example defines that the job is run at 1 a.m.

324

administrator help

Note: Besides the example values stated above, you can define a number of different schedule options with

sp_add-jobschedul

e. For example, the job can be run every two minutes or only once per week. For further information, see the Microsoft Transact SQL Documentation.

7.11.6.13.3 Clean up stored procedures, jobs and tables

The script

spShrinkEventTable_uninstall.sql

deletes the stored procedure and the

EVENT_BACKUP table.The script

ScheduledShrinkEventTable_uninstall.sql

deregisters the scheduled job.

Note: When you execute

spShrinkEventTable_uninstall.sql

, the EVENT_BACKUP table will be deleted with all data contained in it.

7.11.6.14 Report Message Templates

Events are not logged with their complete event texts in the SafeGuard Enterprise Database.

Only ID and the relevant parameter values are written to the database table. When the logged events are retrieved in the SafeGuard Management Center Event Viewer, the parameter values and the text templates contained in the .dll are converted into the complete event text in the current

SafeGuard Management Center system language.

The templates used for event texts can be edited and processed, for example by using SQL queries. To do so, you can generate a table containing all text templates for event messages.

Afterwards you can customize the templates according to your specific requirements.

To create a table containing the text templates for the individual event IDs:

1. In the menu bar of the SafeGuard Management Center, select Tools > Options.

2. In the Options window, go to tab Database.

3. In the Report Message Templates area, click Create Table.

The table containing the templates for the event ID is created in the current system language and can be customized.

Note: Before the templates are generated, the table is cleared. If the templates have been generated for a specific language and a user generates the templates for a different language, the templates for the first language are deleted.

7.11.7 Events available for reports

The following table provides an overview on all events which can be selected for logging.

Category

System

System

System

System

Event

ID

Description

1001 Process started.

1005

1005

1006

Service started.

Service started.

Service start failed.

325

SafeGuard Enterprise

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

System

System

System

System

System

System

System

System

1020

1021

Communication 1500

Communication 1507

1007

1007

1016

1017

1018

1019

Communication 1508

2004

2004

2005

2005

2006

2006

2007

2007

2001

2002

2003

2003

Service stopped.

Service stopped.

Integrity test of data files failed.

Logging destination not available.

Unauthorized attempt to uninstall SafeGuard Enterprise.

key backup failed

Sending "key backup complete" to Sophos Enterprise Console failed.

key backup not acknowledged

Email was sent with attachments (From, Subject, Encryption method)

Email was sent with attachments (From, Subject, Attachments, Encryption method)

Email was sent with attachments (From, Recipients, Subject, Attachments,

Encryption method)

External GINA identified and integrated successfully.

External GINA identified, integration failed.

Power-on Authentication active.

Power-on Authentication active.

Power-on Authentication deactivated.

Power-on Authentication deactivated.

Wake on LAN activated.

Wake on LAN activated.

Wake on LAN deactivated.

Wake on LAN deactivated.

Challenge created.

Challenge created.

326

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

2016

2017

2018

2018

2019

2019

2020

2020

2021

2022

2023

2010

2010

2011

2012

2013

2014

2015

2008

2008

2009

2009

2009

2010

Response created.

Response created.

Logon successful.

Logon successful.

Logon successful.

Logon failed.

Logon failed.

Logon failed.

User imported during logon and marked as owner.

User imported by owner and marked as non-owner.

User imported by non-owner and marked as non-owner.

User removed as owner.

Import of user during logon failed.

User logged off.

User was forced to log off.

Action performed on device.

Action performed on device.

User started a Password/PIN change.

User started a Password/PIN change.

User changed their password/PIN after logon.

User changed their password/PIN after logon.

Password/PIN quality.

Password/PIN policy violated.

LocalCache was corrupted and has been restored.

administrator help

327

SafeGuard Enterprise

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

2056

2057

2057

2058

2061

2062

2071

2072

2073

2074

2075

2029

2030

2031

2032

2033

2035

2036

2024

2025

2025

2026

2027

2028

Invalid Password Black List Configuration.

Response code that allows the user to display the password received.

Response code that allows the user to display the password received.

Local cache backup completed successfully.

Local cache backup failed.

The logged on user is guest user.

Successful logon to Web Helpdesk with preconfigured credentials.

Logged on user is a Service Account.

Logon to Web Helpdesk with preconfigured credentials failed.

Authorization for Web Helpdesk failed.

Web Helpdesk started.

Service Account List imported.

Service Account List deleted.

SGN Windows user added.

All SGN Windows users have been removed from a machine.

All SGN Windows users have been removed from a machine.

Manual UMA user removal has been performed.

Computrace check return code.

Computrace check could not be executed.

Kernel initialization was successfully completed.

Kernel initialization has failed.

Machine keys were successfully generated on the client.

Machine keys could not be generated successfully on the client.

Querying disk properties or Opal disk initialization has failed.

328

administrator help

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Authentication

Administration

2079

2080

2081

2082

2083

2083

2084

2084

2085

2085

2086

2087

2095

2096

2097

2098

2099

2100

2101

2102

2103

2104

2500

Importing user into the kernel was successfully completed.

Removing user from the kernel was successfully completed.

Importing user into the kernel has failed.

Removing user from the kernel has failed.

Response with "display user password" created.

Response with "display user password" created.

Response for virtual client created.

Response for virtual client created.

Response for standalone client created.

Response for standalone client created.

For a standalone client user a new certificate was generated.

A certificate was assigned to a standalone client user. This event can only occur on standalone clients and thus will never be logged to the database.

Wake on LAN could not be activated.

Wake on LAN could not be deactivated.

The user has logged in to the client using the standby token for the first time.

The standby token was set as standard token.

A successful standby certificate activation has been reported to the server.

The user has logged in to the client using the standby token for the first time.

The standby certificate could not be activated because of an error.

The standby certificate activation has failed on the server

The pin on the token has been changed

PIN change on token failed

Unable to enforce policy "Enforce certificate based token logon"

Policy "Enable certificate based token logon" enforced

SafeGuard Enterprise Administration started.

329

SafeGuard Enterprise

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2513

2513

2515

2515

2518

2522

2522

2525

2529

2529

2532

2505

2506

2506

2507

2508

2508

2511

2500

2501

2502

2502

2503

2504

SafeGuard Enterprise Administration started.

Logon to SafeGuard Enterprise Administration failed.

Authorization for SafeGuard Enterprise Administration failed.

Authorization for SafeGuard Enterprise Administration failed.

Additional authorization required.

Additional authorization for action granted.

Additional authorization failed.

Data import from directory successful.

Data import from directory successful.

Data import from directory cancelled.

Failed to import data from directory.

Failed to import data from directory.

User created.

User changed.

User changed.

User deleted.

User deleted.

Application of user failed.

Failed to delete user.

Failed to delete user.

Machine applied.

Machine deleted.

Machine deleted.

Application of machine failed.

330

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2556

2557

2557

2560

2560

2562

2563

2564

2564

2573

2575

2546

2547

2550

2550

2553

2553

2555

2536

2536

2539

2539

2543

2543

Failed to delete machine.

Failed to delete machine.

OU applied.

OU applied.

OU deleted.

OU deleted.

Application of OU failed.

Import of OU failed.

Failed to delete OU.

Failed to delete OU.

Group applied.

Group applied.

Group modified.

Group renamed.

Group deleted.

Group deleted.

Application of group failed.

Application of group failed.

Failed to change group.

Failed to rename group.

Failed to delete group.

Failed to delete group.

Members added to group.

Members deleted from group.

administrator help

331

SafeGuard Enterprise

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2603

2603

2604

2604

2607

2607

2607

2608

2609

2609

2609

2593

2593

2594

2594

2596

2596

2603

2576

2578

2580

2583

2591

2591

Failed to add members to group.

Failed to delete members from group.

Group switched from OU to OU.

Failed to switch group from OU to OU.

Objects added to group.

Objects added to group.

Objects deleted from group.

Objects deleted from group.

Failed to add objects to group.

Failed to add objects to group.

Failed to delete objects from group.

Failed to delete objects from group.

Key generated.

Key generated.

Key generated.

Key modified.

Key modified.

Key assigned.

Key assigned.

Key assigned.

Key assignment cancelled.

Failed to generate key.

Failed to generate key.

Failed to generate key.

332

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2621

2622

2623

2624

2624

2627

2627

2628

2629

2630

2630

2615

2615

2615

2616

2616

2619

2619

2610

2610

2613

2613

2613

2614

Failed to modify key.

Failed to modify key.

Failed to assign key.

Failed to assign key.

Failed to assign key.

Failed to delete assignment of key.

Certificate generated.

Certificate generated.

Certificate generated.

Certificate imported.

Certificate imported.

Certificate deleted.

Certificate deleted.

Certificate assigned to user.

Certificate assignment to user cancelled.

Failed to create certificate.

Failed to import certificate.

Failed to import certificate.

Failed to delete certificate.

Failed to delete certificate.

Extension of certificate failed.

Failed to assign certificate to user.

Failed to delete assignment of certificate to user.

Failed to delete assignment of certificate to user.

administrator help

333

SafeGuard Enterprise

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2639

2640

2640

2641

2641

2642

2642

2643

2644

2645

2645

2634

2635

2635

2636

2637

2638

2638

2631

2631

2632

2633

2633

2634

Token plugged in.

Token plugged in.

Token removed.

Token issued to user.

Token issued to user.

Change user PIN on token.

Change user PIN on token.

Change SO PIN on token.

Change SO PIN on token.

Token locked.

Token unlocked.

Token deleted.

Token deleted.

Token assignment for user removed.

Failed to issue token for user.

Failed to issue token for user.

Failed to change user PIN on token.

Failed to change user PIN on token.

Failed to change SO PIN on token.

Failed to change SO PIN on token.

Failed to lock token.

Failed to unlock token.

Failed to delete token.

Failed to delete token.

334

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2663

2665

2667

2668

2670

2678

2678

2679

2680

2680

2681

2654

2657

2658

2659

2660

2661

2662

2647

2648

2650

2651

2652

2653

Policy created.

Policy changed.

Policy deleted.

Policy assigned and activated to OU.

Assigned policy removed from OU.

Failed to create policy.

Failed to change policy.

Failed to assign and activate a policy to OU.

Removing of assigned policy from OU failed.

Policy group created.

Policy group changed.

Policy group deleted.

Failed to create policy group.

Failed to change policy group.

Following policy has been added to policy group.

Following policy has been deleted from policy group.

Failed to add policy to policy group.

Failed to delete policy from policy group.

Recorded event exported.

Recorded event exported.

Export of recorded events failed.

Recorded events deleted.

Recorded events deleted.

Failed to delete recorded events.

administrator help

335

SafeGuard Enterprise

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2694

2695

2695

2696

2697

2698

2699

2700

2701

2702

2702

2687

2688

2692

2692

2693

2693

2694

2681

2684

2684

2685

2685

2686

Failed to delete recorded events.

Security Officer allows renewal of certificate.

Security Officer allows renewal of certificate.

Security Officer denies renewal of certificate.

Security Officer denies renewal of certificate.

Failed to alter renewal settings for certificate.

Officer certificate changed.

Failed to change officer certificate.

Creation of workgroups.

Creation of workgroups.

Failed creation of workgroups.

Failed creation of workgroups.

Deletion of workgroups.

Deletion of workgroups.

Failed deletion of workgroups.

Failed deletion of workgroups.

Creation of users.

Failed creation of users.

Creation of machines.

Failed creation of machines.

License is violated.

Key file has been created.

Key for key file has been deleted.

Key for key file has been deleted.

336

administrator help

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2717

2718

2719

2720

2721

2722

2723

2724

2725

2726

2727

2709

2710

2711

2712

2713

2715

2716

2703

2704

2705

2706

2707

2708

A Security Officer disabled power-on authentication in policy.

LSH Question Theme created.

LSH Question Theme changed.

LSH Question Theme deleted.

Question changed.

Configuration package for standalone client created.

Configuration package for Enterprise Client created.

CCO has been imported.

CCO has been exported.

CCO has been deleted.

Update of the company certificate.

Service Account List created.

Service Account List modified.

Service Account List deleted.

Cloud Storage Definition created.

Cloud Storage Definition modified.

Cloud Storage Definition deleted.

Application List created.

Application List modified.

Application List deleted.

Role created.

Role modified.

Role deleted.

Role assigned to Security Officer.

337

SafeGuard Enterprise

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2741

2742

2743

2744

2745

2746

2747

2748

2749

2750

2753

2734

2735

2736

2737

2738

2739

2740

2728

2729

2730

2731

2732

2733

Role unassigned from Security Officer.

Master Security Officer created.

Master Security Officer modified.

Master Security Officer deleted.

Master Security Officer certificate changed.

Master Security Officer certificate change failed.

Master Security Officer enabled.

Master Security Officer disabled.

Security Officer created.

Security Officer modified.

Security Officer deleted.

Security Officer deleted. Additional information about the children.

Security Officer enabled.

Security Officer disabled.

Security Officer moved.

Security Officer promoted.

Security Officer promoted. Additional information about the children.

Master Security Officer demoted.

Security Officer Group created.

Security Officer Group modified.

Security Officer Group deleted.

Security Officer added to Security Officer Group.

Security Officer removed from Security Officer Group.

Read access to container granted for Security Officer.

338

administrator help

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2766

2767

2768

2769

2770

2771

2772

2773

2800

2801

2810

2760

2761

2762

2763

2764

2765

2765

2754

2755

2756

2757

2758

2759

Read access to container granted for Security Officer Group.

Full access to container granted for Security Officer.

Full access to container granted for Security Officer Group.

Access to container revoked for Security Officer.

Access to container revoked for Security Officer Group.

Read access to policy granted for Security Officer.

Read access to policy granted for Security Officer Group.

Full access to policy granted for Security Officer.

Full access to policy granted for Security Officer Group.

Access to policy revoked for Security Officer.

Read access to policy revoked for Security Officer Group.

LSH Question number parameters changed.

LSH Question number parameters changed.

Access to container explicitly denied for Security Officer.

Explicitly denied access to container revoked for Security Officer.

Read access to container revoked for Security Officer.

File tracking viewer has been opened.

Policy deployment enabled by security officer.

Policy deployment disabled by security officer.

Policy deployment enabled by license management.

Policy deployment disabled by license management.

The confirmation of unconfirmed user was successful.

A user has not been automatically confirmed.

POA user created.

339

SafeGuard Enterprise

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

Administration

2832

2833

2834

2835

2850

2851

2852

2853

2854

2855

2856

2821

2822

2825

2826

2827

2830

2831

2811

2812

2815

2816

2817

2820

POA user modified.

POA user deleted.

Creation of POA user failed.

Modification of POA user failed.

Deletion of POA user failed.

POA group created.

POA group modified.

POA user group deleted.

Creation of POA user group failed.

Modification of POA user group failed.

Deletion of POA group failed.

POA Group is assigned to container.

Assigned POA Group removed from container.

Groups are activated for the assignment of POA Group to container.

Failed to assign POA Group to container.

Removing of assigned POA Group from Container failed.

Failed to activate groups for the assignment of POA Group to container.

Scheduler service stopped due to an exception.

Scheduler task executed successfully.

Scheduler task failed.

Scheduler task created or modified.

Scheduler task deleted.

The certificate signature algorithm for new certificates has been changed.

The certificate key length for new certificates has been changed.

340

administrator help

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Administration

Administration

Administration

Administration

Administration

Administration

3011

3018

3019

3020

3021

3022

3025

3026

3027

3028

3029

3003

3005

3006

3007

3008

3009

3010

2857

2858

2859

2900

2900

2905

The certificate validity period for new certificates has been changed.

The database has been upgraded successfully

The database upgrade failed

Response for Configuration Protection suspension created

Response for Configuration Protection suspension created

BitLocker recovery key was exported for machine

Kernel backup succeeded.

Kernel restore first chance succeeded.

Kernel restore second chance succeeded.

Kernel backup failed.

Kernel restore failed.

Kernel backup failed.

Backup token from POA removed

Backup token added to POA

The delayed encryption encrypted a file.

The delayed encryption decrypted a file.

File tracking for removable media: a file has been created.

File tracking for removable media: a file has been renamed.

File tracking for removable media: a file has been deleted.

File tracking for cloud storage: a file has been created.

File tracking for cloud storage: a file has been renamed.

File tracking for cloud storage: a file has been deleted.

File tracking: a file has been encrypted manually.

File tracking: a file has been decrypted manually.

341

SafeGuard Enterprise

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

Client

3081

3082

3110

3111

3116

3117

3200

3201

3202

3203

3300

3051

3055

3060

3070

3071

3072

3080

3030

3035

3040

3045

3046

3050

User has changed his LSH secrets after login.

LSH was activated

LSH was deactivated

LSH is available - Enterprise Client

LSH is available - Standalone Client

LSH is disabled - Enterprise Client

LSH isn't available - Standalone Client

The QST list (LSH questions) was changed

The user has changed his answers in LSH

Key backup saved to the specified network share.

Key backup could not be saved to the specified network share.

User turned off encryption.

Sophos UEFI boot entry has been repaired successfully.

Sophos UEFI boot entry repair failed.

The outlook add-in has been disabled although it is enabled in the SGN policy.

POA user imported into POA

POA user deleted from POA

Import of POA user into POA failed

Deletion of POA user from POA failed

Configuration Protection suspended.

Configuration Protection not suspended (wrong response).

Suspension of Configuration Protection ended by user.

Suspension of Configuration Protection ended (suspension time was over).

Master Application restarted

342

administrator help

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Client

Client

Client

Client

Client

Client

Client

Client

Client

Encryption

Encryption

Encryption

Encryption

3504

3505

3506

3507

3508

3509

3510

3511

3512

3513

3514

3407

3408

3409

3500

3501

3502

3503

3301

3302

3303

3304

3405

3406

Master Application was unexpectedly terminated

Master Application restart failed

An unhandled exception caused a crash in the Master application.

Termination of unknown MasterApp failed.

Configuration Protection client failed to uninstall.

Configuration Protection client experienced an internal error.

Configuration Protection client detected a possible tampering event.

Configuration Protection client detected a possible tampering of event logs.

Wrong passphrase entered.

Hard disk was successfully prepared for BitLocker encryption.

Access denied to medium on drive.

Access denied to data file.

Sector-based initial encryption of drive started.

Sector-based initial encryption of drive started (fast mode)

Sector-based initial encryption of drive completed successfully.

Sector-based initial encryption of drive failed and closed.

Sector-based initial encryption of drive cancelled.

Sector-based initial encryption of drive failed.

Sector-based decryption of drive started.

Sector-based decryption of drive completed successfully.

Sector-based decryption of drive failed and closed.

Sector-based decryption of drive cancelled.

Sector-based decryption of drive failed.

File-based initial encryption on a drive started.

343

SafeGuard Enterprise

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

3522

3524

3525

3526

3540

3541

3542

3515

3516

3517

3519

3520

3521

3543

3544

3545

3546

3547

3548

3549

3559

3560

3561

File-based initial encryption on a drive completed successfully.

File-based initial encryption on a drive failed and closed.

File-based initial encryption on a drive cancelled.

File-based decryption on a drive started.

File-based decryption on a drive closed successfully.

File-based decryption on a drive failed and closed.

File-based decryption on a drive cancelled.

Encryption of a file started.

Encryption of a file completed successfully.

Encryption of a file failed.

Decryption of a file started.

Decryption of a file completed successfully.

Decryption of a file failed.

Backup of boot key successful.

Maximum count of boot algorithms exceeded.

Read errors on KSA.

Disabling volumes according to the defined policies.

Warning: NTFS boot sector backup is missing on the volume.

The user has set new BitLocker credentials for starting up the computer.

The user tried to set new BitLocker credentials for starting up the computer but the operation failed.

Items from asynchronous encryption queue are missing.

Access Protection

Computer status has been changed to secure.

344

administrator help

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

Encryption

3574

3600

3601

3602

3603

3570

3571

3572

3573

3604

3605

3607

3610

3611

3612

3700

3701

3710

3711

3712

3713

3562

3563

Computer is secure, but policy setting "Remove keys on compromised machines" is not enabled. No action was taken.

Computer is insecure, but policy setting "Remove keys on compromised machines" is not enabled. No action was taken.

Media Encryption Key assigned.

Media Passphrase Key assigned.

Media Passphrase Key created.

Media Passphrase Key imported.

Broken key table detected.

General encryption error.

Encryption error - Engine: Volume missing.

Encryption error - Engine: Volume offline.

Encryption error - Engine: Volume removed.

Encryption error - Engine: Volume bad.

This computer is insecure. You must take further action.

Encryption error - Encryption key missing.

Encryption error - Origin KSA area corrupt.

Encryption error - Backup KSA area corrupt.

Encryption error - Origin ESA area corrupt.

File Share discarded an invalid path in the policy.

A trusted application could not be found.

File Share encryption started.

File Share encryption finished successfully.

File Share encryption completed with errors.

File Share encryption was cancelled.

345

SafeGuard Enterprise

Encryption

Encryption

Encryption

3714

3715

3800

Encryption

Encryption

3900

3999

Access Control 4400

Access Control 4401

Access Control 4402

Access Control 4403

Access Control 4404

Access Control 4405

Access Control 4406

Access Control 4407

Access Control 4408

Access Control 4409

Access Control 4410

Access Control 4411

Access Control 4412

Access Control 4413

Access Control 4414

Access Control 4415

Initial encryption has finished.

Initial encryption has finished for path.

Cloud Storage discarded an invalid path in the policy.

Encryption of self-decrypting HTML5 file has finished successfully.

Preparation of hard disk for BitLocker encryption has failed

Port successfully approved.

Device successfully approved.

Storage successfully approved.

WLAN successfully approved.

Port removed successfully.

Device removed successfully.

Storage device removed successfully.

WLAN disconnected successfully.

Port restricted.

Device restricted.

Storage device restricted.

WLAN restricted.

Port blocked.

Device blocked.

Storage device blocked.

WLAN blocked.

7.12 Policy types and their fields of applications

SafeGuard Enterprise policies include all settings needed to implement a company-wide security policy on endpoints.

346

administrator help

SafeGuard Enterprise policies can incorporate settings for the following areas (policy types):

■

General Settings

Settings for transfer rate, customization, logon recovery, background images, and so on.

■

Authentication

Settings for logon mode, device lock, etc.

■

PIN

Defines requirements for used PINs.

■

Password

Defines requirements for used passwords.

■

Passphrase

Defines requirements for passphrases used for SafeGuard Data Exchange.

■

Device Protection

Settings for volume- or file-based encryption (including settings for SafeGuard Data Exchange,

SafeGuard Cloud Storage and SafeGuard Portable): algorithms, keys, the drives on which data is to be encrypted, and so on.

■

Specific Machine Settings

Settings for SafeGuard Power-on Authentication (activate/deactivate), secure Wake on LAN, display options, and so on.

■

Logging

Defines events to be logged and their output destinations.

■

Configuration Protection

Note: Configuration Protection is only supported for SafeGuard Enterprise Clients up to

Version 6.0. This policy type is still available in the 7.0 SafeGuard Management Center to support old clients that have Configuration Protection applied.

Settings (allow/block) for the usage of ports and peripheral devices (removable media, printers, and so on.).

■

File Encryption

Settings for file-based encryption on local drives and network locations, especially for work groups on network shares.

In the SafeGuard Management Center, default policies are available for all policy types. For

Device Protection policies, policies for full disk encryption (target: mass storage), Cloud Storage

(target: DropBox) and Data Exchange (target: removable media) are available. The options in these default policies are set to the relevant values. You can modify the default settings according to your requirements. The default policies are named <policy type> (Default).

347

SafeGuard Enterprise

Note: The names of the default policies depend on the language setting during installation. If you change the language of the SafeGuard Management Center afterwards, the default policy names remain in the language set during installation.

7.12.1 General settings

Policy setting

Loading of Settings

Policy Loopback

Explanation

Replay Machine Settings

If Replay Machine Settings is selected in the field Policy Loopback, and the policy originates from a machine (Replay Machine settings in a user policy does not have any effect), this policy is implemented again at the end. This then overrides any user settings and the machine settings apply.

Ignore User

If you select Ignore User for a policy (machine policy) in the field

Policy Loopback and the policy originates from a machine, only the machine settings are analyzed. User settings are not analyzed.

No Loopback

No Loopback is the standard behavior: User policies take priority over machine policies.

How are the settings "Ignore User" and "Replay Machine

Settings" analyzed?

If there are active policy assignments, the machine policies are analyzed and consolidated first. If consolidation of the various policies results in the Ignore User attribute in policy loopback, policies that would have been applied for the user are no longer analyzed. This means that the same policies apply to the user as to the machine.

If the Replay Machine Settings value is applied in the case of the policy loopback, once the individual machine policies have been consolidated, the user policies are then merged with the machine policies. After consolidation, the machine policies are re-written and override any user policy settings. This means that if a setting is present in both policies, the machine policy value overrides the user policy value. If the consolidation of individual machine policies results in "not configured", the following applies: User settings take priority over machine settings.

Transfer Rate

348

administrator help

Policy setting

Connection interval to server

(minutes)

Explanation

Determines the period in minutes after which a SafeGuard Enterprise

Client sends a policy (changes) enquiry to the SafeGuard Enterprise

Server.

Note: To prevent a large number of clients contacting the server at the same time, communication is carried out during a period of +/-

50% of the interval you set. Example: If you set “90 minutes”, communication occurs after an interval that can be from 45 to 135 minutes.

Feedback

Improve Sophos SafeGuard

®

by sending anonymous usage data

Sophos is continuously trying to improve SafeGuard Enterprise.

Accordingly, clients regularly send anonymized data to Sophos. This data is exclusively utilized for improving the product. It cannot be used to identify customers or machines, and does not contain any other confidential information.

Because all data is sent anonymized, the data collection function is enabled by default.

If you set this option to No, no usage data will be sent to Sophos.

Logging

Feedback after number of events

The log system, implemented as Win32 Service “SGM LogPlayer”, collects log entries generated by SafeGuard Enterprise for the central database and stores them in local log files. These are located in the

Local Cache in the “Auditing\SGMTransLog” directory. These files are transferred to the transport mechanism which then sends them to the database through the SGN Server. Transfer takes place as soon as the transport mechanism has succeeded in creating a connection to the server. The log file therefore increases in size until a connection has been established. To limit the size of each log file, it is possible to set a maximum number of log entries in the policy.

Once the preset number of entries has been reached the logging system places the log file in the SGN Server transport queue and starts a new log file.

Customization

Language used on client

Language in which settings for SafeGuard Enterprise are displayed on the endpoint:

You can select a supported language or the endpoint's operating system language setting.

Logon recovery

349

SafeGuard Enterprise

Policy setting Explanation

Activate logon recovery after

Windows Local Cache corruption

The Windows Local Cache is the start and the end point for the data exchange between the endpoint and the server. It stores all keys, policies, user certificates and audit files. All data stored in the local cache are signed and cannot be changed manually.

By default, logon recovery after Local Cache corruption is deactivated.

This means the Local Cache will be restored automatically from its backup. In this case, no Challenge/Response procedure is required for repairing the Windows Local Cache. If the Windows Local Cache is to be repaired explicitly with a Challenge/Response procedure, set this field to Yes.

Local Self Help

Enable Local Self Help

Determines whether users are permitted to log on to endpoints with

Local Self Help if they have forgotten their password. With Local Self

Help, users can log on by answering a specified number of previously defined questions in the SafeGuard Power-on Authentication. They can regain access to their computers even if neither telephone nor internet connection are available.

Note: For the user to be able to use Local Self Help, automatic logon to Windows must be enabled. Otherwise, Local Self Help will not work.

Minimum length of answers

Welcome text under Windows

Defines the minimum character length for Local Self Help answers.

Specify the custom text to be displayed in the first dialog when launching the Local Self Help Wizard on the endpoint. Before you can specify the text here, it has to be created and registered in the policy

navigation area under Texts.

Users can define their own questions

As a security officer, you can define the set of questions to be answered centrally and distribute it to the endpoint in the policy.

However, you can also grant the users the right to define their own questions. To entitle users to define their own questions, select Yes.

Challenge / Response (C/R)

Enable logon recovery via C/R

Determines whether a user is permitted to generate a challenge in the SafeGuard Power-on Authentication (POA) to regain access to their computer with a Challenge/Response procedure.

Yes: User is permitted to generate a challenge. In this case, the user can regain access to their computer with a C/R procedure in an emergency.

No: User is not permitted to issue a challenge. In this case, the user cannot initiate a C/R procedure to regain access to their computer in an emergency.

350

administrator help

Policy setting

Allow automatic logon to

Windows

Information text

Explanation

Allows a user to log on to Windows automatically after authentication with Challenge/Response.

Yes: User is automatically logged on to Windows.

No: Windows logon screen appears.

Example: A user has forgotten their password. After the

Challenge/Response procedure, SafeGuard Enterprise logs the user on at the endpoint without a SafeGuard Enterprise password. In this case automatic Windows logon is switched off and the Windows logon screen is displayed. The user cannot log on because they do not know the SafeGuard Enterprise password (= Windows password). The setting Yes allows automatic logon and the user is able to move on from the Windows logon screen.

Display information text when a Challenge/Response procedure is initiated in the SafeGuard POA. For example: "Please contact Support

Desk on telephone number 01234-56789".

Before you specify a text here, you must create it as a text file in the

Policies navigation area under Texts.

Images

Prerequisite:

New images must be registered in the Policies navigation area of the SafeGuard Management Center under Images. The images will only be available after registration. Supported formats: .BMP, .PNG,

.JPEG.

Background image in POA

Background image in POA (low resolution)

Replace the blue SafeGuard Enterprise background with a custom background image. Customers may for example use the company logo in SafeGuard POA and at Windows logon. Maximum file size for all background bitmaps: 500 KB.

Normal:

Resolution: 1024x768 (VESA mode)

Colors: unlimited

Low:

Resolution: 640x480 (VGA mode)

Colors: 16 colors

351

SafeGuard Enterprise

Policy setting

Logon image in POA

Logon image in POA (low resolution)

Explanation

Replaces the SafeGuard Enterprise image displayed during SafeGuard

POA logon with a custom image, for example a company logo.

Normal:

Resolution: 413 x 140 pixels

Colors: unlimited

Low:

Resolution: 413 x 140 pixels

Colors: 16 colors

File Encryption

Trusted Applications

Ignored Applications

For file-based encryption by File Encryption and SafeGuard Data

Exchange, you can specify applications as trusted to grant them access to encrypted files. This is for example necessary to enable antivirus software to scan encrypted files.

Enter the applications you want to define as trusted in the editor list box of this field. Applications must be entered as fully qualified paths.

For file-based encryption by File Encryption and SafeGuard Data

Exchange, you can specify applications as ignored to exempt them from transparent file encryption/decryption. For example, if you define a backup program as an ignored application, encrypted data backed up by the program remains encrypted.

Enter the applications you want to define as ignored in the editor list box of this field. Applications must be entered as fully qualified paths.

Ignored Devices

For file-based encryption by File Encryption and SafeGuard Data

Exchange, you can exclude entire devices (for example disks) from file-based encryption.

In the editor list box, select Network to select a predefined device, or enter the required device names to exclude specific devices from encryption.

Enable persistent encryption

For file-based encryption by File Encryption and SafeGuard Data

Exchange, you can configure persistent encryption. With persistent encryption, copies of encrypted files will be encrypted, even when they are saved in a location not covered by an encryption rule.

This policy setting is activated by default.

352

administrator help

Policy setting

User is allowed to set default keys

Explanation

For file-based encryption by Cloud Storage you can configure whether the user is allowed to set a default key for encryption or not. If allowed, the Set default key command is added to the Windows Explorer context menu of Cloud Storage synchronization folders. Users can use the command to specify separate default keys to be used for encryption of different synchronization folders.

Email add-in settings

Enable email add-in

SafeGuard Enterprise includes an add-in for Microsoft Outlook that makes encrypting email attachments easy.

If you set this option to Yes, users will be prompted to decide how to handle attachments each time they send emails with attachments.

In addition, you can list domains and specify how attachments are handled when they are sent to these domains.

Behavior for white-listed domains

Encryption method for white-listed domains

Select how to handle attachments from the drop-down list:

Encrypted: All attachments in emails to the specified domain will be encrypted. Users will not be prompted.

No encryption: Attachments in emails to the specified domain will not be encrypted. Users will not be prompted.

Unchanged: Encrypted files will be sent encrypted, plain files will be sent in plaintext. Users will not be prompted.

Always ask: Users will be asked how to handle the attachments each time they send emails to the specified domain.

Domain whitelist

Enter one or more domains for which the encryption method should be applied. Enter several domains separated by commas. Wildcards and partially specified domains are not supported.

7.12.2 Authentication

Policy Setting

Access

Explanation

353

SafeGuard Enterprise

Policy Setting Explanation

User may only boot from internal hard disk

Note: This setting is only supported by endpoints with an earlier

SafeGuard Enterprise version than 6.1 installed. It was used to enable recovery by allowing the user to start the endpoint from external media. As of version 6.1 this setting does not have any effect on endpoints. For the recovery scenario concerned, you can use recovery with Virtual Clients, see

Challenge/Response using

Virtual Clients

(page 211).

Determines whether users may start the computer from the hard drive and/or another medium.

YES: Users can only boot from the hard disk. The SafeGuard POA does not offer the option to start the computer with a floppy disk or other external media.

NO: Users may start the computer from hard disk, floppy disk or external medium (USB, CD etc.)

Logon Options

Logon mode

Determines how users need to authenticate themselves at the

SafeGuard POA.

User ID/Password

Users have to log on with their user name and password.

Token

The user can only log on to the SafeGuard POA using a token or smartcard. This process offers a higher level of security. The user is requested to insert the token at logon. User identity is verified by token ownership and PIN presentation. After the user has entered the correct PIN, SafeGuard Enterprise automatically reads the data for user logon.

Note: Once this logon process has been selected, users can only log on using a previously issued token.

You can combine the settings User ID/Password and Token. To test whether logon using a token works, first select both settings.

Only deselect the User ID/Password logon mode, if authentication using the token was successful. In order to switch between logon modes, allow users to log on once while the two settings are combined or they might run into a logon deadlock. You must also combine the two settings, if you want to allow Local Self Help for token logon.

Fingerprint

Select this setting to enable logon with Lenovo Fingerprint

Reader. Users to whom this policy applies can then log on with a fingerprint or a user name and password. This procedure provides the maximum level of security. When logging on, users

354

administrator help

Policy Setting Explanation swipe their fingers over the fingerprint reader. Upon successful recognition of the fingerprint, the SafeGuard Power-on

Authentication process reads the user’s credentials and logs the user on to Power-on Authentication. The system then transfers the credentials to Windows, and the user is logged on to the computer.

Note: After selecting this logon procedure, the user can only log on with a pre-enrolled fingerprint or a user name and password. Token and fingerprint logon procedures cannot be combined on the same computer.

Display unsuccessful logons for this user

If this is set to Yes: After logon at the SafeGuard POA and

Windows, a dialog is shown containing information on the last failed logon (user name/date/time).

Display last user logon

If this is set to Yes: After logon at the SafeGuard POA and

Windows, a dialog is shown containing information on the last successful logon (user name/date/time) last user credentials of the logged on user

Disable 'forced logoff' in workstation lock

Note: This setting only takes effect on endpoints with Windows

XP. Windows XP is no longer supported as of SafeGuard Enterprise

6.1. This policy setting is still available in the SafeGuard

Management Center to support SafeGuard Enterprise 6 clients managed with a 7.0 Management Center.

If users wish to leave the endpoint for a short time only, they can click Block workstation to lock the computer for other users and unlock it with the user password. No: The user who has locked the computer as well as an administrator can unlock it. If an administrator unlocks the computer, the currently logged on user is logged off automatically. Yes: Changes this behavior. In this case, only the user can unlock the computer. The administrator cannot unlock it and the user will not be logged off automatically.

Activate user/domain preselection

Yes: The SafeGuard POA saves the user name and domain of the last logged on user. Users therefore do not need to enter their user name every time they log on.

No: The SafeGuard POA does not save the user name and the domain of the last logged on user.

Service Account List

To prevent administrative operations on a SafeGuard Enterprise protected endpoint leading to an activation of the Power-on

Authentication and the addition of rollout operators as users to the

355

SafeGuard Enterprise

Policy Setting

Pass through to Windows

Explanation endpoint, SafeGuard Enterprise allows you to create service account lists for Windows logon at SafeGuard Enterprise endpoints.

The users listed are treated as SafeGuard Enterprise guest users.

Before you select a list here you must first create the lists in the

Policies navigation area under Service Account Lists.

Note: For the user to be able to grant other users access to their computer, the user has to be permitted to deactivate logon passthrough to Windows.

Let user choose freely

The user can decide by selecting/deselecting this option in the

SafeGuard POA logon dialog whether automatic logon at

Windows is to be performed.

Disable pass-through to Windows

After the SafeGuard POA logon, the Windows logon dialog will be displayed. The user has to log on to Windows manually.

Enforce pass-through to Windows

The user will always be automatically logged on to Windows.

BitLocker Options

BitLocker Logon Mode for Boot

Volumes

The following options are available:

TPM: The key for logon is stored on the TPM (Trusted Platform

Module) chip.

TPM + PIN: The key for logon is stored on the TPM chip and a PIN is also required for logon.

Startup Key: The key for logon is stored on a USB memory stick.

TPM + Startup Key: The key for logon is stored on the TPM chip and on a USB memory stick. Both are needed for logon.

Note: To be able to use TPM + PIN, TPM + Startup Key or

Startup Key enable the Group Policy Require additional

authentication at startup either in Active Directory or on computers locally. In the Local Group Policy Editor (gpedit.msc) the Group Policy can be found here: Local Computer

Policy\Computer Configuration\Administrative

Templates\Windows Components\BitLocker Drive

Encryption\Operating System Drive

To use Startup Key you must also activate Allow BitLocker

without a compatible TPM in the Group Policy.

356

administrator help

Policy Setting Explanation

Note: If the logon mode that is currently active on the system is an allowed fallback logon mode, the logon mode set here is not enforced.

BitLocker Fallback Logon Mode for

Boot Volumes

If the setting defined as BitLocker Logon Mode for Boot Volumes cannot be applied, SafeGuard Enterprise offers the following alternatives for logon:

Password: The user will be required to enter a password.

Startup Key: The key for logon is stored on a USB memory stick.

Password or Startup Key: USB memory sticks will be used only if passwords are not supported on the client operating system.

Error: An error message will be displayed and the volume will not be encrypted.

Note: In the case of clients with version 6.1 or earlier the values

Password or Startup Key and Password will be mapped to the old settings USB Memory Stick and Error.

Note: Passwords are only supported on Windows 8 or later.

BitLocker Logon Mode for Non-Boot

Volumes

For non-boot volumes (fixed data drives) the following options are available:

Auto-Unlock: If the boot volume is encrypted, an external key is created and stored on the boot volume. The non-boot volume(s) will then be encrypted automatically. They will be unlocked automatically using the auto-unlock functionality provided by BitLocker. Note that auto-unlock works only if the boot volume is encrypted. Otherwise the fallback mode will be used.

Password: The user will be prompted to enter a password for each non-boot volume.

Startup Key: The keys for unlocking the non-boot volumes are stored on a USB stick.

Note: Clients with version 6.1 or earlier ignore this policy setting and they use the values defined for the logon mode for boot volumes instead. As the TPM cannot be used for non-boot volumes, USB memory stick or an error message will be used in such cases.

Note: Passwords are only supported on Windows 8 or later.

357

SafeGuard Enterprise

Policy Setting Explanation

Note: If the logon mode that is currently active on the system is an allowed fallback logon mode, the logon mode set here is not enforced.

BitLocker Fallback Logon Mode for

Non-Boot Volumes

If the setting defined as BitLocker Logon Mode for Non-Boot

Volumes cannot be applied, SafeGuard Enterprise offers the following alternatives:

Password: The user will be prompted to enter a password for each non-boot volume.

Startup Key: The keys are stored on a USB memory stick.

Password or Startup Key: USB memory sticks will be used only if passwords are not supported on the client operating system.

Note: Clients with version 6.1 or earlier ignore this policy setting. They instead use the values defined for the fallback logon mode for boot volumes. As they cannot handle passwords, USB memory stick or error message will be used instead.

Note: Passwords are only supported on Windows 8 or later.

Failed Logons

Maximum no. of failed logons

Determines how many times a user can attempt to log on using an invalid user name or password. After incorrectly entering a user name or password three times in a row for instance, a fourth attempt will lock the computer.

Display "Logon failed" messages in

POA

Defines level of detail for messages on failed logons:

Standard: Shows a short description.

Verbose: Displays more detailed information.

Token Options

Action if token logon status is lost

Defines behavior after removing the token from the computer:

Possible actions include:

Lock Computer

Present PIN dialog

No Action

358

administrator help

Policy Setting

Allow unblocking of token

Lock Options

Lock screen after X minutes inactivity

Explanation

Determines whether the token may be unblocked at logon.

Lock screen at token removal

Lock screen after resume

Determines the time after which an unused desktop is automatically locked.

The default value is 0 minutes, and the desktop will not be locked if this value is not changed.

Determines whether the screen is locked if a token is removed during a session.

Determines whether the screen is locked if the computer is reactivated from standby mode.

7.12.3 Syntax rules for PINs

In policies of the type PIN, you define settings for token PINs. These settings do not apply to PINs used for logon at BitLocker encrypted endpoints. For more information on BitLocker PINs see

PIN and passwords

(page 140).

PINs can contain numbers, letters and special characters (for example + - ; etc.). However, when issuing a new PIN, do not use any character with the combination ALT + < character > as this input mode is not available at SafeGuard Power-on Authentication.

Note: Define PIN rules either in the SafeGuard Management Center or in the Active Directory, not both.

Explanation Policy Setting

PIN

Min. PIN length

Max. PIN length

Min. number of letters

Min. number of digits

Specifies the number of characters a PIN must comprise when changed by the user. The required value can be entered directly or increased/reduced using the arrow buttons.

Specifies the maximum number of characters a PIN may comprise when changed by a user. The required value can be entered directly or increased/reduced using the arrow buttons.

These settings specify that a PIN must not consist exclusively of letters, numbers or special characters, but of a combination of at least two (for example 15flower). These settings only make sense if a minimum PIN length of greater than 2 has been defined.

359

SafeGuard Enterprise

Policy Setting

Min. number of special characters

Keyboard row forbidden

Explanation

Keyboard column forbidden

Three or more consecutive characters forbidden

Refers to keys arranged consecutively in rows on the keyboard such as "123" or "qwe". A maximum of two adjacent characters on the keyboard is allowed. Consecutive key sequences relate only to the alphanumerical keyboard area.

Refers to keys arranged consecutively in columns on the keyboard such as "xsw2" or "3edc" (but not "xdr5" or "cft6"!). A maximum of two adjacent symbols in a single keyboard column is permitted. If you disallow keyboard columns, combinations like these are rejected as

PINs. Consecutive key sequences relate only to the alphanumerical keyboard area.

The activation of this option disallows key sequences which are consecutive series of ASCII code symbols in both ascending and descending order ("abc" or "cba").

which consist of three or more identical characters ("aaa" or "111").

User name as PIN forbidden

Determines whether user name and PIN may be identical.

Yes: Windows user name and PIN must be different.

No: Users may use their Windows user names as PINs.

Use forbidden PIN list

List of forbidden PINs

Determines whether certain character sequences must not be used for PINs. The character sequences are stored in the List of forbidden

PINs (for example .txt file).

Defines character sequences which must not be used for PINs. If a user uses a forbidden PIN, an error message will be displayed.

Prerequisite:

A list (file) of forbidden PINs must be registered in the Management

Center in the policies navigation area under Texts, see

Create forbidden PIN lists for use in policies

(page 362). The list is only available after registration.

Maximum file size: 50 KB

Supported format: Unicode

Defining forbidden PINs

In the list, forbidden PINs are separated by a line break.

Wildcard: Wildcard character "*" can represent any character and any number of characters in a PIN. Therefore *123* means that any series of characters containing 123 will be disallowed as a PIN.

360

administrator help

Policy Setting Explanation

Note:

If the list contains only a wildcard, the user will no longer be able to log on to the system after a forced password change.

Users must not be permitted to access the file.

Option Use forbidden PIN list must be activated.

Case sensitive

This setting is only effective with Use forbidden PIN list and User

name as PIN forbidden.

Example 1: You have entered "board" in the list of forbidden PINs.

If the Case sensitive option is set to Yes, additional PIN variants such as BOARD, BoaRD will not be accepted and logon will be denied.

Example 2: "EMaier" is entered as a user name. If the Case sensitive option is set to Yes and the User name as PIN forbidden option is set to No, user EMaier cannot use any variant of this user name (for example "emaier" or "eMaiER") as a PIN.

Changes

PIN change after min. (days)

Determines the period during which a PIN must not be changed. This setting prevents the user from changing a PIN too many times within a specific period.

Example:

User Miller defines a new PIN (for example "13jk56"). The minimum change interval for this user (or group to which this user is assigned) is set to five days. After two days the user wants to change the PIN to "13jk56". The PIN change is rejected because Mr. Miller may only define a new PIN after five days have passed.

PIN change after max. (days)

The user has to define a new PIN after the set period has expired. If the period is set to 999 days, no PIN change is required.

Notify of forced change before

(days)

A warning message is displayed "n" days before PIN expiry reminding the user to change their PIN in "n" days. Alternatively, the user may change the PIN immediately.

General

Hide PIN in POA

Specifies whether the digits entered are hidden when entering PINs.

If enabled, nothing is shown when PINs are entered in the POA.

Otherwise, PINs are shown masked with asterisks.

361

SafeGuard Enterprise

Policy Setting

PIN history length

Explanation

Determines when previously used PINs can be reused. It makes sense to define the history length in conjunction with the PIN change

after max. (days) setting.

Example:

The PIN history length for user Miller is set to 4, and the number of days after which the user must change their PIN is 30. Mr. Miller is currently logging on using the PIN "Informatics". After the 30 day period expires, he is asked to change his PIN. Mr. Miller types in

"Informatics" as the new PIN and receives an error message that this

PIN has already been used and he needs to select a new PIN. Mr.

Miller cannot use the PIN "Informatics" until after the fourth request to change the PIN (in other words PIN history length = 4).

7.12.3.1 Create forbidden PIN lists for use in policies

For policies of the type PIN a list of forbidden PINs can be created to define character sequences which must not be used in PINs. PINs are used for token logon. For further information, see

Tokens and smartcards (page 290).

The text files containing the required information have to be created before you can register them in the SafeGuard Management Center. The maximum file size for text files is 50 KB. SafeGuard

Enterprise only uses Unicode UTF-16 coded texts. If you create the text files in another format, they will be automatically converted when they are registered.

Note: In the lists, forbidden PINs are separated by a line break.

To register text files:

1. In the policy navigation area, right-click Texts and select New > Text.

2. Enter a name for the text to be displayed in the Text item name field.

3. Click [...] to select the text file previously created. If the file needs to be converted, a message will be displayed.

4. Click OK.

The new text item is displayed as a subnode below Texts in the policy navigation area. If you select a text item, its contents are displayed in the window on the right-hand side. The text item can now be selected when creating policies.

Proceed as described to register further text items. All registered text items are shown as subnodes.

Note: Using the Modify Text button, you can add new text to existing text. When clicking this button, a dialog is displayed for selecting another text file. The text contained in this file is appended to the existing text.

7.12.4 Syntax rules for passwords

In policies of type Password, you define rules for passwords used to log on to the system. These settings do not apply to passwords used for logon at BitLocker encrypted endpoints. For more

information on BitLocker passwords see PIN and passwords (page 140).

362

administrator help

Passwords can contain numbers, letters and special characters (for example + - ; etc.). However, when issuing a new password, do not use any character with the combination ALT + <character> as this input mode is not available at SafeGuard Power-on Authentication. Rules for passwords used to log on to the system are defined in policies of the type Password.

Note: To enforce a strong password policy, see Security recommendations (page 233) as well

as the SafeGuard Enterprise manual for certification-compliant operation.

The enforcement of password rules and password history can only be guaranteed if the SGN credential provider is used consistently. Define password rules either in the SafeGuard

Management Center or in the Active Directory, not both.

Policy setting Explanation

Password

Min. password length

Max. password length

Specifies the number of characters a password must comprise when changed by the user. The required value can be entered directly or increased/reduced using the arrow buttons.

Specifies the maximum number of characters a password may comprise when changed by a user. The required value can be entered directly or increased/reduced using the arrow buttons.

Min. number of letters

Min. number of digits

Min. number of special characters

These settings specify that a password must not consist exclusively of letters, numbers or special characters, but of a combination of at least two (for example 15flower). These settings only make sense if a minimum password length of greater than 2 has been defined.

Keyboard row forbidden

Keyboard column forbidden

Three or more consecutive characters forbidden

Refers to keys arranged consecutively in rows on the keyboard such as "123" or "qwe". A maximum of two adjacent characters on the keyboard is allowed. Consecutive key sequences relate only to the alphanumerical keyboard area.

Refers to keys arranged consecutively in columns on the keyboard such as "xsw2" or "3edc" (but not "xdr5" or "cft6"!). A maximum of two adjacent symbols in a single keyboard column is permitted. If you disallow keyboard columns, combinations like these are rejected as passwords. Consecutive key sequences relate only to the alphanumerical keyboard area.

The activation of this option disallows key sequences which are consecutive series of ASCII code symbols in both ascending and descending order ("abc" or "cba").

which consist of three or more identical characters ("aaa" or

"111").

363

SafeGuard Enterprise

Policy setting Explanation

User name as password forbidden

Determines whether user name must not be used as a password.

Yes: Windows user name and password must be different.

No: Users may use their Windows user names as passwords.

Use forbidden password list

List of forbidden passwords

Determines whether certain character sequences must not be used for passwords. The character sequences are stored in the List of

forbidden passwords (for example .txt file).

Defines character sequences which must not be used for passwords. If a user uses a forbidden password, an error message will be displayed.

A list (file) of forbidden passwords must be registered in the

SafeGuard Management Center in the policies navigation area

under Texts, see Create forbidden password list for use in policies

(page 366). The list is only available after registration.

Maximum file size: 50 KB

Supported format: Unicode

Defining forbidden passwords

In the list, forbidden passwords are separated by a line break.

Wildcard: The wildcard character "*" can represent any character and any number of characters in a password. Therefore *123* means that any series of characters containing 123 will be disallowed as a password.

Note:

If the list contains only a wildcard, the user will no longer be able to log on to the system after a forced password change.

Users must not be permitted to access the file.

Option Use forbidden password list must be activated.

Case sensitive

This setting is only effective with Use forbidden password list and User name as password forbidden.

Example 1: You have entered "board" in the list of forbidden passwords. If the Case sensitive option is set to Yes, additional password variants such as BOARD, BoaRD will not be accepted and logon will be denied.

Example 2: "EMaier" is entered as a user name. If the Case

sensitive option is set to Yes and the User name as password

forbidden option is set to No, user EMaier cannot use any variant of this user name (for example "emaier" or "eMaiER") as a password.

Changes

364

administrator help

Policy setting Explanation

Password change allowed after min.

(days)

Determines the period during which a password may not be changed. This setting prevents the user from changing a password too many times within a specific period. If the user is forced to change their password by Windows or if the user changes their password after a warning message has been displayed stating that the password will expire in x days, this setting will not be evaluated!

Example:

User Miller defines a new password (for example "13jk56"). The minimum change interval for this user (or group to which this user is assigned) is set to five days. After two days the user wants to change the password to "13jk56".The password change is rejected because user Miller may only define a new password after five days have passed.

Password expires after (days)

Notify of forced change before

(days)

If you set this option, the user has to define a new password after the set period has expired.

A warning message is displayed "n" days before password expiry reminding the user to change their password in "n" days.

Alternatively, the user may change the password immediately.

General

Hide password in POA

Password history length

Specifies whether the characters entered are hidden when entering passwords. If enabled, nothing is shown when passwords are entered in the POA. Otherwise, passwords are shown masked with asterisks.

Determines when previously used passwords can be reused. It makes sense to define the history length in conjunction with the

Password expires after (days) setting.

Example:

The password history length for user Miller is set to 4, and the number of days after which the user must change their password is 30. Mr. Miller is currently logging on using the password

"Informatics". After the 30 day period expires, he is asked to change his password. Mr. Miller types in "Informatics" as the new password and receives an error message that this password has already been used and he needs to select a new password. Mr. Miller cannot use the password "Informatics" until after the fourth request to change the password (in other words password history length = 4).

Note: If you set the password history length to 0, the user can set the old password as the new password. This is not good practice and should be avoided.

User password synchronization to other SGN Clients

This field determines the procedure of synchronizing passwords when users, who work on several SafeGuard Enterprise endpoints

365

SafeGuard Enterprise

Policy setting Explanation and are defined as users on these endpoints, change their passwords. The following options are available:

Slow (wait for user to log on)

If a user changes their password on a SafeGuard Enterprise endpoint and intends to log on to another endpoint on which the user is also registered, they have to log on using their old password at the SafeGuard Power-on Authentication first.

Password synchronization will only be performed after logging on using the old password first.

Fast (wait for machine to connect)

If a user changes their password on a SafeGuard Enterprise endpoint, password synchronization with other endpoints, on which the user is also registered, will be performed as soon as the other endpoint has established a connection to the server.

This is for example the case, when another user, who is also registered as a user on the endpoint, logs on to the endpoint in the meantime.

7.12.4.1 Create forbidden password list for use in policies

For policies of type Password, you can create a list of forbidden passwords to define character sequences that must not be used in passwords.

Note: In the lists, forbidden passwords are separated by line breaks.

The text files containing the required information have to be created before you can register them in the SafeGuard Management Center. The maximum file size for text files is 50 KB. SafeGuard

Enterprise only uses Unicode UTF-16 coded texts. If you create the text files in another format, they will be automatically converted when they are registered.

If a file is converted, a message is displayed.

To register text files:

1. In the policy navigation area, right-click Texts and select New > Text.

2. Enter a name for the text to be displayed in the Text item name field.

3. Click [...] to select the text file previously created. If the file needs to be converted, a message will be displayed.

4. Click OK.

The new text item is displayed as a subnode below Texts in the policy navigation area. If you select a text item, its contents are displayed in the window on the right-hand side. The text item can now be selected when creating policies.

Proceed as described to register further text items. All registered text items are shown as subnodes.

Note: Use the Modify Text button to add new text to existing text. When you click this button, a dialog is displayed for selecting another text file. The text contained in this file is appended to the existing text.

366

administrator help

7.12.5 Passphrase for SafeGuard Data Exchange

The user must enter a passphrase which is used to generate local keys for secure data exchange with SafeGuard Data Exchange. The keys generated on the endpoints are also stored in the

SafeGuard Enterprise Database. In policies of the type Passphrase, you define the relevant requirements.

For details of SafeGuard Data Exchange, see SafeGuard Data Exchange

(page 166).

For further details of SafeGuard Data Exchange and SafeGuard Portable on the endpoint refer to the SafeGuard Enterprise user help, chapter SafeGuard Data Exchange.

Policy Setting Explanation

Passphrase

Min. passphrase length

Max. passphrase length

Defines the minimum number of characters for the passphrase from which the key is generated. The required value can be entered directly or increased/reduced using the arrow keys.

Defines the maximum number of characters for the passphrase. The required value can be entered directly or increased/reduced using the arrow keys.

Min. number of letters

Min. number of digits

Min. number of special characters

This setting specifies that a passphrase must not consist exclusively of letters, numbers or symbols, but of a combination of that least two

(for example 15flower). These settings only make sense if a minimum passphrase length of greater than 2 has been defined.

Keyboard row forbidden

Keyboard column forbidden

Three or more consecutive characters forbidden

Refers to keys arranged consecutively in rows on the keyboard such as "123" or "qwe". A maximum of two adjacent characters on the keyboard is allowed. Consecutive key sequences relate only to the alphanumerical keyboard area.

Refers to keys arranged consecutively in columns on the keyboard such as "xsw2" or "3edc" (but not "xdr5" or "cft6"!). A maximum of two adjacent characters in a single keyboard column is permitted. If you disallow keyboard columns, these combinations are rejected for passphrases. Consecutive key sequences relate only to the alphanumerical keyboard area.

The activation of this option disallows key sequences which are consecutive series of ASCII code symbols in both ascending and descending order ("abc" or "cba").

which consist of three or more identical characters ("aaa" or

"111").

367

SafeGuard Enterprise

Policy Setting

User name as passphrase forbidden

Case sensitive

Explanation

Determines whether the user name and passphrase may be identical.

Yes: Windows user name and passphrase must be different.

No: Users may use their Windows user names as passphrases.

This setting is effective when User name as passphrase forbidden is active.

Example: "EMaier" is entered as a user name. If the option Case

sensitive is set to YES and User name as passphrase forbidden is set to NO, user EMaier cannot use any variant of this user name

(for example emaier or eMaiER) as a passphrase.

7.12.6 White Lists for Device Protection policies for file-based encryption

In the SafeGuard Management Center, you can select White Lists as targets for policies of the type Device Protection for file-based encryption. This allows you to create encryption policies for specific device models or even for distinct devices.

Before you select a White List as a target for a Device Protection policy, you have to create and register it in the SafeGuard Management Center. You can define White Lists for specific storage device models (for example iPod, USB devices from a specific vendor etc.) or for distinct storage devices according to serial number. You can add the devices to White Lists manually or use the results of a SafeGuard PortAuditor scan. For further information, refer to the SafeGuard PortAuditor

user guide.

Afterwards, you can select the White List as a target when you create a Device Protection policy.

Note: If you select a White List as a target for a policy of the type Device Protection, you can only select File-Based or No Encryption as the Media encryption mode. If you select No

Encryption for a Device Protection policy with a White List, this policy does not exclude a device from encryption, if another policy applies that specifies volume-based encryption.

Note: For SafeStick devices from BlockMaster special requirements apply. These devices have different IDs for administrators and users without administrator privileges. For consistent handling within SafeGuard Enterprise, you must add both IDs to White Lists. SafeGuard PortAuditor detects both IDs, if a SafeStick device has been opened at least once on the computer scanned by

SafeGuard PortAuditor.

7.12.6.1 Create White Lists for Device Protection policies for file-based encryption

1. In the Policies navigation area, select White List.

2. In the context menu of White List, click New > White List.

3. Select the White List type:

■

To create a White List for specific device models, select Storage Device Models.

■

To create a White List for specific devices according to serial number, select Distinct

Storage Devices.

368

administrator help

4. Under Source of White List, specify how you want to create the White List:

■

To enter devices manually, select Create White List manually.

When you click OK, an empty White List is opened in the SafeGuard Management Center.

In this empty White List, you can create entries manually. To add a new entry, click the green Add (Insert) icon in the SafeGuard Management Center toolbar.

Note: To retrieve the relevant strings for a device with the Windows Device Manager, open the Properties window for the device and look at the values for the Hardware Ids and

Device Instance Path properties. Only the following interfaces are supported: USB, 1394,

PCMCIA and PCI.

■

If you want to use the result of a scan of endpoints by SafeGuard PortAuditor as a source, select Import from SafeGuard PortAuditor Result.

The results of the SafeGuard PortAuditor scan have to be available (XML file), if you want to create the White List based on this source. To select the file, click the [...] button.

For further information refer to the SafeGuard PortAuditor user guide.

Click OK, to display the contents of the imported file in the SafeGuard Management Center.

The White List is displayed under White Lists in the Policies navigation area. You can select it when you create policies of the type Device Protection for file-based encryption.

7.12.6.2 Select White Lists as targets for Device Protection policies for file-based encryption

Prerequisite: The required White List must have been created in the SafeGuard Management

Center.

1. In the navigation area of the SafeGuard Management Center, click Policies.

2. In the navigation window, right-click Policy Items and select New.

3. Select Device Protection.

A dialog for naming the new policy is displayed.

4. Enter a name and optionally a description for the new policy.

5. Under Device protection target, select the relevant White List:

■

If you have created a White List for storage device models, it is displayed under Storage

Device Models.

■

If you have created a White List for distinct storage devices, it is displayed under Distinct

Storage Devices.

6. Click OK.

The White List has been selected as a target for the Device Protection policy. After the policy has been transferred to the endpoint, the encryption mode selected in the policy applies.

7.12.7 Device Protection

Policies of type Device Protection cover the settings for data encryption on different data storage devices. Encryption can be volume- or file-based with different keys and algorithms. Policies of

369

SafeGuard Enterprise type Device Protection also include settings for SafeGuard Data Exchange, SafeGuard Cloud

Storage and SafeGuard Portable. For further information, see SafeGuard Data Exchange

(page

166) and Cloud Storage

(page 160). For further details on SafeGuard Data Exchange, SafeGuard

Cloud Storage and SafeGuard Portable on the endpoint, refer to the SafeGuard Enterprise user

help.

When creating a policy for device protection, you first have to specify the target for device protection. Possible targets are:

■

■

■

■

Internal storage (boot volumes or non-boot volumes)

Removable media

Optical drives

Drive letters

■

■

Storage device models

Distinct storage devices

■

Cloud Storage definitions

For each target, create a separate policy.

Note: Removable media: A policy that specifies volume-based encryption of removable drives and allows the user to choose a key from a list (for example Any key in user key ring) can be circumvented by the user by not choosing a key. To make sure that removable drives are always encrypted, either use a file-based encryption policy, or explicitly set a key in the volume-based encryption policy.

Policy Setting

Media encryption mode

Explanation

Used to protect devices (PCs, notebooks and so on) and all types of removable media.

Note: This setting is mandatory.

The primary objective is to encrypt all data stored on local or external storage devices. The transparent operating method enables users to continue to use their usual applications, for example Microsoft Office.

Transparent encryption means that all encrypted data (whether in encrypted directories or volumes) is automatically decrypted in the main memory as soon as it is opened in a program. A file is automatically re-encrypted when it is saved.

The following options are available:

No encryption

Volume-based (= transparent, sector-based encryption)

Ensures that all data is encrypted (incl. boot files, swapfiles, idle files/hibernation files, temporary files, directory information etc.) without the user having to change normal operating procedures or consider security.

File-based (= transparent, file-based encryption, Smart Media

Encryption)

370

administrator help

Policy Setting Explanation

Ensures that all data is encrypted (apart from Boot Medium and directory information) with the benefit that even optical media such as CD/DVD can be encrypted or data can be swapped with external computers on which SafeGuard Enterprise is not installed (provided policies permit).

Note: For policies with White Lists, only No encryption or File-based can be selected.

General Settings

Algorithm to be used for encryption

Sets the encryption algorithm.

List of all usable algorithms with respective standards:

AES256: 32 bytes (256 bits)

AES128: 16 bytes (128 bits)

Key to be used for encryption

Defines which key is used for encryption.You can define specific keys

(for example machine key or a defined key) or you can allow the user to select a key. You can also restrict the keys which a user is allowed to use.

The following options are available:

Any key in user key ring

All keys from a user's key ring are displayed and the user can select any one of them.

Note: This option has to be selected, if you define a policy for file-based encryption for an unmanaged endpoint protected by

SafeGuard Enterprise (standalone).

Any key in user key ring, except user key

All except user keys from a user's key ring are displayed and the user can select any one of them.

Any group key in user key ring

All group keys from a user's key ring are displayed and the user can select any one of them.

Defined machine key

The machine key is used - the user CANNOT select a key

Note: This option has to be selected, if you define a policy for volume-based encryption for an unmanaged endpoint protected by SafeGuard Enterprise (standalone mode). If you nevertheless select Any key in user key ring and the user selects a locally created key for volume-based encryption, access to this volume will be denied.

Any key in key ring, except locally created keys

371

SafeGuard Enterprise

Policy Setting

Defined key for encryption

Explanation

All except locally generated keys from a key ring are displayed and the user can select any one of them.

Defined key on list

The administrator can select any available key when setting policies in the Management Center.

The key has to be selected under Defined key for encryption.

If the option Defined machine key is used:

If only SafeGuard Data Exchange is installed on an endpoint (no

SafeGuard POA, no volume-based encryption), a policy defining the

Defined machine key as the key to be used for file-based encryption will not become effective on this endpoint. The defined machine key is not available on an endpoint of this type. The data cannot be encrypted.

Policies for unmanaged endpoint protected by SafeGuard Enterprise

(standalone):

Note: Note that only the Any key in user key ring option can be used when creating policies for unmanaged endpoint computers. In addition, creating local keys must be allowed for this type of endpoint computer.

If the media passphrase feature is activated for unmanaged endpoints, the Media Encryption Key is automatically used as Defined key for

encryption, since no group keys are available on unmanaged endpoints. Selecting another key under Defined key for encryption when creating a removable media policy for unmanaged endpoints will have no effect.

This field only becomes active, if you have selected the option Defined

key on list in the Key to be used for encryption field. Click [...] to display the Find Keys dialog. Click Find now, to search for keys and select a key from the list displayed.

In case of a policy of the type Device protection with target

Removable Media this key is used to encrypt the Media Encryption

Key when the media passphrase functionality is enabled (User may

define a passphrase for devices set to Yes).

For Device Protection policies for removable media the settings

Key to be used for encryption

Defined key for encryption

therefore must be specified independently from each other.

Policies for unmanaged endpoints protected by SafeGuard

Enterprise (standalone):

If the media passphrase feature is activated for unmanaged endpoints, the Media Encryption Key is automatically used as Defined key for

372

administrator help

Policy Setting Explanation

encryption, since no group keys are available on unmanaged endpoints.

User is allowed to create a local key

This setting determines whether users can generate a local key on their computers or not. The default setting is Yes, users are allowed to create local keys.

Note: A policy that forbids users to create local keys (User is allowed

to create a local key set to No) will only be applied on Windows endpoints.

Local keys are generated on the endpoint based on a passphrase entered by the user. The passphrase requirements can be set in policies of the type Passphrase.

These keys are also saved in the database. The user can use them on any endpoint they are logged on to.

Local keys can be used for secure data exchange with SafeGuard

Data Exchange (SG DX). For more information, see

Local keys

(page

167).

Volume-Based Settings

Users may add or remove keys to or from encrypted volume

Yes: Endpoint users may add/remove keys to/from a key ring. The dialog is displayed from the context menu command

Properties/Encryption tab.

No: Endpoint users may not add additional keys.

Reaction to unencrypted volumes

Defines how SafeGuard Enterprise handles unencrypted media.

The following options are available:

Reject (= text medium is not encrypted)

Accept only blank media and encrypt

Accept all media and encrypt

User may decrypt volume

Fast initial encryption

Proceed on bad sectors

Allows the user to decrypt the volume with a context menu command in Windows Explorer.

Select this setting to enable the fast initial encryption mode for volume-based encryption. This mode reduces the time needed for initial encryption on endpoints.

Note: This mode may lead to a less secure state. For further information, see

Fast initial encryption

(page 176).

Specifies whether encryption should proceed or be stopped if bad sectors are detected. The default setting is Yes.

373

SafeGuard Enterprise

Policy Setting

File-Based Settings

Initial encryption of all files

Explanation

Automatically starts initial encryption for a volume after user logon.

The user may need to select a key from the key ring beforehand.

Enables the user to cancel initial encryption.

User may cancel initial encryption

User is allowed to access unencrypted files

User may decrypt files

Defines whether a user may access unencrypted data on a volume.

User may define a media passphrase for devices

Copy SafeGuard Portable to target

Enables the user to decrypt individual files or whole directories (with the Windows Explorer extension <right-click>).

Enables the user to define a media passphrase on their computers.

The media passphrase makes it possible to easily access all local keys used on computers without SafeGuard Data Exchange with

SafeGuard Portable.

If this option is selected, SafeGuard Portable is copied to any removable media connected to the endpoint and any synchronization folder defined in a Cloud Storage Definition for SafeGuard Cloud

Storage as soon as content is written to the encrypted media or folder.

SafeGuard Portable enables the exchange of encrypted data with removable media or cloud storage without the recipient having

SafeGuard Enterprise installed.

The recipient can decrypt and re-encrypt the encrypted files using

SafeGuard Portable and the corresponding passphrase. The recipient can re-encrypt files with SafeGuard Portable or use the original key for encryption.

SafeGuard Portable does not have to be installed or copied to the recipient's computer but can be used directly from the removable media or cloud storage synchronization folder.

Default initial encryption key

This field offers a dialog for selecting a key which is used for file-based initial encryption. If you select a key here, the user cannot select a key when initial encryption starts. Initial encryption starts without user interaction.

The key selected will always be used for initial encryption.

Example:

Prerequisite: A default key for initial encryption has been set.

When the user connects a USB device to the computer, initial encryption automatically starts. The key defined is used. The user does not have to interfere. If the user afterwards wants to re-encrypt files or save new files on the USB device, they can select any key (if allowed and available). If the user connects a different USB device, the key defined for initial encryption will be used again. This key will

374

administrator help

Policy Setting Explanation also be used for all encryption processes that follow until the user explicitly selects a different key.

Note: If the media passphrase feature is activated, this option will be deactivated. The Defined key for encryption will be used.

Plaintext folder

The folder specified here will be created on all removable media, mass storage devices and cloud storage synchronization folder. Files that are copied to this folder will always stay plaintext.

User is allowed to decide about encryption

You can allow the user to decide about encryption of files on removable media and mass storage devices:

If you set this option to Yes, users are prompted to decide whether data should be encrypted. For mass storage devices, the prompt is displayed after each logon, for removable media the prompt is displayed when they plug in removable media.

If you set this option to Yes, remember user settings, users can select the option Remember this setting and do not show this

dialog again to have their choice remembered for the relevant device. In this case, the dialog will not be displayed for the relevant device again.

If the user selects No in the dialog displayed on the endpoint, neither initial nor transparent encryption occurs.

7.12.8 Specific machine settings - basic settings

Policy Settings

Power-On Authentication (POA)

Enable Power-on Authentication

Explanation

Defines whether the SafeGuard POA is switched on or off.

Important: For security reasons we strongly recommend that you keep the SafeGuard POA switched on. Deactivating the SafeGuard POA reduces the system security to Windows logon security and increases the risk of unauthorized access to encrypted data.

Access denied if no connection to the server

(days) (0 = no check)

Refuses SafeGuard POA logon if there was no connection between endpoint and server for longer than the set period.

375

SafeGuard Enterprise

Policy Settings

Secure Wake on LAN (WOL)

Number of auto logons

Allow local Windows logon during WOL

Start of time slot for external WOL start

End of time slot for external WOL start

Explanation

With Secure Wake on LAN (WOL) settings you can prepare endpoints for software rollouts. If the relevant Wake on LAN settings apply to endpoints, the necessary parameters (for example SafeGuard

POA deactivation and a time interval for Wake on

LAN) are transferred directly to the endpoints where parameters are analyzed.

Important: Deactivating the SafeGuard POA - even for a limited number of boot processes - reduces the security of your system!

For further information on Secure Wake on LAN, see

Secure Wake on LAN (WOL) (page 200).

Defines the number of restarts while SafeGuard

Power-on Authentication is switched off for Wake on LAN.

This setting temporarily overwrites the Enable

Power-on Authentication setting until the automatic logons reach the preset number. SafeGuard

Power-on Authentication is then reactivated.

If you set the number of automatic logons to two and

Enable Power-on Authentication is active, the endpoint starts twice without authentication through the SafeGuard POA.

For Wake on LAN, we recommend that you allow

three more restarts than necessary for your

maintenance operations to overcome any unforeseen problems.

Determines whether local Windows logons are permitted during Wake on LAN.

Date and time can be either selected or entered for the start and end of the Wake on LAN (WOL).

Date format: MM/DD/YYYY

Time format: HH:MM

The following input combinations are possible:

Defined start and end of WOL.

End of WOL is defined, start is open.

No entries: no time interval has been set.

376

administrator help

Policy Settings Explanation

For a planned software rollout, you should set the time frame for the WOL such that the scheduling script can be started early enough to allow all endpoints sufficient time for starting.

WOLstart: The starting point for the WOL in the scheduling script must be within the time interval set in the policy. If no interval is defined, WOL is not locally activated on the SafeGuard Enterprise protected endpoint. WOLstop: This command is carried out irrespective of the final point set for the

WOL.

User Machine Assignment (UMA)

Forbid SGN Guest user to logon

Allow registration of new SGN users for

Enable registration of SGN Windows Users

Note: This setting only applies to managed endpoints.

Defines whether guest users can log on to Windows on the endpoint.

Note: Microsoft accounts are always handled as

SafeGuard Enterprise guest users.

Defines who is able to import another SGN user into the SafeGuard POA and/or UMA (by disabling the pass-through to the operating system).

Note: For endpoints that do not have the Device

Encryption module installed, the Allow registration

of new SGN users for setting must be set to

Everybody if it should be possible on the endpoint to add more than one user to the UMA with access to their key ring. Otherwise users can only be added in the Management Center. This setting is only evaluated on managed endpoints. For more information, see Sophos knowledgebase article

110659 .

If the setting is set to Nobody, the POA does not become active at all. Users will need to be assigned manually in the Management Center.

Defines whether SGN Windows users can be registered on the endpoint. An SGN Windows user is not added to the SafeGuard POA, but has a key ring for accessing encrypted files, just as an SGN user. If you select this setting, all users, that would have otherwise become SGN guest users, will become SGN Windows users. The users are added

377

SafeGuard Enterprise

Policy Settings Explanation to the UMA as soon as they have logged on to

Windows.

Enable manual UMA cleanup for standalone endpoints

Note: This setting only applies to unmanaged endpoints.

Defines whether users may delete SGN users and

SGN Windows users from the User Machine

Assignment. If you select Yes, the command User

Machine Assignments is available from the system tray icon menu on the endpoint. This command shows a list of users who can log on at the

SafeGuard Power-on Authentication as SGN users and at Windows as SGN Windows users. In the dialog displayed, users can be removed from the list. After SGN users or SGN Windows users have been removed, they can no longer log on at the

SafeGuard Power-on Authentication or at Windows.

Maximum number of SGN Windows users before automatic cleanup

Note: This setting only applies to managed endpoints.

With this setting you can activate an automatic cleanup of SafeGuard Enterprise Windows users on managed endpoints. As soon as the threshold you set here is exceeded by one SafeGuard Enterprise

Windows user, all existing SafeGuard Enterprise

Windows users except the new one are removed from the User Machine Assignment. The default value is 10.

Display Options

Display machine identification

Machine identification text

Display legal notice

Displays either the computer name or a defined text in the SafeGuard POA title bar.

If the Windows network settings include the computer name, this is automatically incorporated into the basic settings.

The text to be displayed in the SafeGuard POA title bar.

If you have selected Defined name in the Display

machine identification field, you can enter the text in this input field.

Displays a text box with a configurable content which is displayed before authentication in the SafeGuard

378

Policy Settings

Legal notice text

Display additional information

Additional information text

Display additional information period

Enable and show the system tray icon

administrator help

Explanation

POA. In some countries a text box with certain content must be displayed by law.

The box needs to be confirmed by the user before the system continues.

Before you specify a text, the text has to be registered as a text item under Texts in the Policies navigation area.

The text to be displayed as a legal notice.

In this field, you can select a text item registered under Texts in the Policies navigation area.

Displays a text box with a configurable content which appears after the legal notice (if activated).

You can define whether the additional information is displayed

Never

Every system start

Every logon

Before you specify a text, the text has to be registered as a text item under Texts in the Policies navigation area.

The text to be displayed as additional information.

In this field, you can select a text item registered under Texts in the Policies navigation area.

In this field you can define how long (in seconds) additional information is to be displayed.

You can specify the number of seconds after which the text box for additional information is closed automatically. The user can close the text box at any time by clicking OK.

The SafeGuard Enterprise System Tray Icon allows the user to access all user functions quickly and easily on the endpoint. In addition, information about the endpoint status (new policies received etc.) can be displayed in balloon tool tips.

Yes:

379

SafeGuard Enterprise

Policy Settings

Show overlay icons in Explorer

Virtual Keyboard in POA

Installation Options

Uninstallation allowed

Enable Sophos tamper protection

Explanation

The system tray icon is displayed in the information area of the taskbar and the user is continually informed through balloon tool tips about the status of the SafeGuard Enterprise protected endpoint.

No:

The system tray icon is not displayed. No status information for the user by balloon tool tips.

Silent:

The system tray icon is displayed in the information area of the taskbar but there is no status information for the user through balloon tool tips.

Defines whether Windows key symbols will be shown to indicate the encryption status of volumes, devices, folders and files.

Defines whether a virtual keyboard can be shown on request in the SafeGuard POA dialog for entering the password.

Determines whether uninstallation of SafeGuard

Enterprise is allowed on the endpoints. When

Uninstallation allowed is set to No, SafeGuard

Enterprise cannot be uninstalled, even by a user with administrator rights, while this setting is active within a policy.

Activates/deactivates Sophos Tamper Protection. If you have allowed uninstallation of SafeGuard

Enterprise in the policy setting Uninstallation

allowed, you can set this policy setting to Yes, to ensure that uninstallation attempts are checked by

Sophos Tamper Protection to prevent casual removal of the software.

If Sophos Tamper Protection does not allow uninstallation, any uninstallation attempts will be canceled.

If Enable Sophos Tamper Protection is set to No, uninstallation of SafeGuard Enterprise will not be checked or prevented by Sophos Tamper Protection.

Note: This setting only applies to endpoints using

Sophos Endpoint Security and Control from version

9.5.

380

Policy Settings

Credential Provider Settings

Credential Provider wrapping

Token Support Settings

Token middleware module name

administrator help

Explanation

You can configure SafeGuard Enterprise to use a different Credential Provider than the Windows

Credential Provider. Templates for supported

Credential Providers can be downloaded from

Sophos.com. To get a list of templates for tested

Credential Providers and the location to download please contact your Sophos support.

You can import a template and deploy it to endpoints by using the Credential Provider policy setting. To do so click Import template and browse for the template file. The imported template and its content is displayed in the Credential Provider multiline field and set as policy.

To remove a template click Clear template.

Note: Do not edit the template files provided. If the

XML structure of these files is changed, the settings may not be recognized on the endpoint and the default Windows Credential Provider may be used instead.

Registers the PKCS#11 Module of a token.

The following options are available:

ActiveIdentity ActivClient

ActiveIdentity ActivClient (PIV)

AET SafeSign Identity Client

Aladdin eToken PKI Client a.sign Client

ATOS CardOS API

Charismatics Smart Security Interface

Estonian ID-Card

Gemalto Access Client

Gemalto Classic Client

Gemalto .NET Card

381

SafeGuard Enterprise

Policy Settings Explanation

IT Solution trustware CSP+

Módulo PKCS#11 TC-FNMT

Nexus Personal

RSA Authentication Client 2.x

RSA Smart Card Middleware 3.x

Siemens CardOS API

T-Systems NetKey 3.0

Unizeto proCertum

Custom PKCS#11 settings...

If you select Custom PKCS#11 settings... the

Custom PKCS#11 settings are enabled.

You can then enter the module names to be used:

PKCS#11 module for Windows

PKCS#11 module for SafeGuard Power-on

Authentication

Note: If you install Nexus Personal or Gemalto

.NET Card middleware, you also need to add their installation path to the PATH environment variable of your computer's System Properties.

Default installation path for Gemalto .NET Card:

C:\Program Files\ Gemalto\PKCS11 for

.NET V2 smart cards

Default installation path for Nexus Personal:

C:\Program Files\Personal\bin

Licenses:

Note that the use of the respective middleware for the standard operating system requires a license agreement with the relevant manufacturer. For more information, see Sophos knowledgebase article

116585 .

For Siemens licenses contact:

Atos IT Solutions and Services GmbH

Otto-Hahn-Ring 6

D-81739 Muenchen

Germany

382

administrator help

Policy Settings

Services to wait for

Explanation

This setting is used for problem solving with specific tokens. Our Support team will provide corresponding settings as required.

7.12.9 Logging for Windows endpoints

Events for SafeGuard Enterprise can be logged in the Windows Event Viewer or in the SafeGuard

Enterprise Database. To specify the events to be logged and their destination, create a policy of the type Logging and select the required events by clicking on them.

Many different events from different categories (for example Authentication, Encryption, etc.) are available for selection. We recommend that you define a strategy for logging, and determine the events necessary according to reporting and auditing requirements.

For further information, see

Reports (page 315).

7.13 Troubleshooting

7.13.1 Error codes

7.13.1.1 SGMERR codes in Windows event log

You will see the following message in the Windows event log:

"Authorization for SafeGuard Enterprise Administration failed for user... Reason:

SGMERR[536870951]"

See the table below for the definition of number "536870951". Number "536870951" means for example "Incorrect PIN entered. Unable to authenticate user".

Error ID

22

23

0

21

24

Display

OK

Internal error found

Module not initialized

File I/O Error detected

Cache cannot be assigned

383

SafeGuard Enterprise

Error ID

1206

1207

1208

1209

1210

1211

1202

1203

1204

1205

1212

1301

1302

1303

1304

1305

25

26

50

101

102

103

1201

384

Display

File I/O Read error

File I/O Write error

No operation carried out

General error

Access denied

File already exists

Registry entry could not be opened.

Registry entry could not be read.

Registry entry could not be written.

Registry entry could not be removed.

Registry entry could not be created.

Access to a system service or driver was not possible.

A system service or driver could not be added in the registry.

A system service or driver could not be removed from the registry.

An entry for a system service or driver already exists in the registry.

No access to the Service Control Manager.

An entry in the registry for a session could not be found.

A registry entry is invalid or wrong

Access to a drive has failed.

No information about a volume available.

Access to a volume failed.

Invalid option defined.

Invalid file system type.

Error ID

1317

1318

1319

1330

1351

1352

1313

1314

1315

1316

1353

1354

1355

1401

1402

1403

1306

1307

1308

1309

1310

1311

1312 administrator help

Display

Existing file system on a volume and the defined file system differ.

Existing cluster size used by a file system and the defined cluster size differ.

Invalid sector size used by a file system defined.

Invalid start sector defined.

Invalid partition type defined.

An unfragmented, unused area of required size could not be found on a volume.

File system cluster could not be marked as used.

File system cluster could not be marked as used.

File system cluster could not be marked as GOOD.

File system cluster could not be marked as BAD.

No information about clusters of a file system available.

Area marked as BAD could not be found on a volume.

Invalid size of a volume area defined.

MBR sector of a hard disk could not be replaced.

Wrong command for an allocation or deallocation defined.

Invalid algorithm defined.

Access to system kernel has failed.

No system kernel is installed.

An error occurred accessing the system kernel.

Invalid change of system settings.

Writing data to a drive has failed

Reading data from a drive has failed.

Access to a drive has failed.

385

SafeGuard Enterprise

Error ID

1458

1459

1460

1461

1462

1463

1454

1455

1456

1457

1501

1502

1503

1504

1505

1506

1404

1405

1406

1407

1451

1452

1453

386

Display

Invalid drive defined.

Changing position on a drive has failed.

Drive is not ready.

Unmount of a drive has failed.

File could not be opened.

File could not be found.

Invalid file path defined.

File could not be created.

File could not be copied.

No information about a volume available.

Position in a file could not be changed.

Reading data from a file has failed.

Writing data to a file has failed.

A file could not be removed.

Invalid file system

File could not be closed.

Access to a file is not allowed.

Not enough memory available.

Invalid or wrong parameter defined.

Data buffer size exceeded

A DLL module could not be loaded.

A function or process was aborted.

No access allowed.

Error ID

1550

2850

2851

2852

2853

2854

1517

1518

1519

1520

20001

20002

20003

20004

30050

30051

1510

1511

1512

1513

1514

1515

1516

Display

No system kernel installed.

A program could not be started.

A function, an object or data are not available.

Invalid entry detected.

An object already exists.

Invalid function call.

An internal error has occurred.

An access violation has occurred.

Function or mode is not supported.

Uninstallation has failed.

An exception error has occurred.

The MBR sector of the hard disk could not be replaced.

Scheduler service stopped due to an exception.

Scheduler task executed successfully.

Scheduler task failed.

Scheduler task created or modified.

Scheduler task deleted.

Unknown

Process terminated

File not verified

Invalid policy

Failed to open command.

Not enough memory administrator help

387

SafeGuard Enterprise

Error ID

30052

30053

30058

30059

30060

30061

30054

30055

30056

30057

30062

30063

30064

30065

30066

30067

30068

30069

30070

30071

30072

Display

General failure of process communication

A resource is temporarily unavailable. This is a temporary condition and later attempts to access it may complete normally.

General communication failure

Unexpected return value

No card reader attached

Buffer overflow

Card has no power

A timeout has occurred

Invalid card type

The requested functionality is not supported at this time / under this OS / in this situation etc

Invalid driver

This software cannot use the firmware of the connected hardware.

Failed to open file

File not found

Card not inserted

Invalid argument

The semaphore is currently in use

Semaphore is temporarily in use

General failure.

You currently do not have the rights to perform the requested action. Usually a password has to be presented in advance

The service is currently not available

388

30076

30077

30078

30079

30080

30081

30082

30083

30084

30085

30086

30087

30088

30089

30090

30091

30092

30093

Error ID

30073

30074

30075 administrator help

Display

An item (for example a key with a specific name) could not be found

The password presented is incorrect.

The password has been presented incorrectly several times, and is therefore locked.

Usually use a suitable administrator tool to unblock it.

The identity does not match a defined cross-check identity

Multiple errors have occurred. Use this error code if it is the only way of obtaining an error code when various different errors have occurred.

There are still items left, therefore for example the directory structure etc. cannot be deleted.

Error during consistency check

The ID is on a blacklist, so the requested action is not allowed.

Invalid handle

Invalid configuration file

Sector not found.

Entry not found.

No more sections

End of file reached.

The specified item already exists.

The password is too short.

The password is too long.

An item (for example a certificate) has expired.

The password is not locked.

Path not be found.

The directory is not empty.

389

SafeGuard Enterprise

Error ID

12451843

352321637

352321638

352321639

352321640

352321641

352321642

352321643

352321644

352321645

352321646

352321647

352321648

352321649

352321650

352321651

30094

30095

30096

30097

12451840

12451842

12451842

Display

No more data

The disk is full

An operation has been aborted.

Read only data; a write operation failed

The key is unavailable.

The key is not defined.

Access to unencrypted medium denied.

Access to unencrypted medium denied unless it is empty.

The file is not encrypted.

The key is unavailable.

The correct key is unavailable.

Checksum error in file header

Error in CBI function.

Invalid file name.

Error when reading/writing temporary file.

Access to unencrypted data is not allowed.

Key Storage Area (KSA) full.

The file has already been encrypted with another algorithm.

The file has been compressed with NTFS and so cannot be encrypted.

File is encrypted with EFS!

Invalid file owner!

Invalid file encryption mode!

Error in CBC operation!

390

Error ID

402653191

402653192

402653193

536870913

536870914

536870915

536870916

536870917

536870918

536870919

536870920

536870921

536870922

536870923

536870924

536870925

385875969

402653185

402653186

402653187

402653188

402653189

402653190

Display

Integrity breached.

The token contains no credentials.

Credentials cannot be written to the token.

TDF tag could not be created.

TDF tag does not contain the required data.

The object already exists on the token.

No valid slot found.

Unable to read serial number

Token encryption has failed.

Token decryption has failed.

The key file contains no valid data.

Parts of the RSA key pair are invalid.

Failed to import the key pair.

The key file format is invalid.

No data available.

Certificate import failed.

The module has already been initialized.

The module has not been initialized.

The ASN.1 encryption is corrupt.

Incorrect data length.

Incorrect signature.

Incorrect encryption mechanism applied.

This version is not supported.

administrator help

391

SafeGuard Enterprise

Error ID

536870926

536870927

536870928

536870929

536870930

536870931

536870932

536870933

536870934

536870935

536870936

536870937

536870938

536870939

536870940

536870941

536870942

536870943

536870945

536870946

536870947

Display

Padding error.

Invalid flags.

The certificate has expired and is no longer valid.

Incorrect time entered. Certificate not yet valid.

The certificate has been withdrawn.

The certificate chain is invalid.

Unable to create the certificate chain.

Unable to contact CDP.

A certificate which can be used only as the final data unit has been used as CA or vice versa.

Problems with validity of certificate length in the chain.

Error opening file.

Error reading a file.

Error or several parameters which have been assigned to the function are incorrect.

Function output exceeds cache.

Token problem and/or slot breached.

Token has insufficient memory to perform the required function.

Token was removed from slot while function being performed.

The required function could be performed but information on the cause of this error is not available.

The computer on which the CBI compilation is taking place has insufficient memory to perform the required function. This function may be only partly completed.

A required function is not supported by the CBI compilation.

An attempt has been made to set a value for an object which cannot be set or altered.

392

administrator help

536870955

536870956

536870957

536870958

536870959

536870960

536870961

536870962

536870963

536870964

536870965

Error ID

536870948

536870949

536870950

536870951

536870952

536870953

536870954

Display

Invalid value for object.

An attempt to obtain the value of an object has failed because the object is either sensitive or inaccessible.

The PIN entered has expired. (Whether a normal user's PIN runs on an issued token varies from one to another).

The PIN entered is incorrect. Unable to authenticate user.

The PIN entered contains invalid characters. This response code is applied only for those attempting to set up a PIN.

The PIN entered is too long/short. This response code is applied only for those attempting to set up a PIN.

The selected PIN is blocked and cannot be used. This happens when a certain number of attempts are made to authenticate a user and the token refuses any further attempts.

Invalid Slot ID.

The token was not in the slot at the time of the request.

The CBI archive/slot failed to recognize the token in the slot.

The requested action cannot be carried out because the token is write-protected.

The entered user cannot be logged on because this user is already logged onto a session.

The entered user cannot be logged on because another user is already logged onto the session.

The required action cannot be performed because there is no matching user logged on. One example is that a session cannot be logged off while one is still logged on.

The normal user PIN has not been initialized with CBIInitPin.

An attempt made by several different users to log on to the same token simultaneously has been allowed.

Invalid value entered as CBIUser. Valid types are defined in user types.

An object with the designated ID could not be found on the token.

393

SafeGuard Enterprise

Error ID

536870973

536870974

536870975

536870976

536870977

536870978

536870979

536870980

536870981

536870982

536870966

536870967

536870968

536870969

536870970

536870971

536870972

536870983

536870984

536870985

536870986

536870987

Display

Operation has timed out.

This version of IE is not supported.

Authentication failed.

The basic certificate is secured.

No CRL found.

No active internet connection.

Certificate time-value error.

Unable to verify the selected certificate.

Certificate expiry status unknown.

The module has exited. No further requests.

An error has occurred during request for network function.

An invalid request for a function has been received.

Unable to find an object.

A terminal server session has been interrupted.

Invalid operation.

The object is in use.

The random number generator has not been initialized. (CBIRNDInit ( ) not requested.)

Unknown command (see CBIControl ( ) ).

UNICODE is not supported.

More seed needed for random number generator.

Object already exists

Incorrect algorithm combination. (See CBIRecrypt ( ) ).

394

administrator help

Error ID

536870995

536870996

536870997

536870998

536870999

536871000

536871001

536871002

536871003

536871004

805306369

805306370

805306371

805306372

805306373

805306374

536870988

536870989

536870990

536870991

536870992

536870993

536870994

Display

The Cryptoki module (PKCS#11) has not been initialized.

The Cryptoki module (PKCS#11) has been initialized.

Unable to load Cryptoki module (PKCS#11).

Certificate not found.

Not trusted.

Invalid key.

The key cannot be exported.

The algorithm entered is temporarily not supported.

The decryption mode entered is not supported.

GSENC compilation error.

Data request format not recognized.

The certificate has no private key.

Bad system setting.

There's an operation active

A certificate in the chain is not properly time nested.

The CRL could not be replaced

The USER pin has already been initialized

You do not have sufficient rights to perform this action. Access denied!

Invalid operation

Invalid parameter in use

Object already exists

The object could not be found.

Database Exception

395

SafeGuard Enterprise

Error ID

805306382

805306383

805306384

805306385

805306386

805306387

805306388

805306389

805306390

805306391

805306375

805306376

805306377

805306378

805306379

805306380

805306381

805306392

805306393

805306394

805306395

Display

The action has been cancelled by the user.

The token is not assigned to a specific user.

The token is assigned to more than one user.

The token could not be found in the database.

The token has been successfully deleted and removed from the database.

Unable to identify the token in the database.

The policy is assigned to a policy group. Remove assignment before deleting policy.

The policy is assigned to an OU. Please remove assignment first.

The certificate is invalid for this Officer.

The certificate has expired for this Officer.

The Officer could not be found in the database.

The selected Officer is not unique.

The Officer is blocked and cannot be authenticated.

The Officer is no longer or not yet valid.

Unable to authorize Officer - request outside office hours.

Responsible party cannot delete self.

The Master Security Officer cannot be deleted because a second Master Security

Officer is needed for additional authentication.

The Security Officer cannot be deleted because a second Security Officer is required for additional authentication.

The checking Officer cannot be deleted because a second checking Officer is required for additional authentication.

The recovery Officer cannot be deleted because a second recovery Officer is required for additional authentication.

The advisory Officer cannot be deleted because a second advisory Officer is required for additional authentication.

396

administrator help

Error ID

805306396

805306397

805306398

805306399

805306400

805306401

805306402

805306403

805306404

805306405

805306406

805306407

805306408

805306409

805306410

805306411

805306412

805306413

Display

The Master Security Officer function cannot be deleted because a second Master

Security Officer is needed for additional authentication.

The Security Officer function cannot be deleted because a second Security Officer is needed for additional authentication.

The checking Officer function cannot be deleted because a second checking Officer is needed for additional authentication.

The recovery Officer function cannot be deleted because a second recovery Officer is needed for additional authentication.

The advisory Officer function cannot be deleted because a second advisory Officer is needed for additional authentication.

There is no additional Officer with the required function available for additional authentication.

Event log

Integrity of central event log successfully verified.

Integrity breached! One or more events have been removed from the start of the chain.

Integrity breached! One or more events have been removed from the chain. The message at which point the break in the chain was discovered has been highlighted.

Integrity breached! One or more events have been removed from the end of the chain.

Failed to export events to file. Reason:

The current view contains unsaved data. Do you want to save changes before exiting this view?

The file could not be loaded or the file is damaged. Reason:

The integrity of the log has been breached! One or more events have been removed.

Save events to a file before deleting?

Job display

Several CRL found in database: Unable to delete CRL.

397

SafeGuard Enterprise

Error ID

805306414

805306415

805306416

805306417

805306418

805306419

805306420

805306421

805306422

805306423

805306424

805306425

805306426

805306427

805306428

805306429

805306430

805306431

805306432

805306433

805306435

Display

CRL not found in database:

Unable to find the user to whom the certificate should have been assigned to in the database.

A P7 Blob is urgently required for a certificate assignment.

The user to whom the certificate should have been assigned is not uniquely named.

Unfortunately unable to find certificate assignment.

Certificate assignment not unique. Unclear which certificate to remove.

Unable to find the user for whom the certificate is to be produced in the database.

The user to whom the certificate is to be assigned cannot be uniquely named.

The certificate has already been assigned to another user. A certificate can only be assigned to one user.

Unable to find the machine to which the certificate is to be assigned in the database.

The machine to assign the certificate could not be uniquely identified.

Imported certificates cannot be extended by SGN.

Inconsistent certificate data

The extension of the certificate has not been approved by a Security Officer.

Error deleting token

Certificate cannot be deleted by the token because it has been used to authorize the present user.

System access already exists with this name. Please select another name.

The Security Officer does not have any roles assigned. Logon not possible.

The license is violated.

No license was found.

Missing or invalid log file path.

398

administrator help

Error ID

2415919104

2415919105

2415919106

2415919107

2415919108

2415919109

2415919110

2415919111

2415919112

2415919113

3674210305

3674210306

3674210307

3758096385

3758096386

3758096387

3758096388

3758096389

3758096390

3758096391

3758096392

3758096393

3758096394

Display

No policy found.

No configuration file available!

No connection to server.

No more data.

Invalid priority used for sending to server!

More data pending.

Auto registration pending.

Database authentication failed!

Wrong session ID!

Data packet dropped!

Domain not found.

Machine not found.

User not found.

The password does not contain enough letters

The password does not contain enough numbers

The password does not contain enough special characters

The password is the same as the user name

The password contains consecutive characters

The password is too similar to the user name

The password has been found in a list of prohibited passwords

The password is too similar to the old password

The password includes a keyboard sequence with more than two characters

The password includes a keyboard column with more than two characters

399

SafeGuard Enterprise

Error ID

3758096395

3758096396

3758096397

3758096398

3758096399

3758096400

3758096401

3758096402

4026531840

4026531841

4026531842

4026531843

4026531844

4026531845

4026531846

4026531847

Display

The password is not yet valid

A password has expired

The password has not yet reached its minimum validity period

The password has exceeded its maximum validity period

Information must be displayed about an impending change to the password

Must be changed at first log on

The password has been found in the history

Error when verifying against specified blacklist.

No "platform" found.

No document.

XML Parse Error.

Document Object Model (XML) Error

No <DATAROOT> tag found.

XML tag not found.

"nostream" error.

"printtree" error.

7.13.1.2 BitLocker error codes

BitLocker errors are reported using the following SafeGuard events:

■

Kernel initialization has failed. Internal code: <Error code>.

■

Sector-based initial encryption of drive <drive letter> failed and closed. Reason: <Error code>

The following table provides a list of error codes for BitLocker:

Error code (Hex) Error code (Dec) Description

400

administrator help

0x00000000 –

0x000032C8

0x00BEB001

0x00BEB002

0x00BEB003

0 – 15999

12496897

12496898

12496899

0x00BEB004

0x00BEB005

0x00BEB006

0x00BEB007

0x00BEB008

12496900

12496901

12496902

12496903

12496904

0x00BEB009 12496905

0x00BEB00A

0x00BEB00B

0x00BEB00C

0x00BEB00D

0x00BEB00E

0x00BEB00F

0x00BEB010

0x00BEB102

0x00BEB202

12496906

12496907

12496908

12496909

12496910

12496911

12496912

12497154

12497410

See Microsoft System Error Codes

Encryption not possible due to error during kernel initialization.

Boot manager must not be on the system volume to be encrypted.

Found an unsupported Windows version on the HDD. Minimum is

Windows Vista.

The configured authentication method is not supported.

The PIN dialog has not been completed successfully.

The path dialog has not been completed successfully.

Error in inter-process communication in PIN or path dialog.

Unhandled exception in PIN or path dialog. The dialog was displayed, but the user logged off or stopped it with the Task Manager.

The encryption algorithm defined in the policy does not match the one of the encrypted drive. By default (if not modified) native

BitLocker uses AES-128 whereas the SGN policies define AES-256.

The volume is a dynamic volume. Dynamic volumes are not supported.

The hardware test failed because of a hardware problem.

An error occurred during TPM initialization and activation.

The Encryption-Algorithm in the SGN-Policy conflicts with the

Encryption-Algorithm settings in the GPO.

Sector-based initial encryption of drive <drive letter> failed.

Active Directory backup of recovery keys is required but no domain controller is available.

Active Directory backup of recovery keys is not compatible with

BitLocker Challenge/Response.

UEFI version could not be validated and therefore BitLocker will be executed in legacy mode.

Client configuration package has not yet been installed.

401

SafeGuard Enterprise

0x00BEB203

0x80280006

0x80280007

0x80280014

0x80310037

0x8031005B

0x8031005E

0x80280000 –

0x803100CF

12497411

-2144862202

-2144862201

-2144862188

-2144272329

UEFI version not supported and therefore BitLocker will be executed in legacy mode. Minimum requirement is 2.3.1.

The TPM is inactive.

The TPM is disabled.

The TPM already has an owner.

-2144272293

The Group Policy setting requiring FIPS compliance prevents a local recovery password from being generated and written to the key backup file. Encryption will nevertheless continue.

The Group Policy for the specified authentication method is not set.

Please enable the Group Policy "Require additional authentication at startup".

-2144272290 The Group Policy for encryption without TPM is not set. Please enable the Group Policy "Require additional authentication at startup" and set the checkbox "Allow BitLocker without a compatible TPM" within it.

-2144862208 –

-2144272177

See Microsoft COM Error Codes (TPM, PLA, FVE) .

7.14 SafeGuard Enterprise and self-encrypting,

Opal-compliant hard drives

Self-encrypting hard drives offer hardware-based encryption of data when they are written to the hard disk. The Trusted Computing Group (TCG) has published the vendor-independent Opal standard for self-encrypting hard drives. Different hardware vendors offer Opal-compliant hard drives. SafeGuard Enterprise supports the Opal standard and offers management of endpoints with self-encrypting Opal-compliant hard drives. For more information, see Sophos knowledgebase article 113366 .

7.14.1 How does SafeGuard Enterprise integrate Opal-compliant hard drives?

With SafeGuard Enterprise, endpoints with self-encrypting, Opal-compliant hard drives can be managed from the SafeGuard Management Center, like any other endpoint protected by SafeGuard

Enterprise.

Central and fully transparent management of Opal-compliant hard drives by SafeGuard Enterprise allows for the use in heterogeneous IT environments. By supporting the Opal standard, we offer the full set of SafeGuard Enterprise features to corporate users of self-encrypting, Opal-compliant hard drives. In combination with SafeGuard Enterprise, Opal-compliant hard drives offer enhanced security features.

402

administrator help

7.14.2 Enhancement of Opal-compliant hard drives with SafeGuard Enterprise

SafeGuard Enterprise offers the following benefits in combination with self-encrypting,

Opal-compliant hard drives:

■

Central management of endpoints

■

SafeGuard Power-on Authentication with graphical user interface

■

Multi-user support

■

Token/smartcard logon support

■

Fingerprint logon support

■

Recovery (Local Self Help, Challenge/Response)

■

Central auditing

■

Encryption of removable media (for example USB memory sticks) with SafeGuard Data

Exchange

7.14.3 Manage endpoints with Opal-compliant hard drives with SafeGuard

Enterprise

In the SafeGuard Management Center, you can manage endpoints with self-encrypting,

Opal-compliant hard drives just like any other endpoint protected by SafeGuard Enterprise. As a security officer, you can define security policies, for example authentication policies, and deploy them to endpoints.

Once an endpoint with an Opal-compliant hard drive is registered at SafeGuard Enterprise, information on user, computer, logon mode and encryption status is displayed. In addition, events are logged.

Management of endpoints with Opal-compliant hard drives in SafeGuard Enterprise is transparent, which means that management functions in general work the same as for other endpoints protected by SafeGuard Enterprise. The type of a computer is shown in Inventory of a container in Users

and Computers. The column POA Type tells you if the respective computer is encrypted by

SafeGuard Enterprise or uses a self-encrypting, Opal-compliant hard drive.

7.14.4 Encryption of Opal-compliant hard drives

Opal-compliant hard drives are self-encrypting. Data are encrypted automatically when they are written to the hard disk.

The hard drives are locked by an AES 128/256 key used as an Opal password. This password

is managed by SafeGuard Enterprise through an encryption policy, see Lock Opal-compliant hard drives

(page 404).

403

SafeGuard Enterprise

7.14.5 Lock Opal-compliant hard drives

To lock Opal-compliant hard drives, the machine key has to be defined for at least one volume on the hard drive in an encryption policy. In case the encryption policy includes a boot volume, the machine key is defined automatically.

1. In the SafeGuard Management Center, create a policy of the type Device Protection.

2. In the field Media encryption mode, select Volume-based.

3. In the field Key to be used for encryption, select Defined machine key.

4. Save your changes in the database.

5. Deploy the policy to the relevant endpoint.

The Opal-compliant hard drive is locked and can only be accessed by logging on to the computer at the SafeGuard Power-on Authentication.

7.14.6 Enable users to unlock Opal-compliant hard drives

As a security officer, you can enable users to unlock Opal-compliant hard drives on their endpoints by using the Decrypt command from the Windows Explorer context menu.

Prerequisite: In the Device Protection policy that applies to the Opal-compliant hard drive, the option User may decrypt volume must be set to Yes.

1. In the SafeGuard Management Center, create a policy of the type Device Protection and include all volumes on the Opal-compliant hard drive.

2. In the field Media encryption mode, select No encryption.

3. Save your changes in the database.

4. Deploy the policy to the relevant endpoint.

The user can unlock the Opal-compliant hard drive on the endpoint. In the meantime, the hard drive remains locked.

7.14.7 Logging of events for endpoints with Opal-compliant hard drives

Events reported by endpoints with self-encrypting, Opal-compliant hard drives are logged, just as for any other endpoint protected by SafeGuard Enterprise. The events do not especially mention the computer type. Events reported are the same as for any other endpoint protected by SafeGuard

Enterprise.

For further information, see

Reports (page 315).

404

administrator help

8 Technical support

You can find technical support for Sophos products in any of these ways:

■

Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.

■

■

■

Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx

.

Download the product documentation at www.sophos.com/en-us/support/documentation.aspx

.

Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx

.

405

SafeGuard Enterprise

9 Legal notices

Copyright

©

1996 - 2017 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos

Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.

You find copyright information on third party suppliers in the Disclaimer and Copyright for 3rd

Party Software document in your product directory.

406