Sophos SafeGuard Disk Encryption, Sophos SafeGuard Easy
2 About Sophos SafeGuard
Sophos SafeGuard encrypts data transparently: users do not need to decide which data is to be encrypted. Encryption and decryption is performed in the background. Encryption effectively prevents data from being read or changed by unauthorized persons. Sophos SafeGuard encryption cannot be bypassed by connecting storage media to another system.
Sophos SafeGuard lets you:
■
Implement quickly.
■ Protect the confidentiality of data.
■
Encrypts data using technology that is FIPS 140 compliant.
Computers protected by Sophos SafeGuard run the SafeGuard Power-on Authentication (POA) in the pre-boot phase of the computer, before the operating system starts. After the user has been properly authenticated at the POA, the operating system starts and the user is logged on to
Windows.
4
The POA provides highly secure and user friendly features such as:
■
Tamper protection for Sophos SafeGuard Disk Encryption.
■ Logon delays on false entries.
■ Customizable Windows-like graphical user interface.
■
Passthrough to Windows.
■
Multiple language and unicode support.
Convenient access for IT operations
Sophos SafeGuard offers several features that aid IT operations on endpoint computers:
■
The Power-on Authentication can be configured for use with Wake on LAN, for example to facilitate patch management.
■
Service accounts enable members of the IT team to log on to endpoint computers for post-installation tasks without activating the Power-on Authentication.
startup guide
■
POA access accounts enable members of the IT team to log on to encrypted endpoint computers for administrative tasks after the Power-on Authentication has been activated.
Recovery scenarios in Sophos SafeGuard
For recovery, Sophos SafeGuard offers different options that are tailored to different recovery scenarios:
■
Logon recovery using Local Self Help
Local Self Help enables users who have forgotten their password to log on to their computers without the assistance of a help desk. Even in situations where neither telephone nor network connections are available (for example aboard an aircraft), users can regain access to their computers. To log on, they answer a predefined number of questions in the Power-on
Authentication.
Local Self Help reduces the number of calls concerning logon recovery, thus freeing the help desk staff from routine tasks and allowing them to concentrate on more complex support requests.
■
Recovery using Challenge/Response
The Challenge/Response recovery mechanism involves the assistance of the help desk. It helps users who cannot log on to their computers or access encrypted data. During the
Challenge/Response procedure, the user provides a challenge code generated on the endpoint computer to the help desk officer who in turn generates a response code that authorizes the user to perform a specific action on the computer. With recovery through Challenge/Response,
Sophos SafeGuard offers different workflows for typical recovery scenarios requiring help desk assistance.
■
System recovery
Sophos SafeGuard offers different methods and tools for system recovery, such as a Sophos
SafeGuard customized Windows PE and Lenovo Rescue and Recovery. Problems with Windows system and Sophos SafeGuard components can be addressed using these tools.
Recovery is based on a key recovery file created for each Sophos SafeGuard encrypted computer and typically stored on a network share. This recovery key ensures that the recovery process is not exploited to bypass data protection and is encrypted for additional security. The network share for storing these files well as the required access rights to this share are automatically created during first-time configuration.
5
