The Pointsec Protector Administration Console allows system administrators to centrally manage Pointsec Protector Client software. The Pointsec Protector

Administration Console is a Microsoft Management Console (MMC) snapin.

Using this management console it is possible to perform the following tasks:

•

Create and manage user/group-based policy profiles for the control of Removable

Media Manager, Program Security Guard (PSG), Device Manager, and Encryption

Policy Manager.

•

Perform dynamic management of Pointsec Protector Client workstations.

Getting Started

•

View and process audit events

•

Management of automated alerts

•

Management of Pointsec Protector Security infrastructure

•

Management of removable media encryption settings (EPM)

Getting Started

This section presents the stages that should be followed when installing

Pointsec Protector for the first time (for detailed installation instructions, see the Pointsec Protector Installation Guide). It is advisable to complete the following steps in the order they are presented here to complete a successful deployment:

1. Edit the default profile. This profile is used as the default global profile and contains the default organizational policies. For example, if a global messaging standard is required across the organization it should be configured within the default profile.

The default profile is also used if the client user is unknown or if the server connection fails and should be used as a failsafe mechanism.

2. Create new profile templates from within the Profile Templates node.

These profiles should include a standard user profile and an administrator profile plus any other special profiles required.

3. Create new groups using the Create New Group Wizard and assign the required profile templates. It is often advisable to create new

Windows/Novell domain groups for use with the Pointsec Protector

Enterprise Server.

4. Specify the required e-mail alerts from the Alerts node.

5. Configure the Pointsec Protector security settings as required. If using the Encryption Policy Manager, please pay careful attention when specifying the EPM Key Recovery option.

6. Back up the media ID using the Export Media ID wizard. A prompt to back up the media ID would also be received the first time the administration console is opened.

7. Export the default profile to Pointsec Protector Client installation folder.

8. Manually install at least two Pointsec Protector Client workstations for testing.

9. Set up and configure a silent Pointsec Protector Client installation.

Administrator Utilities

A number of administrator utilities are provided for managing the Pointsec

Protector Enterprise. This section details the following features:

•

Managing Pointsec Protector Enterprise Server/Client security

•

Performing a local/remote server connection using Microsoft

Management Console (MMC)

•

Generating a Pointsec Protector Emergency Access disk

•

Managing Removable Media signature IDs

•

Configuring device types covered under the management of Device

Manager

•

Managing Removable Media Encryption (EPM)

Connect to Remote or Local Server

The Pointsec Protector Administration Console uses the industry standard

Microsoft Management Console (MMC) to manage the Pointsec Protector

Server. MMC provides a great deal of flexibility and allows for remote server connections. It is possible to install multiple administration consoles across an organization to manage a Pointsec Protector Server (see

“Installing a Remote Pointsec Protector Administrator Console” on page 133

To connect to a remote or local server machine that is within the same LAN:

1. Select Connect to from the Check Point Protector Server node as displayed below:

Figure 2-1

The following window opens:

Chapter 2 Using the Administration Console 15

Connect to Remote or Local Server

Figure 2-2

2. Select one of the following connections as applicable:

•

the local machine, if the Pointsec Protector Server is running locally or

•

a remote machine, by entering the server machine name or IP address in the host field. The TCP/IP port number of the server machine should be entered (default 9738).

3. Click Finish to complete the connection.

The following connection process is displayed:

Figure 2-3

The current connection status is displayed. Note that security access must be granted within the Security Permissions tab before a remote server connection can be performed.

Figure 2-4

System Utilities

Removable Media Manager

During installation the Pointsec Protector Enterprise Server generates a unique signature media ID. This unique ID is used during media authorization and ensures that media authorized within other Pointsec

Protector protected environments are not valid within this protected zone and vice versa.

On occasions it can be desirable to use the same media signature ID on multiple sites/servers. This means that devices authorized within one protected environment can also be recognized as authorized in other environments. This can be achieved using the Import/Export Media ID feature.

Enhanced Mode

The Removable Media Manager operates in Enhanced Mode by default as determined by the EM field in the

config.ini

file when deploying the

Pointsec Protector Client software.

This Enhanced Mode of operation will detect every single change made to the removable media on a non-Pointsec Protector machine. However, this system would be slow for all media directory levels and is therefore only applied to seven directory levels (that is, including the root level). Doing the check any deeper could result in a noticeable system slow down and we cannot compromise this trade-off, having to maintain system security and speed. Therefore, files/folders beyond this scope are treated as read-only with no access to the binary files therein. Files cannot be executed or copied to the Pointsec Protector client machine's hard drive.

If the Enhanced Mode flag is manually changed in the

config.ini

pre-rollout by a System Administrator and is not operational on their

Pointsec Protector client-base, only significant media changes will be detected when reintroduced media has been amended on these client machines.

Import/Export Media ID

To launch the Import/Export Media ID wizard:

1. Right-click on the Pointsec Protector Server node and select Removable

Media Manager > Import/Export Media ID as shown below:

Chapter 2 Using the Administration Console 17

Removable Media Manager

Figure 2-5

2. Click Next past the welcome screen:

Figure 2-6

3. Select Import media ID if you wish to set up this server with a previously generated media ID, and select Export media ID to back up your media

ID and also if you wish to set up another server using the same media

ID. Click Next to continue:

Removable Media Manager

Figure 2-7

4. Select the location where you wish to import/export the media ID from/to. Click Next to continue:

Figure 2-8

5. Click Finish to complete the process:

Chapter 2 Using the Administration Console 19

Remote Help

Figure 2-9

Remote Help

Both the full Pointsec Protector client and the EPM Explorer support challenge/response password recovery either using the Pointsec Protector

Management console or using the SmartCenter for Pointsec - webRH system.

More information on how to install, configure and use SmartCenter for

Pointsec - webRH is found in these documents:

•

SmartCenter for Pointsec - webRH Framework Administrator’s

Guide

•

SmartCenter for Pointsec - webRH Framework Installation Guide

•

SmartCenter for Pointsec - webRH Pointsec Protector Module

Administrator’s Guide

•

SmartCenter for Pointsec - webRH Pointsec Protector Module

Installation Guide

EPM Key Recovery

On sites where the Encryption Policy Manager (EPM) has been enabled it is possible to perform remote password recovery in the event that a user forgets his/her offline password on encrypted devices. The challenge response system settings can be configured within the EPM tab.

Figure 2-10

To perform remote password recovery:

1. Select EPM Key Recovery. The following dialog is displayed:

Figure 2-11

Remote Help

2. Click Next to continue. The following dialog is displayed:

Figure 2-12

Chapter 2 Using the Administration Console 21

Pointsec Protector Server Properties

3. Enter the challenge code generated by the locked out user. Click Next to continue.

The Pointsec Protector Enterprise Server will securely authenticate the challenge code and verify its authenticity. Once verified, a response code is generated and must be relayed to the user:

Figure 2-13

4. On completion, click Finish.

Pointsec Protector Server Properties

Right-click on the Pointsec Protector Server node and choose Properties, the following tabs are displayed; General, Applications, Security, E-mail

configuration, and Console settings.

General Tab

The General tab displays Pointsec Protector server information, media revocation, and license information as described below.

Version Information

The version of Pointsec Protector Server that is currently running is displayed in the General tab, this information is very useful for support purposes and should be relayed back to the Check Point Technical support department during any correspondence.

Figure 2-14

Pointsec Protector Server Properties

Media Revocation

The media revocation feature allows the revocation all previously authorized media, thus enforcing re-authorization. This is achieved by changing the media ID on all machines within the protected environment.

To revoke all previously authorized media, select Revoke All on the General tab.

Note - This process can be reversed by re-importing the media ID providing a backup was taken during installation.

Chapter 2 Using the Administration Console 23

Pointsec Protector Server Properties

Figure 2-15

Licensing Information

Pointsec Protector Enterprise Server requires a license number to be entered during installation both for evaluation and licensed use. The license information can be viewed under License information on the General tab.

Figure 2-16

Further information can be obtained by clicking the License Manager... button. The following dialog will be displayed:

Figure 2-17

Pointsec Protector Server Properties

This dialog details the type of license (full or evaluation), the number of clients permitted, and the expiration date of the license(s).

Add New Registration Codes/License Numbers

It is possible add new registration codes/license numbers in the Pointsec

Protector License Manager.

To add a new license number:

1. Open the Pointsec Protector License Manager window by clicking the

License Manager... button on the General tab.

2. Click on the Add License button and enter a new license issued from

Check Point, or click on the Add from license file button to import a license from a license file (.lic).

3. Click OK to complete the activation.

Figure 2-18

A message is displayed to show a valid license number has been entered.

Chapter 2 Using the Administration Console 25

Pointsec Protector Server Properties

Figure 2-19

Applications Tab

The Applications tab displays settings for the

expreset.ini

, the Device

Manager Configuration Editor, and the EPM site identification as described below.

Figure 2-20

Expreset.ini

Pointsec Protector is shipped with a database of recommended file types that should be protected by Program Security Guard (PSG). This database is regularly updated and distributed in a file called

expreset.ini

. In addition to recommended file types, this file contains a list of recommended exempt applications. During installation the contents of the

expreset.ini

is automatically imported into all new profiles.

Backing Up expreset.ini

It is often desirable to take a snapshot of the current PSG settings either for backup purposes or use within another Pointsec Protector Enterprise

Server. The current settings can be exported to an

expreset.ini

file by clicking the Backup button and selecting a suitable location.

Pointsec Protector Server Properties

Restoring/Importing New expreset.ini

Check Point frequently update the current list of PSG recommended file types and exemptions. A new

expreset.ini

can be imported by selecting the Restore button and selecting the updated file.

Device Manager Configuration Editor

The Pointsec Protector Device Manager provides unrivalled management of all removable media/IO devices. Pointsec Protector is shipped with a default list of device types but it is often desirable to add/remove new devices as required. This feature allows greater granularity and supports both black list and white list protection.

Using the Device Manager Configuration Editor it is possible to add specific brands and models of devices for more granular device management. Specific security rights can then be assigned on a device by device basis.

Figure 2-21

By clicking Edit the Device Manager Configuration Editor is invoked:

Chapter 2 Using the Administration Console 27

Pointsec Protector Server Properties

Figure 2-22

Adding a New Device Class

In the unlikely event that a new device class is introduced that is not part of the core operating system default list, it is possible to specify and add new types of device (device class).

To add a new device class:

1. Click Add device class. The following dialog is invoked:

Note - A device class is a new type of device rather than a specific model or brand of existing device class.

Figure 2-23

Pointsec Protector Server Properties

2. Supply the following credentials:

Device information

•

Display Name

The name of the device as displayed within the Device Manager configuration tab. The name should be a useful description of the device type.

•

Device GUID

This is the unique system information about the new device class.

This information can be retrieved from the log field after the device has been inserted into the system. Each type/brand of device will have its own unique ID. To be less specific the device GUID string can be reduced. For further information please contact the

Pointsec support department.

•

Device Connection

It is possible to stipulate the device connection type. It is possible to control either just internal, just external or both types of connection for the new device class. For example, it maybe desirable to block the use of external modems but permit the use of built-in modems on a laptop computer.

•

Extra Information

For removable media storage devices it is desirable to stipulate whether the device appears to MS Windows as a fixed disk device

(Hard disk with master boot record) or as removable media (Media without master boot record).

Chapter 2 Using the Administration Console 29

Pointsec Protector Server Properties

•

Icon

A custom icon can be used for graphical representation in the

Device Manager configuration tab. Select the required icon from the drop-down menu or alternatively new icons can be added using the Load Images button on the parent dialog.

Device capabilities

•

Can be read only

For storage devices it is possible to provide read-only management.

By selecting this checkbox the read-only functionality will be available during device configuration.

•

Can be used for reading and writing

If the new device class provides removable media storage that can be read from and written to, this option should be selected.

•

Can encrypt data with EPM

For digital storage devices, the Encryption Policy Manager (EPM) can be enabled to provide transparent removable media encryption.

•

Can generate audit event on arrival

The arrival of new devices can be audited under the Audit tab.

This event records the type of device with full details of the device usage. This checkbox determines if the device is able to generate audit events or not; for the actual sending of events, the Generate

device arrival audit event checkbox must be selected.

Default device access rights

•

Default access

This setting configures the default device access for new profiles.

Select the required configuration, No access or Full access, from the drop-down menu.

•

Generate device arrival audit event

This checkbox enables, if selected, the sending of audit events from the device.

Adding a New Device ID

It is often desirable to provide greater granularity over the types/brands/model of device that can be can be managed within the

Pointsec Protector Device Manager. For example, the system administrator may wish to specify additional security rights on defined corporate brands and models of device. This component offers both white list and black list protection across all device types. For example, the system administrator can specify that 'any device except for the XXXX Brand(s)/Model(s)' can be used or alternatively that 'only the XXXXX Brand(s)/Model(s)' of device can be used. Under each specific device it is possible to assign individual security rights.

Pointsec Protector Server Properties

To add a new device ID:

1. Click on the device class under which the new device is to be added

(i.e., removable media in the Device Manager configuration editor) and click Add device ID. The following dialog opens:

Figure 2-24

2. Supply the following credentials:

Device information

•

Display Name

The name of the device as displayed within the Device Manager configuration tab. The name should be a useful description of the device type.

•

Device GUID

This is the unique system information about the device class.

When adding a new device ID, this will be grayed out as device IDs fall under existing device classes.

•

Device Connection

•

Extra Information

For removable media storage devices it is desirable to stipulate whether the device appears to MS Windows as a fixed disk device

(Hard Disk with master boot record) or as removable media (Media without master boot record).

Chapter 2 Using the Administration Console 31

Pointsec Protector Server Properties

•

Icon

A custom icon can be used for graphical representation in the

Device Manager configuration tab. Select the required icon from the drop-down menu or alternatively new icons can be added using the Load Images button on the parent dialog.

Device ID filter

•

Device ID String begins with

Each specific model of device has a device specific ID. This information can be automatically imported from the unauthorized device manager alert within the logs node. The Device Manager can be configured to be very specific by including the entire device ID string or less specific by including just the start of the ID string.

Please see the

“Frequently Asked Questions” on page 197

for examples.

Device cababilities

•

Can be read only

For storage devices it is possible to provide read-only management.

By selecting this checkbox the read-only functionality will be available during device configuration. Read-only will prevent users copying data from the local drive/network to the removable storage device.

•

Can be used for reading and writing

If the new device class provides removable media storage that can be read from and written to, this option should be selected.

•

Can generate audit event on arrival

The arrival of new devices can be audited under the Event tab.

device arrival audit event checkbox must be selected.

•

Can encrypt data with EPM

For digital storage devices the Encryption Policy Manager (EPM) can be enabled to provide transparent removable media encryption.

•

Can execute files directly on the device

This option determines whether or not executable files are allowed to run from the device.

Default device access rights

•

Device access

This setting configures the default device access for new profiles.

Select the required configuration from the drop-down menu.

•

Generate device arrival audit event

This checkbox turns on, if selected, the sending of audit events from the device.

Pointsec Protector Server Properties

EPM Site Identification

The Encryption Policy Manager enables transparent encryption of removable media. Within large organizations it is often desirable to enable the transfer of data between trusted organizations via removable media devices such as USB flash media. With EPM it is possible to set up trust relationships between different Pointsec Protector sites that are not physically linked. This trust relationship enables controls over which third party encrypted devices can be accessed. This section provides the ability to add trusted sites, the access control rights are however configured within the individual profiles.

Figure 2-25

Export this site ID

The site ID can be exported for import within other sites. Click the Export

this site ID.. button. Select a location to export the file to (default filename will be the servername):

Figure 2-26

Chapter 2 Using the Administration Console 33

Pointsec Protector Server Properties

Import ID of another site

1. Click the Import ID of another site... button. The import wizard is initialized.

Figure 2-27

Click Next to continue:

2. Select the required EPM Site ID and click Next to continue:

Figure 2-28

3. Enter a relevant site ID name and click Next to continue:

Figure 2-29

4. Click Finish to complete the import process:

Figure 2-30

Pointsec Protector Server Properties

Advanced

The Advanced... button opens additional configuration options. From within this dialog the administrator can view the current list of trusted sites and amend as required. Click Advanced...:

Chapter 2 Using the Administration Console 35

Pointsec Protector Server Properties

Figure 2-31

From within the Advanced tab it is possible to add/remove and edit existing trusted site IDs.

Security Tab

The Pointsec Protector Enterprise Server has been developed using secure client/server authentication. The system administrator can configure the level of security applied to the underlying architecture.

To access the Pointsec Protector Server security console, right-click on the

Pointsec Protector Server node and select properties. Navigate to the

Security tab as shown below:

Figure 2-32

Pointsec Protector Server Properties

During installation, Pointsec Protector Enterprise Server sets up default security permissions. Anyone within the Windows Administrator group will have full rights to the Pointsec Protector Server. Authenticated users will be granted client access only by default. You can add and remove users/groups using the Add and Remove buttons and select the desired security permissions by choosing to allow or deny each feature.

At the bottom of the Security tab, two sub-tabs are displayed; Basic

permissions and Advanced permissions.

Basic Permissions Tab

Figure 2-33

The following options can be configured with the Basic permissions security tab:

•

Administrate

This option grants access to administer the Pointsec Protector

Enterprise server. The ability to change the media ID and delete log files is unavailable.

•

Manage Reports

This option grants access to manage and generate reports within the Pointsec Protector Administration Console.

•

Special Permissions

Special permissions will grant access to recover encryption keys and change the media ID. This option should only be selected for security administrators.

Chapter 2 Using the Administration Console 37

Pointsec Protector Server Properties

Advanced Permissions Tab

Figure 2-34

The Advanced permissions security tab allows configuration of the following security settings:

•

Change Permissions

This feature can be used to control who has access to change security permissions within the Pointsec Protector Administration

Console. Users/groups will be prevented from changing rights within this section of the Pointsec Protector Administration

Console.

This feature can be used to explicitly deny users from elevating permissions (e.g domain admins)

Note - Caution should be taken to ensure that rights are not removed from all users.

•

EPM Key Recovery

This option is only applicable if the Encryption Policy Manager

(EPM) is available and should not be configured for standard users.

This option allows the defined users/groups to perform key recovery of encrypted removable media using the Encryption Policy

Manager. Members of this group will have full access to all encrypted removable media. By default this will be configured for system administrators only.

•

Change Media ID

This option determines whether the selected users/groups have the rights to change the Removable Media ID. It is advised that only

Pointsec Protector Server Properties security administrators are granted the rights to change the media

ID as this process is irreversible and will impact Pointsec Protector

Client users.

•

Change Configuration Settings

This feature can be used to control which users/groups have access to change configuration options (excluding profiles and groups) within the Pointsec Protector Administration console.

•

Change Profile template

Permissions can be assigned regarding the capability of changing global profile templates. Please note that specific profile security will override the global setting.

•

Change Groups and Group Order

Permissions can be assigned regarding the capability of creating, deleting and modifying user groups. Group ordering can also be restricted.

•

Create Reports

The Create Reports security can be used to define which users/groups are permitted to create new HTML reports from within the administration console.

•

Delete Reports

By configuring access to this option it is possible to specify users/groups that are permitted to delete reports from within the administration console.

•

View Configuration

This option will grant/revoke access for the selected users/groups to view the users/groups and profile section within the Pointsec

Protector administration console. Without access being granted to view the configuration, no access will be given to the Pointsec

Protector Administration Console.

•

View Logs

This option will allow the selected users/groups the ability to view the Pointsec Protector audit logs within the Pointsec Protector

Administration Console.

Note - The anonymous network connection must be supported by the

Pointsec Protector server in order to account for requests from the clients where there is no interactive user logged in.

In such scenarios a connection between the client and server is still established according to the security protocol (sspi), that is, authenticated. Anonymous logon accounts must be given client access permissions only as by default. This must not be deleted under any circumstances.

Chapter 2 Using the Administration Console 39

Pointsec Protector Server Properties

E-mail Configuration Tab

The Pointsec Protector Enterprise Server can be configured to send e-mail alerts on defined events to the e-mail addresses specified under the events node. During installation it is possible to configure the SMTP server used for sending alerts and also the specified accounts and security credentials.

This tab enables the administrator to specify or reconfigure these settings:

Figure 2-35

The following information must be specified:

•

SMTP server name

The name of the server where SMTP is enabled for internal connections.

•

Port

Port number on which the SMTP server can be connected to

(default 25)

•

SMTP user name

Specify a user account that has permission to connect to and send e-mail alerts via SMTP.

•

Password

The user account password.

•

Confirm Password

As above.

•

Server e-mail address

The e-mail address used to send Pointsec Protector alerts via the

SMTP server

•

Alert message subject

This text will appear in the message subject for all alert messages generated by the Pointsec Protector Enterprise Server.

Pointsec Protector Server Properties

•

Send a test alert to

Enables the system administrator to test the SMTP configuration settings. On pressing this button a test message should be received immediately in the specified test e-mail inbox.

Console Settings Tab

Pointsec Protector is designed to be used on global infrastructures with many thousands of machines and workstations. To improve performance it is possible to restrict the number of viewed users and workstations. Select the required numbers and click OK to continue:

Figure 2-36

Server Key Tab

For Novell network installations, the Server Key tab will be automatically displayed. The Pointsec Protector Server uses an RSA key to encrypt client>server communication across the network. The RSA key must be exported to the client installation folder prior to install or alternatively the