Endpoint & Media Encryption
201CMR17
(Massachusetts Data Security Regulations)
Personal information, a Massachusetts resident's first name and last name
or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account; provided, however, that “Personal information” shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.
201CMR17
(Massachusetts Data Security Regulations)
(a) Social Security number; (b) driver's license number or state‐ issued identification card number; or (c) financial account
number, or credit or debit card number
These need to be protected while:
•Stored on laptops or portable media
•Transmitted over public networks such as the
Internet
Attorney-Client Privilege
Securing our client’s Intellectual
Property & Competitive Intelligence
We have a great deal of data that is
treated as sensitive and in need of
encryption in a variety of media...
…but as a law firm,
“The only safe assumption that a company can
make to avoid the consequences of a data
breach and disclosure is to assume that a
mobile device contains sensitive data. It is
impractical to attempt to ‘classify’
either the
devices or the information on them, encrypting
some devices but not others. “
‐
Gartner, 2009
“Oops.“
Laptop & Portable Media
Help Forming Your Shortlist
General Services Administration “Data at Rest” Encryption Awardees (www.gsa.gov)
Office of Management and Budget, US Department of Defense and GSA teamed up to identify products government agencies could use to protect “sensitive, unclassified data residing on government
laptops, other mobile computing devices and removable storage media devices” [Warning – this is getting dated!]
SANS What Works program (www.sans.org/whatworks) 5.2 Mobile Data Protection and Storage Encryption
Selecting Encryption Solutions
Full Disk
Encryption
File & Folder
Encryption
Selecting Encryption Solutions
System
Performance
End User
Experience
Selecting Encryption Solutions
Selecting Encryption Solutions
Now Patching Now Patching Now Patching Password:??
Checkpoint (PointSec) Credant Mobile Guardian McAfee SafeBoot
Mobile Armor Data Armor SPYRUS Talisman
Symantec Endpoint Encryption Utimaco
PGP (now Symantec)
GuardianEdge (now Symantec) Microsoft Bitlocker
Secure Computing
Fiberlink
Info Security Corp Secret Agent SafeNet ProtectDrive WinMagic SecurDoc SecurStar DriveCrypt 7-zip FreeOTFE TrueCrypt
Encryption Solutions SkyLOCK Dekart Private Disk
Beachhead Solutions
Laptop & Portable Media
A sample playing field
ILTA Survey Results
N/A
Bitlocker
Credant
Other
Symantec PGP
TrueCrypt
Laptop & Portable Media
RFP/Issues to consider
Encrypt all our user’s data
Robust encryption algorithm(s) User friendly (read: seamless)
Easy Deployment
Removable drive encryption
Minimal (or no noticeable) performance hit No interference with shared computers No conflicts with our existing environment
Ease of management (PW resets, etc.) & integration with Active Directory
Laptop & Portable Media
Bill & Tim’s Shortlist
Checkpoint PointSec
Credant
Mobile Guardian
Trend Micro Mobile Armor Data Armor
Symantec Endpoint Encryption (formerly Guardian Edge)
Sophos
Utimaco
SafeGuard
Your endpoint
encryption charter
has made it through
the finance
committee!
We adjusted your
budget to $0.
Laptop & Portable Media
Low or No Budget Options
Inexpensive viable options may include:
Some regulations take the size of the organization into consideration:
[You must maintain physical and technical security safeguards] that are appropriate to (a) the size, scope and type of business of the person obligated to safeguard the personal information under such comprehensive information security program” (201 CMR 17.03)
How to deploy?
Start with IT
Use a Risk
One Policy to Rule Them All
Bingham’s requirements:
Email - Messages
Policy Enforcement - Device Encryption Policy Enforcement - Lockout
Policy Enforcement – Password Complexity Policy Enforcement - Remote PWD Reset Policy Enforcement - Remote Wipe
Policy Enforcement - Transport Encryption
Policy Enforcement - Wipe on Bad PWD [10 strikes and you’re out] System - Works with existing Bingham technologies (m)
Secure File Transfer
Internal server, appliance or virtual appliance
SFTPAccellion SFT Biscom BDS
AllardSoft Filetransfer
Pros/Cons
Windows vs Non-windows.. important features...
subscription model versus not... hardware versus software versus virtual appliance...
Secure File Transfer
Hosted Solutions
www.yousendit.com (limit 2GB) sendthisfile.com
free for files up to 2GB
optional features include dedicated server, dedicated bandwidth
No anti-virus What to look for:
SSL protected interface (it’s not a given!) anti-virus
