neonetman Posted April 19, 2016 Posted April 19, 2016 We currently run Cryptzone eUSB to enforce encryption on staff USB devices, whilst students are able to use any device. With Cryptzone eUSB going end of life, I'm on the hunt for a replacement package to do this. Obviously we've looked at Bitlocker, however that can't differentiate between staff and students so that's ruled out. Can anyone suggest something appropriate?
enjay Posted April 20, 2016 Posted April 20, 2016 Truecrypt? Or what about https://www.istorage-uk.com/product/datashur/, who sell PIN-protected drives? The drive actually has little number buttons on it, and won't work until you enter the correct code. Totally platform-independent too, so staff who have Macs can still use them, unlike most software-based encrypters.
koryo Posted April 20, 2016 Posted April 20, 2016 Truecrypt? Or what about https://www.istorage-uk.com/product/datashur/, who sell PIN-protected drives? The drive actually has little number buttons on it, and won't work until you enter the correct code. Totally platform-independent too, so staff who have Macs can still use them, unlike most software-based encrypters. *Plans to get some fingerprint dust and check what numbers are pressed* <- I wonder how long it would take to reverse engineer the PIN from that. Does the drive blow up after a number of failed attempts?
southhamster Posted April 20, 2016 Posted April 20, 2016 *Plans to get some fingerprint dust and check what numbers are pressed* <- I wonder how long it would take to reverse engineer the PIN from that. Does the drive blow up after a number of failed attempts? Hmm. In our school the USB stick would be wrecked by someone pressing the buttons so hard it breaks the stick, and probably USB port in the laptop too. We issue Integral encrypted USB sticks to all staff. They sign for them and we keep copies of the passwords in the safe. I have to say we've had zero problems so far.
Blue_Cookeh Posted April 20, 2016 Posted April 20, 2016 How do you mean differentiate between staff and students with BitLocker? We use MDOP MBAM to manage BitLocker & BitLockerToGo across our Windows estate and apply different GPOs to students vs staff. I believe MBAM is included in your Windows licensing if you have volume licensing as of Windows 10.
kevin_lane Posted April 20, 2016 Posted April 20, 2016 We Kingston with built in est anti virus plus builtin encryption
enjay Posted April 21, 2016 Posted April 21, 2016 Hmm. In our school the USB stick would be wrecked by someone pressing the buttons so hard it breaks the stick, and probably USB port in the laptop too. How would your USB ports be more at risk from the use of one of these than from any other memory stick? - - - Updated - - - Remember if you have anyone using a Mac, most of the software-encryption options won't work...
gshaw Posted April 21, 2016 Posted April 21, 2016 How do you mean differentiate between staff and students with BitLocker? We use MDOP MBAM to manage BitLocker & BitLockerToGo across our Windows estate and apply different GPOs to students vs staff. I believe MBAM is included in your Windows licensing if you have volume licensing as of Windows 10. I've been doing this https://blogs.technet.microsoft.com/askpfeplat/2013/06/09/how-to-enable-user-based-controlenforcement-of-bitlocker-on-removable-data-drives/
CyberNerd Posted April 21, 2016 Posted April 21, 2016 I would advocate retiring them completely and using something like Google Drive instead. The advantages are all the data is encrypted in transit and at rest, it's unlimited storage, works on any device, doesn't require any extra software, can't be lost and is completely free.
enjay Posted April 21, 2016 Posted April 21, 2016 I would advocate retiring them completely and using something like Google Drive instead. The advantages are all the data is encrypted in transit and at rest, it's unlimited storage, works on any device, doesn't require any extra software, can't be lost and is completely free. ... and can only store editable files in Google's own format; Word, Excel, PowerPoint all need downloading locally before working on them, so would be saved, unencrypted, on staff members' home PCs.
CyberNerd Posted April 21, 2016 Posted April 21, 2016 ... and can only store editable files in Google's own format; Word, Excel, PowerPoint all need downloading locally before working on them, so would be saved, unencrypted, on staff members' home PCs. I can open a docx file, edit it and save it without converting to Google Drive or even downloading it with the Google drive plugins so I'm not sure where you got that idea from? In any case if you open in Word it would save a non-encrypted temp file somewhere.
enjay Posted April 21, 2016 Posted April 21, 2016 I can open a docx file, edit it and save it without converting to Google Drive or even downloading it with the Google drive plugins so I'm not sure where you got that idea from? Oh yeah, forgot about that plugin. I uninstalled it ages ago because it didn't seem to work very well, and has limited functionality. In any case if you open in Word it would save a non-encrypted temp file somewhere. True, but much harder to find the deleted temp file than it is to find the downloaded Word doc in the MyDocs folder or Recycle Bin.
CyberNerd Posted April 21, 2016 Posted April 21, 2016 True, but much harder to find the deleted temp file than it is to find the downloaded Word doc in the MyDocs folder or Recycle Bin. This is called Security Through Obscurity
LeMarchand Posted April 21, 2016 Posted April 21, 2016 Go old school: More seriously, and as much as it pains me to say so, cloud is surely a better option?
gshaw Posted April 21, 2016 Posted April 21, 2016 I would advocate retiring them completely and using something like Google Drive instead. The advantages are all the data is encrypted in transit and at rest, it's unlimited storage, works on any device, doesn't require any extra software, can't be lost and is completely free. That's my next step once we get Cloud Drive Mapper up and running
southhamster Posted April 21, 2016 Posted April 21, 2016 How would your USB ports be more at risk from the use of one of these than from any other memory stick? - - - Updated - - - Remember if you have anyone using a Mac, most of the software-encryption options won't work... Because pressing the buttons when it's sticking out of the laptop would push the whole thing down and bend the port. Some staff can be pretty heavy handed with things! Another broken laptop screen this week: sigh.
enjay Posted April 22, 2016 Posted April 22, 2016 Because pressing the buttons when it's sticking out of the laptop would push the whole thing down and bend the port. Some staff can be pretty heavy handed with things! You press the buttons to unlock the drive before plugging it in. 1
southhamster Posted April 22, 2016 Posted April 22, 2016 You press the buttons to unlock the drive before plugging it in. Ah thanks. That makes more sense now!
craig-schools Posted April 25, 2016 Posted April 25, 2016 We are using Transcend Hardware encrypted USB's, they have a master password option and multiple users so I set an Admin user and then create the staff member. It has fingerprint and / or password option. Then the staff laptops are encrypted with Truecrypt and I force a 16digit passphrase with at least 1x number, 1x capital and 1x symbol. The staff hated me for the first couple of times they had to type it in, but then they got over it, maybe a week tops. We also have a VPN to connect staff devices to work from home etc. This is the weak point for me.
gshaw Posted April 25, 2016 Posted April 25, 2016 We are using Transcend Hardware encrypted USB's, they have a master password option and multiple users so I set an Admin user and then create the staff member. It has fingerprint and / or password option. Then the staff laptops are encrypted with Truecrypt and I force a 16digit passphrase with at least 1x number, 1x capital and 1x symbol. The staff hated me for the first couple of times they had to type it in, but then they got over it, maybe a week tops. We also have a VPN to connect staff devices to work from home etc. This is the weak point for me. Got a link for these sticks? Interested to see what kind of price they're coming in at. Do you block all other devices from being used or is it more of a user policy that staff have to comply with? Btw TrueCrypt is a bit of a dead duck now TrueCrypt
craig-schools Posted April 25, 2016 Posted April 25, 2016 The USB's we have are the older 8GB Jetflash 220's which of course are end of life. We bought 50x at the time and so far none have failed, although we have had maybe 6x broken or lost. They are hardware encrypted and essentially show as a virtual CD drive which you run the SecureDrive software from, type in your credentials and then the encrypted partition is available. The closest I can find is https://www.amazon.co.uk/Transcend-TS16GJF200-JetFlash-Flash-Drive/dp/B0050FVEH8?ie=UTF8&*Version*=1&*entries*=0 although I'm sure Kingston have something similar. The laptops were originally bought and encrypted back in 2014 but yes I'm aware TrueCrypt has folded. No school / children data is actually kept on the laptops (only teacher planning if they choose to save it), it's overkill really. If they were using SIMS on it, or saving pupil information then I'd have to change it, I'll probably look at it if / when I upgrade to Windows 10.
Brimstone Posted April 25, 2016 Posted April 25, 2016 I can open a docx file, edit it and save it without converting to Google Drive or even downloading it with the Google drive plugins so I'm not sure where you got that idea from? In any case if you open in Word it would save a non-encrypted temp file somewhere. Plus all these other formats as well.... iMovie, Garageband, Pages, Keynote, Logic Pro....I could go on
cpjitservices Posted April 25, 2016 Posted April 25, 2016 Have a look at ESET DESLock... works really well. Simple and easy to use too which is a bonus.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now