Device security

[manamaga2512]

Hi De Hi! After this half term break I will be rolling out around 20 new Windows 10 laptops to some post 16 students, and around 50 of the same to teaching staff. I have only one issue remaining unresolved. I don't know what to use for protecting the data on the laptops if stolen. I have a demo of Deslock tomorrow so will see how that goes but I think it maybe pricey. Although I do have an annual non curric software budget, I wouldn't call it a generous one. I've heard that bitlocker is hard to configure and manage. There are only two of us (reduced from a team of four over the last 12 months) so I'm looking for something easy to manage. Might also roll it out to the desktops.

 

Ta very much.

[snagrat]

Can’t you use Bitlocker?

 

Edit - oops sorry see you mentioned that. I don’t think it is hard to manage. Keys get written to AD so easily recoverable if you need to decrypt the data

[manamaga2512]

Can’t you use Bitlocker?

 

Edit - oops sorry see you mentioned that. I don’t think it is hard to manage. Keys get written to AD so easily recoverable if you need to decrypt the data

Does it affect the speed of laptops much?

[ShellfishClive]

Bitlocker won't slow you laptop down at all, and if it does it's to a state that isn't noticeable. It's pretty damn secure too.

[MrWrighty]

Hi De Hi! After this half term break I will be rolling out around 20 new Windows 10 laptops to some post 16 students, and around 50 of the same to teaching staff. I have only one issue remaining unresolved. I don't know what to use for protecting the data on the laptops if stolen. I have a demo of Deslock tomorrow so will see how that goes but I think it maybe pricey. Although I do have an annual non curric software budget, I wouldn't call it a generous one. I've heard that bitlocker is hard to configure and manage. There are only two of us (reduced from a team of four over the last 12 months) so I'm looking for something easy to manage. Might also roll it out to the desktops.

 

Ta very much.

 

Deslock Pro will allow you to encrypt laptops. I've been looking in to it. You should get 50% educational discounts. Deslock does not require TPM and is priced per user not per device. It can encrypt emails between groups, files, folders, HDD, Laptops etc and is controlled via an Enterprise frontend similar to ERA if you use their Endpoint Products. I believe they will be combining ERA and the Encryption management soon in to one console.

 

ESET Endpoint protection will also allow you to define a list of acceptable USB devices etc that will be allowed on the network.

[Ertech]

I am currently looking at Sophos encryption...

[DJ-1701]

I wouldn't say BitLocker isn't hard to manage, you will need to make a change to your AD scheme and add a GPO for forcing your domain machines to add the key to AD.

 

I am currently looking at Sophos encryption...

 

IIRC from Windows 8+, Sophos just manages BitLocker.

[LeMarchand]

I wouldn't say BitLocker isn't hard to manage, you will need to make a change to your AD scheme and add a GPO for forcing your domain machines to add the key to AD.

 

I don't even get that complicated (though I should!) - just store the keys. Set a GPO so it can be used without TPM. Free and easy. Messes up on some older (XP era) machines, but as the OP is deploying to new ones it shouldn't be a problem.

[DJ-1701]

I don't even get that complicated (though I should!) - just store the keys. Set a GPO so it can be used without TPM. Free and easy. Messes up on some older (XP era) machines, but as the OP is deploying to new ones it shouldn't be a problem.

 

Well, if you did want to store them in AD...

 

If you're running 2008 schema, you will need to run the scripts here first. Note: The second script file will need the ' .' at the end of the command as shown in the example.

https://technet.microsoft.com/en-us/library/jj635854.aspx

 

Run the following script on the DC, so machines can write the TPM data back to AD.

https://technet.microsoft.com/en-us/library/dn466534.aspx#BKMK_Add_TPMSelfWriteACE

 

Add the following GPO setting to the machines you wish to encrypt.

 

Windows Components/BitLocker Drive Encryption/Operating System Drives

-Choose how BitLocker-protected operating system drives can be recovered Enabled

-Allow data recovery agent Enabled

-Configure user storage of BitLocker recovery information:

Allow 48-digit recovery password

Allow 256-bit recovery key

-Omit recovery options from the BitLocker setup wizard Disabled

-Save BitLocker recovery information to AD DS for operating system drives Enabled

-Configure storage of BitLocker recovery information to AD DS: Store recovery passwords and key packages

-Do not enable BitLocker until recovery information is stored to AD DS for operating system drives Enabled

 

For any machines you have already encrypted, you will need to add the information to AD manually, by doing the following...

 

Any devices you have already encrypted you wish to add the details to AD...

 

Open an Administrator level command prompt (yes, Command Prompt, NOT PowerShell... ok, ok... so you opened PowerShell... type CMD for the syntax to work then! )

 

Type: manage-bde -protectors -get c:

From the output take the Numerical Password ID for the drive then type the following replacing Numerical-Password-ID-Here with the ID.

Type: manage-bde -protectors -adbackup c: -id {Numerical-Password-ID-Here}

 

After a while, this should now be in Active Directory under the BitLocker Recovery tab.

[MrWrighty]

I don't even get that complicated (though I should!) - just store the keys. Set a GPO so it can be used without TPM. Free and easy. Messes up on some older (XP era) machines, but as the OP is deploying to new ones it shouldn't be a problem.

 

Surely Bitlocker is only protecting a small proportion of your network. How do you manage communications through email for example. Once and email is written and sent it is in the wild, DesLock will encrypt that process ensuring only people within defined groups are able to read the contents of said email.

[Ertech]

I don't have BitLocker on Windows7Pro devices so it will need to more thn that... - any recommendation for Windows 7 pro devices?

 

I wouldn't say BitLocker isn't hard to manage, you will need to make a change to your AD scheme and add a GPO for forcing your domain machines to add the key to AD.

 

 

 

IIRC from Windows 8+, Sophos just manages BitLocker.

[manamaga2512]

I am currently looking at Sophos encryption...

We do have Sophos Enterprise which we purchase through our LEA, so we only get the 'package' that they, in turn, have purchased from Sophos........and they didn't buy any endpoint protection. Hence me looking for a third party solution.

[LeMarchand]

Well, if you did want to store them in AD...

 

Cheers . It's on my "to do" list - that will be a great help!

 

Surely Bitlocker is only protecting a small proportion of your network. How do you manage communications through email for example. Once and email is written and sent it is in the wild, DesLock will encrypt that process ensuring only people within defined groups are able to read the contents of said email.

 

The OP mentioned Bitlocker, and seemed concerned it was hard to manage. Even I can understand the instructions @DJ-1701 posted (and my lazy person's implementation is even easier). Depends on what the OP wants to achieve.

Edited October 19, 2017 by LeMarchand

[DJ-1701]

Surely Bitlocker is only protecting a small proportion of your network. How do you manage communications through email for example. Once and email is written and sent it is in the wild, DesLock will encrypt that process ensuring only people within defined groups are able to read the contents of said email.

 

The remit for the thread was covering data on the laptop if stolen. Bitlocker would prevent access to the system unless someone knew the password.

 

E-mails are a different kettle of fish and there are other methods such as Office 365 encryption, ZIP file encryption, etc. if required.

 

I don't have BitLocker on Windows7Pro devices so it will need to more thn that... - any recommendation for Windows 7 pro devices?

 

For Windows 7 originally I looked at CompuSec and TrueCrypt, I did use CompuSec but both have now gone. However Veracrypt https://www.veracrypt.fr/en/Home.html have continued the TrueCrypt project, fixing a few security issues along the way.

[LeMarchand]

I don't have BitLocker on Windows7Pro devices so it will need to more thn that... - any recommendation for Windows 7 pro devices?

 

Upgrade to Ent or 10 ?

 

Or Veracrypt if you want free.

[DJ-1701]

Upgrade to Ent or 10 ?

 

Or Veracrypt if you want free.

 

Great minds think alike.

 

I do believe BitLocker on Windows 7 Enterprise requires a TPM on the machine though as I tried that on ours as well.

Edited October 19, 2017 by DJ-1701

[MrWrighty]

The remit for the thread was covering data on the laptop if stolen. Bitlocker would prevent access to the system unless someone knew the password.

 

E-mails are a different kettle of fish and there are other methods such as Office 365 encryption, ZIP file encryption, etc. if required.

 

 

 

For Windows 7 originally I looked at CompuSec and TrueCrypt, I did use CompuSec but both have now gone. However Veracrypt https://www.veracrypt.fr/en/Home.html have continued the TrueCrypt project, fixing a few security issues along the way.

 

Point taken but once a bit locker device is booted it is no longer protected by the encryption. The device may still be accessible at this point. Would you not also require folder level encryption on the device whist it running. There have been stories in the press recently of people on motorbikes stealing laptops and phones whilst people are using them, so bitlocker will not protect you. As I understand it with DESLock keys can be revoked immediately making folders inaccessible.

Edited October 19, 2017 by MrWrighty

[DJ-1701]

Point taken but once a bit locker device is booted it is no longer protected by the encryption. The device may still be accessible at this point. Would you not also require folder level encryption on the device whist it running,

 

It is still protected by NTFS permissions and screensaver time outs, are you saying that other products require you to enter a password each time you wish to access a file, or browse a directory? As that's the only way I can see it being more secure. :/

[MrWrighty]

It is still protected by NTFS permissions and screensaver time outs, are you saying that other products require you to enter a password each time you wish to access a file, or browse a directory? As that's the only way I can see it being more secure. :/

 

As I understand it with DESLock, keys can be revoked immediately making folders inaccessible.

[LeMarchand]

As I understand it with DESLock, keys can be revoked immediately making folders inaccessible.

 

Won't that depend on how quickly the user thinks to call whoever can revoke the keys and that person's availability/response? I think it's about making reasonable steps to secure data. Not even Deslock will stop someone with a long lens or teachers wandering away from their machines and leaving them unlocked.

[DJ-1701]

As I understand it with DESLock, keys can be revoked immediately making folders inaccessible.

 

Won't that depend on how quickly the user thinks to call whoever can revoke the keys and that person's availability/response? I think it's about making reasonable steps to secure data. Not even Deslock will stop someone with a long lens or teachers wandering away from their machines and leaving them unlocked.

 

Also, if the device is stolen and offline, it wouldn't implement.

[ADMaster]

Not to hijack this but I have a dumb noob question about bit locker.

In the past if a PC was acting up I'd just swap the drive into another and away the user went.

Also if an HDD was failing I'd connect it to a USB cady and retrieve what I could.

 

With SSD's dying suddenly data recovery isn't so much the case anymore.

 

How would I go about swapping a drive into different hardware, the machine name would be the same but it would be a different TPM chip.

 

Is there a process to this or will it just have to be a reimage?

Also if I do need to reimage it typically it uses the same hostname so any conflicts there with storing keys in AD.