A Critical Analysis of Microsoft Data Protection Solutions

A Critical Analysis of Microsoft Data Protection Solutions John RHOTON Distinguished Technologist HP Services: Office of CTO

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object]

[object Object],Windows Server 2008 Service Hardening Windows Advanced Firewall BitLocker Drive Encryption Server Core Dynamic Partitioning Next Generation TCP/IP 64x64-bit Cores Investment in the Fundamentals Operations Infrastructure Centralized Role Management Failover Clustering Windows Virtualization Network Access Protection Terminal Services AD Read Only Domain Controllers Windows PowerShell Security Reliability Performance Application Platform IIS 7 .NET Framework 3.0 Resource Management Federated Identity

BitLocker™ Drive Encryption ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],BitLocker

Bitlocker™ features overview ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

What is a Trusted Platform Module (TPM)? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],TPM 1.2 spec: www.trustedcomputinggroup.org

BDE Disk layout and key storage System ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],System Volume Contains: MBR, Loader, Boot Utilities (Unencrypted, small) ,[object Object],[object Object],[object Object],[object Object],SRK 1 2 3 OS Volume PIN USB-hosted key FVEK

BDE: Available Authenticators ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],TPM TPM+USB TPM+PIN USB Key (Recovery or Non-TPM) 123456-789012-345678- Recovery Password (48 Digits) TPM+USB+Pin

BDE architecture Static root of trust measurement of early boot components

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

BDE passwords and PINs... ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

BDE Recovery options ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

How about Embedded Security for HP ProtectTools? Supported applications: ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

But...there’s more than Technology... “ 54321 TO SILENCE ALARM” “ REPEAT CODE TO RESET”

EFS investments ,[object Object],[object Object],[object Object],[object Object],[object Object]

EFS with Smartcards ,[object Object],[object Object],[object Object],[object Object],[object Object],Smartcard Private Key Derive a symmetric key AES-256 key Use as Software Private Key (Accelerated) Cache in LSA Use to encrypt FEK RSA mode Accelerated mode

EFS with remote files Client side encryption Local EFS encryption [Keys and certificates live on the client] Client connects to remote server share SMB protocol No need to enable Trust For Delegation Encrypted file sent to server File Share

EFS Re-Key Wizard ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

EFS key backup improvements ,[object Object],[object Object],[object Object],[object Object]

Information Author The Recipient RMS Server SQL Server Active Directory 2 3 4 5 ,[object Object],[object Object],[object Object],[object Object],[object Object],1 How does RMS work?

AD RMS in Windows Server 2008 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Challenges in External Collaboration ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Solution: AD Federation Service ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

External RMS collaboration via ADFS Contoso Fabrikam RMS WebSSO ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],AD AD FS-A FS-R 1 RAC CLC PL 2 4 3 5 6 7 8 9 RAC CLC 10 UL 11 12

Exchange 2007 and RMS Author using Office 2003 / 2007 The Recipient SQL Server Active Directory 4 5 6 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],1 4 2 3

But...there’s more than Technology... All must enter through electronic mantrap Fence ends here Sign says, “road is for cars only”

Technology comparison BDE EFS RMS Encryption AES 128 (RSA32.LIB) AES 128 (Crypt32.DLL) AES 128 (Crypt32.DLL) Data Awareness Blocks Files App defined; docs/email Master Key TPM + SW Identity, Dongle, File SW, Smart-card Obfuscated SW (lockbox) Content Key Same as root key Same as root key Server Protects What? Windows and Data Directories and Files Documents (including use) Protects Who? Machine Owner, User Users Document Owners Protection Local, removable media Local, removable media, remote Remote, removable media Who is god? Local admin, net admin Local admin, net admin Document owner, RMS admin Supports other security systems? Yes Yes (ISV’s only) No (RMS is a security platform for applications) Data Recovery Mechanism Dongle, File, Network; Manual Key Entry Local or AD based policy RMS server policy Killer Client Scenario Lost or Stolen laptop Multi-user PC Protected Document Sharing Killer Server Scenario Branch-Office Server Protect Documents on File Shares from Admin RMS support in Sharepoint and Exchange Killer Admin Scenario Just switch it on. (also Force Recovery) My Documents encrypted by default Establish corporate information policy

What feature should I use? ,[object Object],[object Object],[object Object],Some cases can result in overlap. (e.g. Multi-user roaming laptops with untrusted network admins) Scenarios BDE EFS RMS Laptops X Branch office server X Local single-user file & folder protection X Local multi-user file & folder protection X Remote file & folder protection X Untrusted network admin X Remote document policy enforcement X

Overview ,[object Object],[object Object],[object Object],[object Object],[object Object]

Download the HP Security Handbook! ,[object Object],[object Object]

More information ,[object Object],[object Object],[object Object]

A Critical Analysis of Microsoft Data Protection Solutions

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a A Critical Analysis of Microsoft Data Protection Solutions

Semelhante a A Critical Analysis of Microsoft Data Protection Solutions (20)

Mais de John Rhoton

Mais de John Rhoton (20)

Último

Último (20)

A Critical Analysis of Microsoft Data Protection Solutions