SECCT 10 Bit Locker Drive Encryption Deployment Russell

SECCT 10: Bit. Locker™ Drive Encryption Deployment Russell Humphries Senior Product Manager – Window Vista Security

Disclaimer • This presentation contains preliminary information that may be changed substantially prior to final commercial release of the software described herein. • The information contained in this presentation represents the current view of Microsoft Corporation on the issues discussed as of the date of the presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of the presentation. • This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. • Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this presentation. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this information does not give you any license to these patents, trademarks, copyrights, or other intellectual property. • © 2006 Microsoft Corporation. All rights reserved.

Information Loss Is Costly Information loss – whether via theft or accidental leakage – is costly on several levels Financial Legal & Regulatory Compliance Image & Credibility The U. S. Dept of Justice estimates that intellectual property theft cost enterprises $250 billion in 2004 Loss of revenue, market capitalization, and competitive advantage Increasing regulation: SOX, HIPAA, GLBA Bringing a company into compliance can be complex and expensive Non-compliance can lead to significant legal fees, fines and/or settlements Leaked executive e-mails can be embarrassing Unintended forwarding of sensitive information can adversely impact the company’s image and/or credibility

“Bit. Locker Drive Encryption provides stronger protection for data stored on your Windows Vista ™ systems – even when the system is in unauthorized hands or is running a different or attacking OS. Bit. Locker does this by utilizing full volume encryption; this prevents a thief who boots another OS or runs a software disk inspection tool from breaking Vista file and system protections or even the offline viewing of data files. ”

Bit. Locker Drive Encryption fully encrypts the entire Windows Vista volume. Designed specifically to prevent the unauthorized disclosure of data when it is at rest. Provides data protection on your Windows client systems, even when the system is in unauthorized hands. Designed to utilize a v 1. 2 Trusted Platform Module (TPM) for secure key storage and boot environment authentication Bit. Locker

Security Management secure usable Adapted from Jesper M. Johansson, “Security Management”, Microsoft Tech. Net affordable

Who are these people? National Interest Spy Personal Gain Thief Personal Fame Trespasser Curiosity Vandal Script-Kiddy Undergraduate 7 Author Expert Specialist

Who are these people? Largest area by $ spent National Interest Spy Largest area by $ lost Personal Gain Thief Fastest growing segment Personal Fame Trespasser Curiosity Vandal Script-Kiddy Undergraduate Largest area by volume 8 Author Expert Specialist

Spectrum of Protection Bit. Locker offers a spectrum of protection allowing customers to balance ease-ofuse against the threats they are most concerned with.

Bit. Locker disk layout

Ease of Deployment Integration with existing infrastructure Deployment features Functionality fully exposed by WMI Supplied MMC plug-in Integrates with Group Policy Active Directory Seamless integration with Longhorn Server Schema extensions available for Server 2003 sp 1 and higher Auto-escrow of recovery keys enabled by default Confidential bit set on keys; read-only by admin only

Bit. Locker TPM Administration Storyboard – New Machine 4 11 2 3 Note: Steps 1 -3 can be pre- config’ed (OEM, SP) Basic TPM Administration/Deployment 1. Machine arrives at enterprise in un-initialized state. 2. Turn TPM On 3. Check for physical presence by rebooting the machine and prompting user at BIOS screen for key press. 4. Log back into Windows Vista 5. Take Ownership of TPM 6. Check for existence of Endorsement Key (Provided by OEM) 7. Create TPM Administration Password. 8. Commit changes to TPM and initialize. 9. Publish TPM Administration Password to AD/File 10. TPM Initialization Complete ***** 9 10 5 ***** 8 7 6

Bit. Locker Enterprise Machine Deployment with TPM BDE installation 1. 2. 3. 4. 5. Active Directory prepared for CS keys Windows Vista Install a. BDE is only available in the Enterprise and Ultimate versions of Windows Vista. b. BDE requires a partition separate from the Windows Vista OS partition with a min free space of 350 Mb. c. During installation the system is checked for correct version of TPM (v 1. 2) and BIOS via Plug and Play. d. TPM & BDE drivers are installed. BDE Initialization a. Scripted initialization of TPM. b. TPM Ownership password saved to Active Directory Remote executed Script BDE a. Policy saves recovery key to AD b. System encrypted Inspect audit logs for successful end to encryption. Windows Vista Install Active Directory is prepared for BDE Keys 2 1 Store TPM Ownership Password TPM Script Initialization Store BDE recovery key 2 3 BDE script setup 4 5

Bit. Locker Recovery 2 2 11 4 5 6 Example Recovery Scenario 1. Feature turned on. 2. AD access via network. 3. Recovery key escrowed to AD and/or USB dongle. 4. User drops laptop and breaks motherboard. 5. HD from old broken machine put into new laptop with 3 BDE enabled. 6. BDE can’t access HD because the TPM key in new laptop is different. 7. User launches BDE recovery: A. User uses USB dongle to recover the drive. -or. A. User calls admin and Administrator authenticates user. B. Admin gets correct recovery key from AD. C. Admin reads key to user over the phone. D. User types in recovery key. 8. Recovery key is used to recover the drive 7 a 3 7 b 88 7 e 7 d 7 D 7 c 7 C

System Upgrade with Bit. Locker™ Upgrading computers with BDE 1 1. Turn off Bit. Locker 2. Upgrade system Updated BIOS -- or -Install Service Pack 3. Turn On Bit. Locker – no encryption required 2 * If doing an update using Windows Update Services, the hash of the new component will already be calculated, so Bit. Locker will not need to be disabled to do the update. 3