HP ProtectTools security software 2011 - Technical white paper

ManualsBrandsHP ManualsTabletHP EliteBook 2760p Base Model Tablet PC

HP ProtectTools security software 2011

Technical white paper

Table of contents

Introduction ......................................................................................................................................... 2

HP ProtectTools security software overview ............................................................................................. 2

HP ProtectTools Security Manager ......................................................................................................... 4

HP Security Manager Setup wizard .................................................................................................... 6

User management ............................................................................................................................ 6

Credential Manager for HP ProtectTools ............................................................................................. 8

HP Enhanced Pre-Boot Security .......................................................................................................... 9

Central Management for HP ProtectTools .......................................................................................... 10

Backup and restore ........................................................................................................................ 11

Security software components for HP ProtectTools .................................................................................. 13

Face Recognition for HP ProtectTools ................................................................................................ 13

Device Access Manager for HP ProtectTools ...................................................................................... 13

Drive Encryption for HP ProtectTools ................................................................................................. 16

Embedded Security for HP ProtectTools ............................................................................................. 17

File Sanitizer for HP ProtectTools ...................................................................................................... 18

Computrace® LoJack Pro for HP ProtectTools ..................................................................................... 19

Privacy Manager for HP ProtectTools ................................................................................................ 19

HP DigitalPass One Time Password .................................................................................................. 20

Platform Support ................................................................................................................................ 20

Frequently Asked Questions ................................................................................................................ 21

For more information .......................................................................................................................... 24

Summary of content (24 pages)

PAGE 1
HP ProtectTools security software 2011 Technical white paper Table of contents Introduction ......................................................................................................................................... 2 HP ProtectTools security software overview ............................................................................................. 2 HP ProtectTools Security Manager .........................................................................................................
PAGE 2
Introduction Data security can have a direct impact on the health of your business, and most businesses rank security among their top concerns. Threats to data security are increasing in magnitude as well as complexity as computers become more mobile and better connected. HP has a rich heritage in enterprise security and started devoting resources to solving the mobile security problem as soon as the trend emerged.
PAGE 3
Figure 1. HP ProtectTools plug-ins HP ProtectTools can be accessed from a single, easy-to-use software interface. It is easily accessible from the Windows® task bar, start menu, or desktop gadget. Each plug-in module provides a high level overview of its purpose. The desktop gadget also indicates the overall security status of your computer using an easy to understand color code. Detailed help files provide additional information.
PAGE 4
HP ProtectTools Security Manager HP ProtectTools Security Manager provides two consoles: User and Administrative. Although somewhat similar, the two consoles provide different options. The Administrative Console makes changes to system wide parameters (Figure 2). For example, if the administrator wants to change the minimum and maximum number of enrolled fingerprints required for all users, she would use the Administrative Console.
PAGE 5
The User Console is the HP ProtectTools Security Manager (Figure 3). This console makes changes to individual user profiles. For example, if a user wants to change his own password or register his fingerprints, he would use the User Console. Figure 3. HP ProtectTools Security Manager home page HP ProtectTools Security Manager provides global functionality needed by the installed security modules, as well as security setup features such as the setup wizard, user management and security backup and restore.
PAGE 6
HP Security Manager Setup wizard Setting up security should be fast and easy. Immediately after logging on to Windows on the user desktop, the administrator is guided through an easy setup of the HP ProtectTools Security Manager by a simple and straightforward Security Manager Setup wizard (Figure 4). Figure 4. HP ProtectTools Security Setup wizard The setup wizard is designed to help you secure access to your computer via a password, smartcard, fingerprint sensor, or face recognition.
PAGE 7
and a separate operating system password. Security is global to the computer and users exist in Windows as well as in the pre-boot environment. User management, accessed from HP ProtectTools Administrative Console (Figure 5), is designed to allow you to create and delete ProtectTools users system wide. To ensure that users and security policies are synchronized between the operating system and the pre-boot environment, users should always be added and deleted using HP ProtectTools user management.
PAGE 8
Credential Manager for HP ProtectTools Credential Manager is a core component of HP ProtectTools security software. It gives users the ability to specify how the different available security technologies will work together to provide increased protection against unauthorized access to the personal computer (Figure 6). It is the glue that brings the different security technologies together to create a specified behavior. Figure 6.
PAGE 9
Feature Benefit Microsoft Windows logon capability Enables the use of any supported security technology to logon to Windows providing a more secure and convenient alternative to password authentication. Single sign-on manages user credentials for websites, applications and protected network resources Users no longer need to remember multiple passwords for protected websites, applications and network resources.
PAGE 10
selected questions. If the answers match, login continues. Upon completion of the login process, the user is asked to change the login credential with an option to accept or decline. Answers to HP SpareKey questions are encrypted and cannot be deciphered by an unauthorized person. The basic process for securing the questions is as follows:  Step 1 – Answers to the three questions are concatenated into a single text string, eliminating all spaces.
PAGE 11
DigitalPersona Pro protects applications and data by simplifying security controls for multiple applications. It provides for strong authentication to boost accountability and deter fraud. It simplifies auditing with comprehensive logging. By consolidating point management tools into one console, organizations are able to automate processes and reduce costs from passwords and provisioning. Table 3 shows the major features of HP ProtectTools with DigitalPersona Pro. Table 3.
PAGE 12
Figure 8.
PAGE 13
Security software components for HP ProtectTools The modular architecture of the HP ProtectTools Security Manager enables add-on components to be selectively installed by the end user or IT administrator. This provides a high degree of flexibility to customize HP ProtectTools depending on security needs and the underlying hardware configuration. Each add-on element is a self contained security application providing targeted security functionality.
PAGE 14
 Advanced Settings Device Administrators Group When Device Access Manager is installed, a Device Administrators group is created. This group is used to exclude trusted users from the restrictions imposed by a Device Access Manager policy. Trusted users usually include system administrators. Simple Configuration Simple Configuration enables or denies access to certain major categories of devices to users that are not part of the Device Administrators group.
PAGE 15
 Scenario 1 – In a call center environment, call takers have full access to sensitive product and pricing information. The company wants to protect this data and ensure that it is not removed from the premises. This can be accomplished by creating a Device Access Manager policy that prevents removable storage devices such as USB keys and writeable optical drives from being used by unauthorized users.
PAGE 16
Drive Encryption for HP ProtectTools Drive Encryption is a full volume encryption (FVE) solution that encodes all information on the hard drive volume so it becomes unreadable to an unauthorized person. FVE is currently the preferred way to protect data on a hard drive. With Drive Encryption, you can encrypt or decrypt individual drives, create backup keys, and perform a recovery (Figure 10). Figure 10.
PAGE 17
Embedded Security for HP ProtectTools Embedded Security for HP ProtectTools is an add-on module that allows users to configure the Trusted Platform Module (TPM) embedded security chip (Figure 11). This add-on module is intended for HP business notebooks, desktops and workstations configured with a TPM embedded security chip designed to the Trusted Computing Group (TCG) standard. Embedded Security for HP ProtectTools version 4.0 or later supports the latest TPM v1.2 as well as the previous TPM v1.1.
PAGE 18
Feature Benefit ProtectTools uses it to further secure the encryption keys that encrypt sensitive user credentials such as website passwords or network logon credentials. Designed to the TCG standard As a standards-based technology, embedded security chips are designed to work with a growing number of third party software solutions while providing a platform to support future hardware and operating system architectures.
PAGE 19
you want shredded automatically, and define the schedules. This level of control is available in File Sanitizer settings (Figure 12), where security levels can be selected as well custom control over types of information to erase (i.e. cookies, temporary files, etc.). File Sanitizer can then be set up to erase the predefined files based on events such as Windows shutdown. Figure 12. HP ProtectTools File Sanitizer setup menu File sanitization is more intensive process than simple file deletion.
PAGE 20
Privacy Manager is an HP ProtectTools plug-in, and can be accessed directly from within Microsoft Office 2010. On first use, a wizard will guide you through the process of obtaining a digital certificate. HP has partnered with Comodo, a leading issuer of digital certificates, to provide HP Privacy Manager users with a certificate, valid for six months, at no cost. The certificate identifies the originator of the communication to the recipient. Non-Comodo certificates are also supported.
PAGE 21
Table 5.
PAGE 22
A. HP ProtectTools and security modules are available as standard security features on all business notebooks. On business desktops, some modules are available at additional cost. For details on ProtectTools availability on business desktops, please refer to the Platform Support section of this white paper. Q. Can smart cards be used for pre-boot authentication? A. Smart cards are not supported in BIOS pre-boot; however, FVE supports specific ActivIdentity smart cards.
PAGE 23
Q. What if a user has multiple Microsoft Windows accounts? A. This would function the same as multiple users on a single PC. The administrator would have to create a different identity for each account. Q. What is the difference between user and administrator rights for Credential Manager for HP ProtectTools? A. An administrator has full rights to all Credential Manager configuration options.
PAGE 24
For more information To learn more about HP ProtectTools, contact your local HP sales representative or visit our website at www.hp.com/products/security. © Copyright 2008, 2010, 2011 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty.