HP ProtectTools Security Software 2010 - Technical White Paper

ManualsBrandsHP ManualsDesktopsHP ProBook 4730s Base Model Notebook PC

H P Protec tTools Sec uri ty Softwa re 2 010

Technica l white paper

Table of contents

Introd uc ti o n ......................................................................................................................................... 2

H P ProtectTools securi ty so ftwa re overview ............................................................................................. 2

HP security setup wizard....................................................................................................................... 4

User management ................................................................................................................................ 5

Backup and restore .............................................................................................................................. 5

Security software components for HP ProtectTools .................................................................................... 6

C redential Manager for HP ProtectTools ............................................................................................. 7

C entra l ma na g ement fo r H P Protec tTools ............................................................................................. 8

Device Access Manager for HP ProtectTools ........................................................................................ 9

Drive Encryption for HP ProtectTools ................................................................................................. 11

HP Enha nced Pre-B oot S ecurity ........................................................................................................ 12

Embedded Security for HP ProtectTools ............................................................................................. 14

Face Recognition for HP ProtectTools ................................................................................................ 15

File Sanitizer for HP ProtectTools ...................................................................................................... 16

Computrace® LoJack Pro for HP ProtectTools ..................................................................................... 17

Privacy Manager for HP ProtectTools ................................................................................................ 17

Smart Card Security for HP ProtectTools ............................................................................................ 19

Platform Support ................................................................................................................................ 20

Frequently Asked Questions ................................................................................................................ 21

For more information .......................................................................................................................... 25

Summary of content (25 pages)

PAGE 1
HP ProtectTools Security Software 2 0 1 0 Technical white paper Ta b le o f co n ten ts Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . .............................................................................................................. 2 HP ProtectTools security software overview ............................................................................................. 2 HP security setup wizard. . . . . . . . . . ...........................................................
PAGE 2
Introduction Data security can have a direct impact on the health of your business, and most businesses rank security among their top concerns. Threats to data security are increasing in magnitude as well as complexity as computers become more mobile and better connected. HP has a rich heritage in enterprise security and started devoting resources to solving the mobile security problem as soon as the trend emerged.
PAGE 3
business notebooks, desktops and workstations under a common architecture and single user interface (Figure 1 ). Figure 1. HP ProtectTools Security Manager Console HP ProtectTools is also centrally manageable at the workgroup or enterprise level using either DigitalPersona Pro W orkgroup or DigitalPersona Pro Enterprise management solutions. Organizations have many security needs, which can create a management challenge.
PAGE 4
Figure 2. HP ProtectTools Administrative Console The HP ProtectTools Security Manager framework allows you to adapt HP ProtectTools functionality through add-on modules as your security needs change. This approach ensures that all new HP ProtectTools security modules introduced over time are highly integrated.
PAGE 5
Login methods can also be selected either individually or in combination to achieve multifactor authentication. The HP ProtectTools Java C ard is a two factor a uthentication method, requiring both possession and a PIN to authenticate. Passwords, fingerprints, and face recognition are single factor authentication methods. To achieve multifactor authentication with these methods, users can use them in combinations such as fingerprint with password.
PAGE 6
Figure 3.
PAGE 7
• File Sanitizer for HP ProtectTools • C omputrace® LoJack Pro for HP ProtectTools o Tracking and recovery requires a fee based subscription and setup. For details and country availability, please visit www. absolute. com/ products/ lojackforlaptops. • Privacy Manager for HP ProtectTools G oing forward, as new needs are identified, HP expects to continue to expand its PC security offerings with additional modules for the HP ProtectTools Security Manager.
PAGE 8
• Support for smart cards (including HP ProtectTools Java C ards), biometric fingerprint security, TPM embedded security chips, USB tokens, virtual tokens and passwords • Single sign-on capability manages and protects passwords for websites, applications and network resources Table 2 shows the features and benefits of C redential Manager for HP ProtectTools. Table 2.
PAGE 9
Figure 5. Key features of HP ProtectTools with DigitalPersona Pro DigitalPersona Pro protects applications and data by simplifying security controls for multiple applications. It provides for strong authentication to boost accountability and deter fraud. It simplifies auditing with comprehensive logging. By consolidating point management tools into one console, organizations are able to automate processes and reduce costs from passwords and provisioning.
PAGE 10
Manager for HP ProtectTools solves that problem. In doing so, it enables a new usage model for personal computing devices. Device Access M anager for HP ProtectTools has two configuration options: Simple C onfiguration (Figure 6 ) and Advanced C onfiguration. Figure 6. Device Access Manager for HP ProtectTools Administrative Console Sim p le Co n f ig u r a tio n The Simple Configuration option is a collection of common options that can be configured with a single selection.
PAGE 11
C onfiguration, Device Access Manager presents a device tree view derived from the W indows Device Manager. Individual devices or a n entire class of devices from the device tree can be selected. Access to the selected device can then be restricted by applying the policy to selected users or class of users.
PAGE 12
Figure 7. Drive Encryption for HP ProtectTools Drive Encryption for ProtectTools is based on McAfee endpoint protection technology. McAfee is a leading provider of powerful encryption and strong access control software that seamlessly integrates with existing standards-based enterprise systems. The hard drive on a new HP Business notebook is unencrypted. The encryption process can be activated by launching HP ProtectTools Security Manager and selecting Drive Encryption for HP ProtectTools.
PAGE 13
or USB storage is disallowed. This means that software designed to bypass the operating system password protection cannot run if the computer is protected using Pre-Boot Security. Enhanced Pre-Boot Security makes it possible to setup multiple users as well as multifactor authentication policies using a password, fingerprint or HP ProtectTools Java C ard. W hile Pre-Boot security has been available for a number of years, it was never designed for multiuser environments.
PAGE 14
N either the answers to the three questions nor the encryption key are stored in memory. The only way to access the encrypted password is to answer the same three questions with exactly the same responses used during initial enrollment. Embedded Security for HP ProtectTools Embedded Security for HP ProtectTools is an add-on module that allows users to configure the TPM embedded security chip (Figure 8 ).
PAGE 15
Table 4 shows Embedded Security for HP ProtectTools features and benefits. Table 4. Embedded Security for HP ProtectTools features and benefits Feature Benefit W orks with HP ProtectTools Security Manager User interface is fully integrated into the HP ProtectTools Security Manager. Increases the functionality of the entire security solution by allowing access to the embedded security chip.
PAGE 16
and passwords. At most sites that require a password, a window pops up over your browser and gives you the option to log in using Face Recognition. HP recommends that a minimum of two factors be used to create a more secure environment. HP ProtectTools has additional authentication options, such as fingerprint authentication, which can be combined with Face Recognition to provide exceptional security.
PAGE 17
Figure 9. HP ProtectTools File Sanitizer setup menu File sanitization is more intensive process than simple file deletion. The amount of time it takes to delete a file or a group of files is in direct relation to their size. File Sanitizer is therefore not a replacement for simple file deletion; it is instead meant to complement it. Free Space Bleaching can also be set up to bleach the hard drive at a predetermined schedule.
PAGE 18
electronic transactions and communications is increasingly required by regulations in finance, law and healthcare applications. Privacy Manager is an HP ProtectTools plug-in, and can be accessed directly from within Microsoft O ffice 2 0 0 7 and Microsoft Live M essenger. O n first use, a wizard will guide you through the process of obtaining a digital certificate.
PAGE 19
environments. W hile that takes care of the security exposure, it a lso prevents the benefits of a very useful communications tool. Privacy Manager for HP ProtectTools adds extensions to MSN Live M essenger to allow for secure communications. W ith Privacy Manager – C hat, a user can continue using MSN Live Messenger, but with additional security. Privacy Mana ger – C hat uses the integrated fingerprint sensor to establish a person’s identity.
PAGE 20
Feature Benefit Backup and restore credentials stored on a user’s Java Card Provides a mechanism to recover from a situation where a user or administrator loses the Java Card Platform Support HP ProtectTools Security Manager is supported across a range of HP business notebooks, desktops and workstations. Table 6 provides details of support for HP business notebooks and desktops. Table 6.
PAGE 21
SF = Standard Feature / O F = O ptional Feature / N = N ot Available HP ProtectTools Support HP ProtectTools Security Manager A A A P Credential Manager for HP ProtectTools A A A P Embedded Security for HP ProtectTools A A A P Java Card Security for HP ProtectTools A A A W Computrace / Lojack for Laptops – for Desktops S S S S A = After Market Option / P = Pre-install / N = N ot Supported S = Supported / W = W eb Release xw4400 xw6400 xw8400 xw9400 Workstation Platforms TPM Em
PAGE 22
A. Currently the following components are available. • HP ProtectTools Security • Embedded Security for HP ProtectTools • File Sanitizer for HP ProtectTools • Privacy Manager for HP ProtectTools W e also currently ship Face Recognition for HP ProtectTools on select models, and LoJack Pro for HP ProtectTools. More modules are planned to be developed and released in the future. Q. W hat authentication technologies are supported by HP ProtectTools? A.
PAGE 23
Q. If a TPM encrypted file is copied moved to a second system which does not have the key to decrypt the file, what would happen to the file. W ould it remain on the second as an unreadable file or would it be automatically deleted? W ould the user of the second system be able to delete the file even if he does not have the decryption keys? Is there a solution to automatically delete such files? A. This depends on the application being used to move data from one system to the other.
PAGE 24
Q. If multiple PCs are used by the same user, can his or her identity be used on the different machines? A. N o, however a user’s credential can be copied in order to be used on another PC. Q. Is Credential Manager supported on non-HP computers? A. Credential Manager for HP ProtectTools requires HP ProtectTools to be present on the system. If the client device is running HP ProtectTools, it will support Credential Manager. Q.
PAGE 25
For more information To learn more about HP ProtectTools, contact your local HP sales representative or visit our website at www. hp. com/ products/ security. © Copyright 2010, 2010 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. N othing herein should be construed as constituting an additional warranty.