Data Exchange (Removeable Media Encryption)

Hi Rob,

Joel is quite right in that if you use auto encryption then you face the problem that storage on mobile devices maybe automatically encrypted too.

There are a couple of ways around this...

1. Using Sophos End-Point protection 'Device Control' you can block all removable media storage devices, and then whitelist based on Vendor ID of the devices or the unique ID of the device.

This way you can allow devices of a particular model or specific individual devices. However you'd be blocking the non-exempt devices from connecting and transferring data. This might be a good thing though as you'd be a step closer to safeguarding against Data Leakage.

Then as soon as an exempted device connects and data is transfered to it SGN (SafeGuard Enterprise) would automatically encrypt the data (provided you have the SGN policies set correctly), even when using Explorer.

NB: End-Point protection policies are machine based and not user based, so they aren't as flexible as the next option:

2. Using Configuration Protection in SGN.

Not only are CP policies assigned to users, but you can block all storage devices and create different whitelists. For example, you could create a whitelist for 'Mobile phone storage' and place the model or unique ID of the storage cards of the phones into this list, and create another whitelist for 'USB sticks'.

Then create a DX (Data Exchange) policy in SGN to automatically encrypt and point this policy to the 'USB sticks' whitelist.

This way everything listed in the 'Mobile phone storage' whitelist will be allowed to transfer data, and everything listed in the 'USB sticks' whitelist will allow data transfer but be automatically encrypted using the encryption key you specify in the policy. Just remember data leakage for the mobiles though ;)

NB: Auto encryption only works on SGN enabled machines. Although SafeGuard Portable will nag a user is they eject a device with new unencrypted data on it, and give them a chance to correct this by encrypting the data.

Obviously creating various policies and assigning them to different user groups / OU's etc. will give you more flexibility.

I can't remember the versions but this functionality in Configuration Protection and Data Exchange was only introduced in the later versions.

Also, if you're considering using Configuration Protection then I'd suggest fully testing it first. Personally I've found numerous defects in Configuration Protection which take a very long time to get resolved as it's a product made by SafeEnd and licensed to Sophos as a feature in the SGN suite.

Good luck!

John

P.S. If you also go down the route of using Data Control in Sophos End-Point protection to control data leakage you  need to be aware that data copied to USB sticks etc. must be copied using the Windows Explorer process and not an application. So saving data directly to a USB stick from Microsoft Word won't work as End-Point protection will block it and moan that you need to user Explorer. - Thus you would need to save to the file system on the machine / server and then use Windows Explorer to COPY (not move) the data to the USB stick.

I think this is because Data Control in End-Point hooks into the Malware scanning engine and wants to be able to read the data (to check against it's policies) before it allows the data to be written to removable media.

Just thought I'd point this out - seeing as you are looking at the Sophos suite.

P.P.S. Now if only SGN DX worked for Apple Mac OSX ;)

Hi Rob,

Joel is quite right in that if you use auto encryption then you face the problem that storage on mobile devices maybe automatically encrypted too.

There are a couple of ways around this...

1. Using Sophos End-Point protection 'Device Control' you can block all removable media storage devices, and then whitelist based on Vendor ID of the devices or the unique ID of the device.

This way you can allow devices of a particular model or specific individual devices. However you'd be blocking the non-exempt devices from connecting and transferring data. This might be a good thing though as you'd be a step closer to safeguarding against Data Leakage.

Then as soon as an exempted device connects and data is transfered to it SGN (SafeGuard Enterprise) would automatically encrypt the data (provided you have the SGN policies set correctly), even when using Explorer.

NB: End-Point protection policies are machine based and not user based, so they aren't as flexible as the next option:

2. Using Configuration Protection in SGN.

Not only are CP policies assigned to users, but you can block all storage devices and create different whitelists. For example, you could create a whitelist for 'Mobile phone storage' and place the model or unique ID of the storage cards of the phones into this list, and create another whitelist for 'USB sticks'.

Then create a DX (Data Exchange) policy in SGN to automatically encrypt and point this policy to the 'USB sticks' whitelist.

This way everything listed in the 'Mobile phone storage' whitelist will be allowed to transfer data, and everything listed in the 'USB sticks' whitelist will allow data transfer but be automatically encrypted using the encryption key you specify in the policy. Just remember data leakage for the mobiles though ;)

NB: Auto encryption only works on SGN enabled machines. Although SafeGuard Portable will nag a user is they eject a device with new unencrypted data on it, and give them a chance to correct this by encrypting the data.

Obviously creating various policies and assigning them to different user groups / OU's etc. will give you more flexibility.

I can't remember the versions but this functionality in Configuration Protection and Data Exchange was only introduced in the later versions.

Also, if you're considering using Configuration Protection then I'd suggest fully testing it first. Personally I've found numerous defects in Configuration Protection which take a very long time to get resolved as it's a product made by SafeEnd and licensed to Sophos as a feature in the SGN suite.

Good luck!

John

P.S. If you also go down the route of using Data Control in Sophos End-Point protection to control data leakage you  need to be aware that data copied to USB sticks etc. must be copied using the Windows Explorer process and not an application. So saving data directly to a USB stick from Microsoft Word won't work as End-Point protection will block it and moan that you need to user Explorer. - Thus you would need to save to the file system on the machine / server and then use Windows Explorer to COPY (not move) the data to the USB stick.

I think this is because Data Control in End-Point hooks into the Malware scanning engine and wants to be able to read the data (to check against it's policies) before it allows the data to be written to removable media.

Just thought I'd point this out - seeing as you are looking at the Sophos suite.

P.P.S. Now if only SGN DX worked for Apple Mac OSX ;)