Portable secure data and applications on laptops, thumb drives, etc.

Background

Protecting university data is important because of privacy issues, legal requirements (FERPA), financial implications, the need to avoid bad publicity and the need to protect intellectual property. At the request of the IT Security Task Force, the Encrypted Data Storage (EDS) Working Group was formed November 15, 2006  to begin investigation of encryption solutions that could be used to protect the confidentiality and integrity of sensitive university data from accidental or unauthorized disclosure. The proliferation and expanded use of mobile devices at the university has compounded the security risks of unauthorized information disclosure due to theft and loss. Encryption has increasingly become widely accepted as the technology of choice for securing desktops, laptops, tablets, PDAs, and other mobile devices from inadvertent disclosure of sensitive information stored on these devices. It offers an effective solution by providing methods to convert readable cleartext (plaintext) data into ciphertext that obscures the data in such a way as to hide its substance thus rendering the data unreadable without special knowledge. The EDS Working Group will investigate and identify data privacy issues associated with the use of desktop and mobile devices and make recommendations on what steps should be taken to help mitigate the security risks.

Conferences and Research by other Universities

Initiatives by the Federal Government

EDS Working Group

Chair: Frank Galligan eProvisioning

Members: Ismael Alaoui eProvisioning, Phil Benchoff Communications Network Svcs, Brock Burroughs Business and Mgt Systems, Marc Debonis MS Implementation Group, Philip Kobezak IT Security, Kevin Rooney Information Resource Management

Charge

Explore and recommend solutions to prevent accidental or unauthorized disclosure of sensitive university data that resides on desktops and mobile devices.

  1. Identify situations where encryption is or is not appropriate.
  2. Identify methods available for encrypting desktop and mobile device storage.
  3. Recommend baseline requirements for purchasing encryption software.
  4. Recommend commercial, freeware products or native built-in tools. 
  5. Communicate recommendations to the Knowledge Base and 4Help groups.

Note: The project charge is limited to file and disk encryption for protecting sensitive data residing on desktop, laptop computers and portable storage devices or media, such as PDA, smart phones, flash drives, CD and DVD media. It does not extend to secure email, network communication, or servers.  

Meeting Minutes

Where Encryption is Needed

This is just some random thoughts on dealing with data you may want to keep on laptops, thumb drives, or home computers. In general, these systems provide more opportunity for an adversary to get physical access to the hardware. The focus is on encrypted file systems rather than on encrypting individual files or e-mails.

Some of the encrypted file systems may just be snapshots of critical data needed to operate without access to the network:

These data could be replicated from a central image to keep everyone up to date with the critical data. Encrypted files would only need to be large enough to hold the data (since they are "read-only"). Each logical set of data could be in one encrypted volume and a person would only carry the ones he needs.

Types of Encryption

Encryption - The Last Line of Defense - Overview of encryption and why it is needed.

Layers of Encryption

There is a spectrum of system layers where encryption can be used.

System Types

Levels of management

User community

What Problem Are You Trying To Solve?

Here are some of the issues that could be addressed by an encrypted file system.

Features

This is a list of features to consider in any solution. In any particular application, some of them will be required.

Need some thought

Out Of Scope

How To Do It

Full Disk Encryption Info

Trusted Platform Module(TPM) Info

Hardware Encryption

Full Disk Encryption Tools

File, Folder and Virtual Disk Encryption Tools

Other Encryption Tools and Info

Portable Storage Devices

 Managing and Securing Mobile Devices-  Best Practices

Applications and Data

Application List

This list covers applications you may want on a portable file system. The focus is on the stuff you need to operate
short term and not a full environment.

Packaging the data

Updating/Synchronizing the data

Risks

Impact of Data Compromise

Managed

Residual

Here are some risks data may still be subject to:

Leftovers

Stuff to be looked at and put in the right place.

An email from 5 Sep:

http://www.u3.com/

Wikipedia has an entry:

http://en.wikipedia.org/wiki/List_of_portable_software

Some sites offering portable freeware and/or shareware:

http://www.portablefreeware.com/resources.php

http://digg.com/software/Very_Best_Free_Portable_Software_for_Windows

http://www.programurl.com/software/portable.htm

http://www.lifehacker.com/software/portable-applications/

http://portableapps.com/ (this was in the earlier message, repeated here for com
pleteness)

http://www.portasoft.org/e107/news.php

Securing your portable key:

http://www.dekart.com/howto/howto_disk_encryption/howto_portable_software/

http://www.keynesis.com/products/lockngo-pro/

A Linux distribution that runs from a USB key:

http://www.flashlinux.org.uk/

Some specific apps:

Text Editor:
http://www.editpadpro.com/portable.html

Email:
Poco PE:
http://www.pocosystems.com/home/index.php?option=content&task=category&sectionid
=2&id=13&Itemid=29

Thunderbird:
http://portableapps.com/apps/internet/thunderbird_portable

Web Browsers:
http://portableapps.com/apps/internet/firefox_portable/test
http://www.kejut.com/operaportable
http://www.opera-usb.com/operausben.htm

OpenOffice.org
http://johnhaller.com/jh/useful_stuff/portable_openoffice/

GIMP (Open Source Photoshop-like image editor):
https://sourceforge.net/projects/portablegimp/

From Unisog:

Date: Fri, 10 Nov 2006 16:14:53 -0500
From: George Farah <george.farah@QUEENSU.CA>
Reply-to: The EDUCAUSE Security Discussion Group Listserv <SECURITY@LISTSERV.EDUCAUSE.EDU>
To: SECURITY@LISTSERV.EDUCAUSE.EDU
Subject: Re: [ED-SEC] Whole Disk Encryption Tools

For encrypting hard drives on laptops, either SafeGuard of SecureDoc
would work, but the SecureDoc product promises to work with all
Anti-Virus products, and it is the only product at FIPS 140-1 level 2.
It is also the only product approved by the NSA for protecting Secret
material, and it's the only product to meet the Homeland Security
Directive 12, FIPS 201.