UNM Encryption Services in Development June 8 – 9, 2017

Overview of the Encryption Service in Development at UNM Focus of this presentation Overview of Current Encryption Services Why do we need Encryption? Types of Encryption Services at UNM Encryption Services for testing Possible Encryption Solutions Q and A

Defining Encryption for this Presentation This presentation is going to focus on full disk encryption using Bitlocker.

Why do we need Encryption? Compliance HIPAA FERPA PII Research Sensitive Data (Export Control, ITAR, Research Integrity) Safeguard Privacy Protect Data Secure Intellectual Property

Type of Encryption Service at UNM Symantec Encryption Desktop Disk and File Encryption for Linux, Windows, & MacOS FileVault Full Disk Encryption for MacOS BitLocker Full Disk Encryption for Windows Self Encrypting Drives

Symantec Encryption Desktop Strengths and Weaknesses File and Disk Level Encryption Cross platform support Can use Passphrase or public and private encryption key pair Keys are managed and monitored. Weaknesses: Not fully tested with macOS Sierra Not Native to any Operating System (OS) There is a additional dollar cost High Learning Curve for End users Setup is not intuitive Initial Encryption is slow because it is not native to the OS

MacOS FileVault Strengths and Weaknesses Native MacOS Easy to implement Full Disk Encryption Additional users can be added easily to use the same device Weaknesses: Disk level encryption Does not encrypt boot camp partition Slow Encryption Not Centrally Managed Cannot encrypt Windows drives

Encryption Services for testing Microsoft BitLocker Administration and Monitoring (MBAM) Recovery keys are stored in a secured central database Web portal allows for self-services and help desk unlock Unlocks will reset TPM and generate a new recovery key Encryption settings are controlled by GPO Reporting of device compliance and recovery is managed by SCCM MBAM client must be installed prior to encryption Devices that are already encrypted using BitLocker will need to be re-encrypted after installing the client and applying GPO

Encryption Services for testing BitLocker Cannot be used for file level encryption.  Only encrypts disk at rest, useful for guarding against theft and lost desktops/laptops Native disk encryption since Windows Vista Supports operating system, fixed and removable drives Trusted Platform Module (TPM) Pin or password Removable USB key Cypher strengths AES 128bit AES 256bit XTS-AES 128bit (Windows 10 build 1511 or newer) XTS-AES 256bit (Windows 10 build 1511 or newer)

Microsoft BitLocker Strengths and Weaknesses Native support in Windows OS Multiple ways to decrypt the disk Little to no impact to disk performance on modern systems Computer can be encrypted during imaging using SCCM No cost since it is part of our Microsoft Campus Agreement Centrally Managed Weaknesses: Does not support file level encryption TPM not required but needed to ensure best security Removable disk can only be used on Windows computers Not supported for BootCamp Cannot encrypt Linux or MacOS drives

BitLocker Demo First, create the BitLocker GPO and link it to the OUs you want to use BitLocker encryption. A BitLocker GPO is available in our MODEL OU for you to reference.

BitLocker Demo Install the MBAM client. 32bit or 64bit client versions available The MBAM client will be available in SCCM Software Center

What happens when you have to recover the key? BitLocker Demo What happens when you have to recover the key?

BitLocker Demo Two Portals for recovery Help desk portal: https://bitlocker.unm.edu/helpdesk Self service portal: https://bitlocker.unm.edu/SelfService/

Help desk portal: https://bitlocker.unm.edu/helpdesk BitLocker Demo Help desk portal: https://bitlocker.unm.edu/helpdesk

Self service portal: https://bitlocker.unm.edu/SelfService/ BitLocker Demo Self service portal: https://bitlocker.unm.edu/SelfService/

Now we can enter our recovery key BitLocker Demo Now we can enter our recovery key

SCCM can report compliance of systems that use MBAM and BitLocker BitLocker Demo SCCM can report compliance of systems that use MBAM and BitLocker

Q and A