(Presented by Eric Nobel) Disk & File Encryption Rob Bandler 21 June 2016 (Presented by Eric Nobel)

Agenda Introductions Service Description Value Proposition Metrics Costs Security More Information Q&A

Introductions Service owner: Rob Bandler Service manager: Eric Nobel Other service delivery team members: Meryl Bursic Lillian Isacks Tim Bradish, Tom Horton, Glenn Larratt Kris Barth, Pete Caforio (Desktop Engineering)

Service Description Service name: Disk & File Encryption Product(s): Windows devices: Microsoft BitLocker Administration and Monitoring (MBAM) via Configuration Manager 2012 (CM2012) or standalone BitLocker Macintosh devices: FileVault2 via Casper or standalone FileVault2 Pretty Good Privacy (PGP) (sunsets October 2016) Brief text description: Disk and file encryption is available to all faculty, staff, and students at no cost for both major platforms (Windows and Macintosh) and both institutionally- and personally-owned devices. Encryption is the process of scrambling data to make it unreadable to anyone who does not possess the proper key Available to: MBAM – CM2012 subscribers only via their Technical Support Provider (TSP) FileVault2 via Casper – Casper subscribers only via their TSP MBAM, BitLocker and FileVault2 (standalone) - all Faculty, Staff, TSPs, and Students Fee? No Service tier: One

Value Proposition Value proposition Customer impact Key benefits Mitigates risk of unauthorized data access in the event of asset loss Campus site license for MBAM – no additional fee Native/free solutions for non-Cornell owned &/or non-managed/personally owned devices Customer impact Little to no impact on functionality Improved security of data Key benefits Saving institutional money & improved data security in the event of asset loss Provides compliance with Cornell University Policy 5.10 “Information Security” Ease of use, reliability, and maintainability will be vastly better with the native solutions Flexible models for standalone, managed, or unmanaged devices

Metrics FY16 Q3 FY 16 Q3 Metrics User/Unit* 2,965 Service & Support Hours 58 Customer Contacts (questions, requests, etc…) 6 Availability 100% Changes (upgrades, patches, etc.) 2 600 - Casper/FileVault2 (now @ 639) 956 - CM/MBAM (now there are 925 fully encrypted) = 1556 1409 – PGP (376 unique users and 442 unique host names/devices) Q3 total = 2965 MBAM server reports 1462 devices, 1295 of which are Compliant with deployed policies the primary reasons for non-compliant are: “System Partition not available or large enough” and “Unable to find compatible TPM” CURRENT TOTOAL DEVICES ENCRYPTED ACROSS ALL PRODUCTS = 3301 * NOTE: User/Unit = devices encrypted with PGP or BitLocker

Current Costs Cost to deliver the current service: FY 16 Total Cost $64,156 Hardware & Software $16,091 Labor $42,233 Staff Support $2,916 Administrative Overhead $21.63 per encrypted device Cost per device: $21.63 Fee for service: No

Future Costs Cost to deliver the service: Cost per device: $16.41 FY 17 Estimated Cost $48,657 Hardware $2,000 Labor $42,233 Staff Support $2,212 Administrative Overhead $16.41 per encrypted device Cost / device continues to go down as more user get onboard with the central encryption services $14.74 per encrypted device based on current number of encrypted devices and estimated costs….will continue to change.... Cost per device: $16.41 Fee for service: No

Security What risks does use of the service mitigate? Financial loss Reputational harm Information security and data loss How does the service mitigate risks? Secure/consistent default Group Policy Object (GPO) configuration provided Makes data access by outsiders virtually impossible in the event of asset loss

More Information Service web page: Service level expectations: http://www.it.cornell.edu/services/bitlocker/ http://www.it.cornell.edu/services/filevault/ http://www.it.cornell.edu/services/pgp/ Start here: http://www.it.cornell.edu/services/ and click on “Security” Service level expectations: https://www.it.cornell.edu/services/sle.cfm?doc=73 Service catalog entry: https://catalog.it.cornell.edu/admin/21 Service quarterly report: http://cio.cornell.edu/resources/it-reports-documents-and-presentations/itcornell-quarterly-metrics/disk-and-file

More Information

Questions?