1. UNM Encryption Services in Development
June 8 – 9, 2017

2. Overview of the Encryption Service in Development at UNM
Focus of this presentation
Overview of Current Encryption Services
Why do we need Encryption?
Types of Encryption Services at UNM
Encryption Services for testing
Possible Encryption Solutions
Q and A

3. Defining Encryption for this Presentation
This presentation is going to focus on full disk encryption using Bitlocker.

4. Why do we need Encryption?
Compliance
HIPAA
FERPA
PII
Research Sensitive Data (Export Control, ITAR, Research Integrity)
Safeguard Privacy
Protect Data
Secure Intellectual Property

5. Type of Encryption Service at UNM
Symantec Encryption Desktop
Disk and File Encryption for Linux, Windows, & MacOS
FileVault
Full Disk Encryption for MacOS
BitLocker
Full Disk Encryption for Windows
Self Encrypting Drives

6. Symantec Encryption Desktop Strengths and Weaknesses
File and Disk Level Encryption
Cross platform support
Can use Passphrase or public and private encryption key pair
Keys are managed and monitored.
Weaknesses:
Not fully tested with macOS Sierra
Not Native to any Operating System (OS)
There is a additional dollar cost
High Learning Curve for End users
Setup is not intuitive
Initial Encryption is slow because it is not native to the OS

7. MacOS FileVault Strengths and Weaknesses
Native MacOS
Easy to implement
Full Disk Encryption
Additional users can be added easily to use the same device
Weaknesses:
Disk level encryption
Does not encrypt boot camp partition
Slow Encryption
Not Centrally Managed
Cannot encrypt Windows drives

8. Encryption Services for testing
Microsoft BitLocker Administration and Monitoring (MBAM)
Recovery keys are stored in a secured central database
Web portal allows for self-services and help desk unlock
Unlocks will reset TPM and generate a new recovery key
Encryption settings are controlled by GPO
Reporting of device compliance and recovery is managed by SCCM
MBAM client must be installed prior to encryption
Devices that are already encrypted using BitLocker will need to be re-encrypted after installing the client and applying GPO

9. Encryption Services for testing
BitLocker
Cannot be used for file level encryption. 
Only encrypts disk at rest, useful for guarding against theft and lost desktops/laptops
Native disk encryption since Windows Vista
Supports operating system, fixed and removable drives
Trusted Platform Module (TPM)
Pin or password
Removable USB key
Cypher strengths
AES 128bit
AES 256bit
XTS-AES 128bit (Windows 10 build 1511 or newer)
XTS-AES 256bit (Windows 10 build 1511 or newer)

10. Microsoft BitLocker Strengths and Weaknesses
Native support in Windows OS
Multiple ways to decrypt the disk
Little to no impact to disk performance on modern systems
Computer can be encrypted during imaging using SCCM
No cost since it is part of our Microsoft Campus Agreement
Centrally Managed
Weaknesses:
Does not support file level encryption
TPM not required but needed to ensure best security
Removable disk can only be used on Windows computers
Not supported for BootCamp
Cannot encrypt Linux or MacOS drives

11. BitLocker Demo
First, create the BitLocker GPO and link it to the OUs you want to use BitLocker encryption.
A BitLocker GPO is available in our MODEL OU for you to reference.

14. BitLocker Demo Install the MBAM client.
32bit or 64bit client versions available
The MBAM client will be available in SCCM Software Center

16. What happens when you have to recover the key?
BitLocker Demo
What happens when you have to recover the key?

18. BitLocker Demo Two Portals for recovery Help desk portal:
Self service portal:

19. Help desk portal: https://bitlocker.unm.edu/helpdesk
BitLocker Demo
Help desk portal:

24. Self service portal: https://bitlocker.unm.edu/SelfService/
BitLocker Demo
Self service portal:

28. Now we can enter our recovery key
BitLocker Demo
Now we can enter our recovery key

30. SCCM can report compliance of systems that use MBAM and BitLocker
BitLocker Demo
SCCM can report compliance of systems that use MBAM and BitLocker

32. Q and A