McAfee DFFCDE-AA-DA - Endpoint Encryption For Files User manual

McAfee Endpoint Encryption for Files and Folders

4.0.0

Product Guide

No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form

or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies.

TRADEMARK ATTRIBUTIONS

AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE

EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN,

WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in

connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property

of their respective owners.

LICENSE INFORMATION

License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED,

WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH

TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS

THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET,

A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU

DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN

THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide2

Contents

Introducing McAfee Endpoint Encryption for Files and Folders.......................5

WhyEEFF?................................................................................5

How EEFF 4.0 works........................................................................5

EEFF Features.............................................................................6

System requirements.......................................................................6

About this guide...........................................................................7

Installing EEFF..............................................................................8

Installing EEFFusingePO....................................................................8

CheckingintheEEFFdeploymentpackage...............................................8

Installing EEFF extension.............................................................9

Installing the ePO help extension......................................................9

Registering an LDAP Server...........................................................9

Deploying EEFF on managed nodes using ePO 4.5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Deploying EEFF on managed systems using ePO 4.6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Uninstalling EEFF.........................................................................12

Uninstalling EEFF from managed nodes.......................................................12

Uninstalling EEFF from managed nodes using ePO 4.6. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Removing the EEFF extension...............................................................13

Removing EEFF deployment package.........................................................14

Uninstalling EEFF from managed nodes using command prompt. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Uninstalling EEFF from managed nodes using Shell command. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Uninstalling EEFF from managed nodes using MSI. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

Configuring EEFF policies using ePO....................................................16

EEFF Policies.............................................................................16

Creating a policy from Policy Catalog.........................................................20

Editing the EEFF policy settings from Policy Catalog. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Assigning policies to a system or a system group...............................................21

Assigning a policy to a managed node.................................................21

Assigning a policy to a system group..................................................21

Enforcing EEFF policies on a system..........................................................22

EnforcingEEFF policies on asystemgroup.....................................................22

3McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide

How Policy Assignment Rules work...........................................................23

Policy assignment rule priority........................................................23

Working with policy assignment rules..................................................24

Howmulti-slotpolicieswork.................................................................25

Assigning multiple instances of Grant Key policy through System Tree. . . . . . . . . . . . . . . . . . . . . . . 25

Assigning Grant key policy through policy assignment rule. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Viewing effective policy assigned to systems............................................28

Viewing effective policy assigned to users..............................................28

Managing EEFF keys......................................................................30

Creating a regular key.....................................................................30

Activatingordeactivatingkeys...............................................................31

Assigningkeystoapolicy...................................................................31

Editing a key.............................................................................31

Deleting keys.............................................................................32

Exporting keys............................................................................32

Importing keys...........................................................................32

How user personal keys work...............................................................33

Working with user personal keys......................................................33

Managing EEFF Reports..................................................................35

Creating EEFF custom queries...............................................................35

Viewing the standard EEFF queries...........................................................36

Defining EEFF permission sets for ePO users..........................................38

Creatingpermissionsetsforuseraccounts.....................................................38

Editing EEFF Policy Permissions..............................................................38

EditingEEFFKey Server permissions..........................................................39

Appendix A: Removable Media registry controls......................................40

Relaxing the Removable Media definition......................................................40

Exempt local drives and network shares from encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

Appendix B: Best Practices..............................................................42

McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide4

Contents

Introducing McAfee Endpoint Encryption for

Files and Folders

McAfee Endpoint Encryption for Files and Folders (EEFF) offers data protection in the form of

powerful encryption technology so that only authorized users can access information.

Contents

Why EEFF?

How EEFF 4.0 works

EEFF Features

System requirements

About this guide

Why EEFF?

EEFF offers enhanced security to protect your data. EEFF depends on Microsoft Windows user

accounts and works in real-time to authenticate user to access encryption keys and to retrieve

the correct policy in EEFF. A smart card implementation based on Windows logon can be used

for enhanced security.

Endpoint Encryption for Files and Folders allows you to define and protect information in a way

that only certain users can access it. This data is stored, managed, archived, and distributed

as any other file is, however, it can be viewed only by those who have been granted access.

Endpoint Encryption for Files and Folders is a Persistent Encryption engine: when a file has

been encrypted and has been moved or copied to another place, it remains encrypted. If a file

is moved out of an encrypted directory, it will also remain encrypted. Likewise, if an encrypted

file is moved to a memory stick – the encryption will remain in place.

EEFF integrates with McAfee ePolicy Orchestrator (ePO), which provides a single point of control

over all the data on the systems. EEFF with ePO supports both user-based and system-based

policies. Assigning these policies to users encrypts the data on the client as configured.

EEFF depends on Microsoft Windows credentials therefore, both registered domain users and

local system users can be assented encryption policies and associated keys.

How EEFF 4.0 works

EEFF encrypts folders and files according to policies assigned to the user. These policies are

enforced by the ePO server.

5McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide

The client software is installed on the client system. After the installation, the system synchronizes

with the ePO server and acquires the user data. EEFF then assigns encryption policies and keys

to the user as configured.

EEFF client acts like a filter between the application creating or editing the files and the storage

media. When a file is saved, EEFF filter executes the assigned encryption policies and encrypts

the data, if applicable. If the user manages to kill the main EEFF process on the client system,

EEFF encrypts folders and files according to policies assigned to the user. These policies are

enforced by the ePO server.

The client software is installed on the client system. After the installation, the system synchronizes

with the ePO server and acquires the user data. EEFF then assigns encryption policies and keys

to the user as configured.

The EEFF client acts like a filter between the application creating or editing the files and the

storage media. When a file is saved, the EEFF filter executes the assigned encryption policies

and encrypts the data, if applicable. If the user manages to kill the main EEFF process

(MfeffCore.exe) on the client system, attempting to deviate from the assigned encryption policy,

the process will be automatically regenerated. The automatic restart cannot be disabled.

When a file that is encrypted with key A is moved to a folder where files are encrypted with

key B, the file encrypted with key A will immediately be re-encrypted with key B. This behavior

is known as

follow-target-encryption

and requires that the user or process transferring the file

has access to both key A and key B. This operation takes place instantly when the file is placed

in the folder encrypted with key B.

EEFF Features

•Centralized management — Provides support for deploying and managing McAfee Endpoint

Encryption for Files and Folders using ePO 4.5 and 4.6.

•Windows authentication based policy enforcement — Assigns encryption policies and

keys to Windows user accounts.

•Integration with the McAfee Tray icon - Consolidates the tray icons to one common

McAfee icon.

•User Personal Keys - Allow users to have individual keys, generated centrally and possible

to assign in policies for encryption.

•Protect data on Removable media — Provides support for removable media encryption.

•Migration from EEFF v3.x to EEFF v4 - Provides support for migrating keys from EEFF

v3.x to EEFF v4 by importing them into ePO.

•File Extension exclusion - Excludes the listed file types from encryption. For example,

MP3 and WAV files.

System requirements

RequirementsSystems

See McAfee ePolicy Orchestrator 4.5 and 4.6 - Installation GuideePO Server Systems

Introducing McAfee Endpoint Encryption for Files and Folders

EEFF Features

McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide6

Software requirements

RequirementsSoftware (or package name)

McAfee management software • ePO 4.5 (minimum patch 4) and 4.6

• McAfee Agent for Windows 4.5 (minimum Patch 2) and 4.6

Endpoint Encryption for Files and Folders • EEFF Extension

• EEFF_4.0.0_xxx.ZIP

• help_eeff_400.ZIP

• MfeEEFF_Client_4.0.0.x.ZIP

See McAfee ePolicy Orchestrator 4.5 and 4.6 - Installation GuideMicrosoft “Windows Installer 3.0

Redistributable” package ( for ePO)

See McAfee ePolicy Orchestrator 4.5 and 4.6 - Installation GuideMicrosoft “.NET Framework 2.0

Redistributable” package ( for ePO)

See McAfee ePolicy Orchestrator 4.5 and 4.6 - Installation GuideMicrosoft MSXML 6 ( for ePO)

Operating system requirements

SoftwareSystems

See McAfee ePolicy Orchestrator 4.5 and 4.6 - Installation GuideePO Server Systems

Client Systems • Microsoft Windows Vista (32-bit) SP 2

• Microsoft Windows XP (32-bit) SP 3

• Microsoft Windows 7 (32-bit and 64-bit) SP 0 and SP 1

About this guide

This guide provides information on detailed instructions for managing the McAfee Endpoint

Encryption for Files and Folders 4.0 client.

Target audience

This guide is mainly intended for McAfee Endpoint Encryption for Files and Folders users.

Introducing McAfee Endpoint Encryption for Files and Folders

About this guide

7McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide

Installing EEFF

This chapter describes how to install EEFF using McAfee ePolicy Orchestrator management

software version 4.5 and 4.6. To use this chapter effectively, you need to be familiar with ePO.

NOTE: This document does not provide detailed information about installing or using ePO. See

the McAfee ePolicy Orchestrator product documentation for more information.

Installing EEFF using ePO

The ePO server provides a scalable platform for centralized policy management and enforcement

of EEFF on the managed nodes. It also provides comprehensive reporting and product

deployment capabilities, all through a single point of control.

Tasks

Checking in the EEFF deployment package

Installing EEFF extension

Installing the ePO help extension

Registering an LDAP Server

Deploying EEFF on managed nodes using ePO 4.5

Deploying EEFF on managed systems using ePO 4.6

Checking in the EEFF deployment package

Use this task to check in the EEFF deployment package to the master repository.

Task

For option definitions, click ?in the interface.

1Copy the MfeEEFF_Client_4.0.0.x archive to a temporary location of your ePO computer.

2Log on to the ePO server as an administrator.

3Click Menu |Software |Master Repository, then click Actions |Check In Package.

The Check In Package wizard appears.

4In the Package page, select the Package type as Product or Update (.ZIP) and browse

in File path to locate MfeEEFF_Client_4.0.0.x saved in a temporary folder.

5Click Next. The Package Options page appears with the package information.

6Click Save.

McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide8

Installing EEFF extension

Use this task to install the EEFF extension. The extension file is in .ZIP format.

Task

For option definitions, click ?in the interface.

1Copy the EEFF_4.0.0_xxx archive to a temporary location of your ePO computer.

2Log on to the ePO server as an administrator.

3Click Menu |Software |Extensions |Install Extension. The Install Extension dialog

box appears.

4Click Browse to locate the extension file EEFF_4.0.0_xxx, then click OK. The Install

Extension page appears with the extension name and version details.

5Click OK.

Installing the ePO help extension

You can install the ePO help extension separately on the ePO 4.5 and 4.6 server using the

Software tab. The Help extension is a .ZIP file.

Task

For option definitions, click ?in the interface.

1Log on to the ePO server as an administrator.

2Click Menu |Software |Extensions |Install Extension. The Install Extension dialog

box appears.

3Click Browse, then select the extension file help_eeff_400.ZIP, then click OK. The

Install Extension page appears with the extension name and version details.

4Click OK.

Registering an LDAP Server

Use this option to register an LDAP Server such as Microsoft Active Directory (AD). You must

have a registered Active Directory to use Policy Assignment Rules, to enable dynamically assigned

permission sets, and automatic user account creation.

Before you begin

Make sure you have the appropriate rights to modify server settings, permission sets, users,

and registered servers.

Task

For option definitions, click ?in the interface.

1Log on to the ePO server as an administrator.

2Click Menu |Configuration |Registered Servers, then click New Server. The

Registered Server Builder wizard opens.

3From the Server type drop-down list on the Description page, select LDAP Server, specify

a unique name (a user friendly name) and any details, then click Next. The Details page

appears.

Installing EEFF

Installing EEFF using ePO

9McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide

4Type the Domain name or the Server name.

NOTE: Use DNS-style domain name. While using DNS-style domain name, ensure that the

system is configured with appropriate DNS setting and can resolve the DNS-style domain

name of the Active Directory. The Server name is the name or IP address of the system

where the Windows Active Directory is present.

5Type the User name and Password.

NOTE: The User name should be of the format: domain\Username of Active Directory

accounts.

6Click Test Connection to ensure that the connection to the server works, then click Save.

Deploying EEFF on managed nodes using ePO 4.5

Use this task to deploy EEFF on the managed nodes. ePO allows you to create tasks to deploy

product on a single node, or on groups of the system tree.

Task

For option definitions, click ?in the interface.

1Log on to the ePO server as an administrator.

2Click Menu |Systems |System Tree |Client Tasks, select the required group in the

System Tree, then click Actions |New Task. The Client Task Builder wizard appears.

3In the Description page, type a Name for the task, Notes (optional), select the Type as

Product Deployment, then click Next.

4In the Configuration page, select Target Platforms as Windows,Products and

components as McAfee Endpoint Encryption for Files and Folders 4.0.0.0,Action

as Install. Select an appropriate Language, then click Next.

5Schedule the task to run immediately or as required, then click Next to view a summary

of the task.

6Review the summary of the task, then click Save. The task is added to the list of client

tasks for the selected group and any group that inherits the task.

7Send an agent wake-up call.

Deploying EEFF on managed systems using ePO 4.6

Use this task to deploy EEFF to groups of managed systems in the System Tree.

Task

For option definitions, click ?in the interface.

1Click Menu |Policy |Client Task Catalog , select McAfee Agent |Product

Deployment as Client Task Types, then click Actions |New Task . The New Task dialog

box appears.

2Ensure that Product Deployment is selected, then click OK.

3Type a name for the task you are creating and add any notes.

4Select Target Platforms as Windows,Products and components as McAfee Endpoint

Encryption for Files and Folders 4.0.0.0,Action as Install. Select an appropriate

Language

Installing EEFF

Installing EEFF using ePO

McAfee Endpoint Encryption for Files and Folders version 4.0.0 Product Guide10

This manual suits for next models

Table of contents

Other McAfee Software manuals

McAfee

McAfee DR SOLOMON S ANTI-VIRUS 8.5 User manual

McAfee

McAfee VIRUSSCAN 5.1 User manual

McAfee

McAfee GSSCDE-AA-DA - GroupShield Security Suite User manual

McAfee

McAfee Agent 4.0 Instruction Manual

McAfee

McAfee UNINSTALLER 6.0 User manual

McAfee

McAfee VSMCDE-AA-AA - VirusScan Mobile - PC User manual

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 1 - S... Instruction Manual

McAfee

McAfee WEBSHIELD SMTP User manual

McAfee

McAfee MIS09EMB3RAA - Internet Security 2009 User manual

McAfee

McAfee INTERNET SECURITY 2008 User manual

McAfee

McAfee PSMCDE-AB-AA - PortalShield For Microsoft SharePoint Server External Connection... User manual

McAfee

McAfee NETSHIELD - FOR NETWARE SERVERS User manual

McAfee

McAfee TOTAL PROTECTION 2009 User manual

McAfee

McAfee AGENT 4.0 PATCH 2 - FOR WINDOWS S 10-03-2009 Instruction Manual

McAfee

McAfee VIRUSSCAN ENTERPRISE 8.7I PATCH 3 - S... Instruction Manual

McAfee

McAfee DR SOLOMON S ANTI-VIRUS 8.5 Service manual

McAfee

McAfee VIRUSSCAN 8.7I Instruction Manual

McAfee

McAfee VIRUSSCAN 5.1 User manual

McAfee

McAfee VIRUSSCAN PLUS 2008 User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.5 - User manual

McAfee

McAfee INTERNET SECURITY 2010 User manual

McAfee

McAfee QUICKCLEAN 1.0 User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 4.0.2 - User manual

McAfee

McAfee EPOLICY ORCHESTRATOR 3.6 - WALKTHROUGH GUIDE User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual