User manual SOPHOS SAFEGUARD DISK ENCRYPTION 4.60 HELP 6-2009

[. . . ] Sophos SafeGuard® Disk Encryption 4. 60 help Document date: June 2009 Contents 1 2 3 4 5 6 7 8 9 Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Getting started. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Local installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Central installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Users often tend to use the same passwords, or trivial passwords, such as their first or last names, company names, sequences of letters or numbers, etc. If a Sophos SafeGuard Disk Encryption password is too obvious it makes it easier for unauthorized outsiders to access a workstation. Careful consideration is needed to agree the strategy for defining how consistently password restrictions are to be applied, and they should also be tested before being implemented. 15. 1 Pre-defined password rules For security reasons Sophos SafeGuard Disk Encryption predefines several rules for all user passwords. A Sophos SafeGuard Disk Encryption password can have a maximum number of 16 characters. A Sophos SafeGuard Disk Encryption password is rejected, if more than 50% of it consists of the same character (for example "aaabba", "222122"). it contains characters in sequence (for example "abcdef ", "1234567"). it is identical to the Sophos SafeGuard Disk Encryption user name (except password for user "SYSTEM"). it is significantly similar to the Sophos SafeGuard Disk Encryption user name (except password for user "SYSTEM"). "Significantly similar" in this context means that the character sequence of the new password differs from the character sequence of the user name/old password by less than 20% . For example, the Sophos SafeGuard Disk Encryption user "USER" is allowed to use the password "U2SER13", "U345SER" etc. , but Sophos SafeGuard Disk Encryption does not accept passwords like "USER1", "USER2", "USERab", "12USER", "1USERF" etc. 76 Sophos SafeGuard® Disk Encryption 4. 60, help 15. 2 Permitted keys for the Sophos SafeGuard Disk Encryption password The Sophos SafeGuard Disk Encryption password can consist of a mixture of alphanumeric characters and punctuation marks. Sophos SafeGuard Disk Encryption accepts all the keys marked with "*" in the figure. The Shift key and Caps Lock key (marked with "#" in the figure). Sophos SafeGuard Disk Encryption does not accept the Shift key, if the Caps Lock key is already pressed. the Alt key the Ctrl key the Num number keys the F keys (for example, F1, F2) the direction keys 15. 3 Configuring Sophos SafeGuard Disk Encryption for use in international environments Sophos SafeGuard Disk Encryption stores all character strings in "scan code" form since, usually, no keyboard drivers are loaded in the Pre-Boot phase. The scan code is a code number (hexadecimal scan code) which the keyboard returns to the PC when a key is pressed. This code is independent of which letters, numbers or symbols are mapped to the key. It is a special identifier for the key itself, and is always the same for a particular key. 77 Sophos SafeGuard® Disk Encryption 4. 60, help 15. 3. 1 The effects of different keyboard layouts As Sophos SafeGuard Disk Encryption stores all the character strings in "scan code" form, the scan code sequence for example for the password "system" on a US keyboard layout is: 1f-15-1f-14-1232. . The scan code sequence for "system" on a German keyboard layout is: 1f-2d-1f-14-12-32. Hint: Y and Z are swapped round!A German-language user would therefore have to enter "szstem" to successfully authenticate themselves The password "system" on a French keyboard layout produces yet another scan code: 1f-15-1f14-12-27. A French-language user would therefore have to enter "syste, " (note the comma replacing the "m") to successfully authenticate themselves. You will find other keyboard layouts at http://www. microsoft. com/globaldev/reference/keyboards. mspx. 78 Sophos SafeGuard® Disk Encryption 4. 60, help 15. 3. 2 Generating internationally uniform data for SDE If Sophos SafeGuard Disk Encryption is implemented in international environments, it is necessary to ensure that passwords and keys can be correctly entered (typed by the user) on all available keyboards. It is especially important to ensure that the Sophos SafeGuard Disk Encryption user profiles for performing administrative tasks can be implemented world-wide. An example is the Challenge/Response procedure, if the user making the call and the help desk person using the Response Code Wizard do not use a keyboard with the same layout. If the Sophos SafeGuard Disk Encryption data (or, to put it more clearly, keystroke sequence) is created from a combination of the following 21 keys, it is very likely that Sophos SafeGuard Disk Encryption can be used without problems in international environments. Printed values on the keys Hexadecimal scan code b c d e f g h i j k l n o p r s t u x v [blank space] 30 2E 20 12 21 22 23 17 24 25 26 31 18 19 13 1F 14 16 2D 2F 39 79 Sophos SafeGuard® Disk Encryption 4. 60, help 15. 4 General password rules You can use the General Password Settings in the Workstation Configuration dialogs of the Administration functions to define further rules for the formation of Sophos SafeGuard Disk Encryption passwords, such as the proportion of letters and numbers or their minimum length. [. . . ] Difference between type of current file system \nand type of defined file system detected. Difference between current cluster size and \ndefined cluster size detected. Clusters could not be marked as 'Bad'. 1307 1308 1309 1310 1311 1312 1313 1314 1315 161 Sophos SafeGuard® Disk Encryption 4. 60, help 1316 1317 1318 1319 Cluster information is corrupt. MBR sector on 1st hard disk could not be replaced. SGOCA Errors 1401 1402 1403 1404 1405 1406 The requested object communication area information data already exists. [. . . ]