Encryption as a tool to deny access to information

Yesterday I blogged about the minor break in AES and what effect this would have on encryption products like Check Point Full Disk Encryption (formerly known as Pointsec). In short, there is not practical effect and the product is still effective at protecting your data.

One of the things I talked about yesterday was that the purpose of encryption is not to protect some piece of information forever. That would likely be impossible as our computer power grows in strenth. Eventually the processes of simply trying every possible key combination will become trivial enough that an sufficiently old algorithm will no longer be effective. Instead, I said that one of the aims of encryption is to deny access to information until that information is no longer useful.

A stunning example is illustrated in this article I read today from the Wall Street Journal: http://online.wsj.com/article/SB124648494429082661.html

To summarize, a friend of Thomas Jefferson once sent him a letter with an encrypted block of text in it. I should point out that this friend was a professional in the field of cryptology as it existed in the early 1800's. The really interesting thing is that the encrypted block of text, which was encrypted without the aid of computers obviously, stoood up to professional examination for 206 years. The code was broken in 2007, but the article is from today. So even though the algorithm was successfully broken, it still served its primary purpose which was to deny access to the plaintext until that plaintext was no longer useful to the attacker.

New Attack on AES, is Pointsec broken?

Like many people in the security world, I keep a close eye on Bruce Schneier's blog. Today I was a little scared when I read about a new attack on AES that has theoretically broken the cipher. You can read Schneier's comments on it here: http://www.schneier.com/blog/archives/2009/07/new_attack_on_a.html

The reason that this freaked me out at first is because the default encryption algorithm used by Check Point Full Disk Encryption (formerly known as Pointsec). Much of my personal data is protected by Check Point FDE and I don't want to see it exposed. The good news is that while this may fit the dictionary definition of a break, it is far from the end of the world.

The freakout comes from the difference between what a cryptologist calls a broken algorithm and what broken algorithm means to a typicaly person on the street. When you tell me that AES is broken, I think that it has been made completely worthless (or nearly worthless as is the case with DES). However, cryptologists have a much different definition. For them, a break means that someone found a way to get at the plaintext data in a more efficient way than simply trying all of the possible code combinations that exist. In this case, they found a way to reduce the number of possible code combinations from 2 to 119th power down to 2 to the 110th power.

So basically, AES is still very much alive and kicking. It is very unlikely that anyone is going to be able to exhaustively search through 2 to the 110th power code combinations and still derive value from your data. This is one of the points that I try to stress in my Full Disk Encryption classes, though. No encryption algorithm is perfect and able to remain eternally unbreakable. The power of encryption is to deny access to information for such a long period of time that the information is no longer valuable. For example it is worthless for the enemy to learn about tomorrows battle plan 35 years from now. The flip side of that coin is that if someone could theoretically gather enough computing resources to break your encryption in a short amount of time (say one week for example) the cost would exceed the value of the information. In other words, I would not spend tens of billions of dollars to break your encryption so that I could get your credit card number that has a limit of $5,000.

So if Check Point Full Disk Encryption broken? Well, maybe in a theoretical sense, but absolutely not in a practical sense.

Verifying Encryption in Office documents

I recently had a question come to me from someone that has to send sensitive data over email. She is keeping the data in an Office 2007 excel file, but in some cases the data are kept in an Office 2003 file. She was asking me about encrypting the documents.

I would really like for her to have an easy to use option that doesn't require learning new software, so I immediately thought about the password protection options that come with Office. I know that in Office 2007 you can select some great encryption algorithms, and when you encrypt a document it is really encrypted. I was under the impression that password protection of files in Office 2003 or better was just that, a password but no encryption of the contents. But when I started poking around in the interface, I did see options to encrypt the document. I decided that before I told this woman that she could use this technique, I needed to verify it for myself.

So when you're performing a scientific experiment, you need to have a hypothesis that you're going to test. In this case, I have two:

H1: Password protecting a document in Office 2003 and selecting an algorithm from the advanced options will obfuscate the data in the plaintext file.
H2: The resulting file will be well encrypted.

So how can you verify that the document has been encrypted? Well here is what I did. I created a simple document in word 2003 and saved it. Then I opened the document, applied a password and one of the encryption options and saved it as another document. Now I have two documents, test1.doc and test2.doc. The first thing I did was run the strings command against them.

As you can see from the two photos, the plaintext data are visible in test1, but not in test2. So now we know that the document has at a minimum been obfuscated. This essentially proves H1. There is also an easy way that we can test the strength of the encryption. Well encrypted data does not compress well, so we can compress the two documents and compare the reduction in size. Unfortunately, as you can see from the output here, the results of this test are not supporting H2. Now I need a way to verify my position that well encrypted data does not compress well. I need to add a control to this experiment.


For my control, I am going to use GPG to encrypt a file since GPG makes use of a well respected encryption algorithm. I ran GPG against test1.doc to get test1.doc.gpg. Just as with the Microsoft enryption, the file size grew. Then I attempted to compress the file and got zero compression. In fact, the compressed file actually grew in size.

So my final conclusion is that password protecting a document in Office 2003 and selecting an encryption algorithm (other than XOR) from the advanced options will obfuscate the data in the file. The quality of the encryption algorithm cannot be verified, but is known to be less than that of GPG.

Now here is my disclaimer. I am not an expert on cryptography. These are some simple tests that I've put together based on my tiny knowledge of the subject. If anyone can provide more information that I can use to validate my claims I would love to hear it.

Edit: After talking to someone that knows more about the subject than I do (though still not an expert) I have a better understanding of the problem. Many encryption algorithms strive to produce output that appears to be random data. This reduces the ability of an attacker to perform a statistical analysis of the ciphertext. This is the reason that well-encrypted data does not compress well, because there is very little redundancy that can be compressed. So the fact that my ciphertext does compress well does not necessarily mean that the encryption algorithm is poor, it just means that it is more vulnerable to statistical analysis than another.

Full Disk Encryption for Mac is slowing me down

I finally got my hands on a full license for Full Disk Encryption for Mac, and I installed it tonight. In fact, my machine is encrypting right now as I write this post. On Windows machines, the encryption process (prot_srv) throttles itself if someone is using the computer. That is why you can deliver a computer to an end user without waiting for the encryption to end.

Unfortunately, that doesn't seem to be the case on the Mac product. I'm really feeling the pain right now. Hopefully it will be done encrypting by morning.

OS X Full Disk Encryption: How to reimage a machine

A while back I borrowed a MacBook from a co-worker so that I could get started testing Full Disk Encryption for OS X. FDE is Checkpoint's version of Pointsec for Macs. I had a 30 day evaluation license, so I applied the software and wrote a couple blog entires about it. Then I got my own MacBook and gave back the one that I borrowed.

Today that coworker came to me with a question about FDE. It seems that once you've installed FDE you can't just install OS X over the top when you're ready to reimage. He booted the MacBook from the installation CD, but when it came time to select the drive that you want to install it on, he got this error.

Let me start by apologizing for the quality of the pictures in this post. Since I don't have OS X running on any virtual machines, I can't just do a screen capture. What you're seeing is the pictures I took with my cell phone. I know, it sucks.

So I called up Checkpoint support to see if they had any ideas. First I waited on the phone for 20 minutes to talk to someone, which is unusual because I typically get a response right away when I call. I also had to deal with the problem I've been having getting my support contract bound to my support account. Even though it has been two months, they still can't seem to recognize that I have support. After I got through all of that, the support technician told me that I would probably have to decrypt the drive using my recovery file and then install OS X.

I was not satisfied with this answer, and I decided that I was going to play around a bit and see if I couldn't come up with something faster, and I did. I booted the computer from the installation CD, but this time I went up to the menu at the top, clicked on Utilities and then Disk Utility. Disk Utility showed me that the hard drive had been partitioned by FDE into a small boot loader and a large encrypted drive. I simply changed the partition scheme to one partition, named the volume Macintosh HD, and set the format to Mac OS X Extended (Journaled). The formatting process took all of 30 seconds, and when I quit Disk Utility I was able to install OS X on the hard drive again. Problem solved.

Pointsec for PC: WIL vs SSO vs NLA

One of my major projects for the year was leading classes on how to install and administer Pointsec for PC. One of the areas that we always spend a lot of time on is the difference between Windows Integrated Login (WIL) and Single Sign On (SSO). This also leads to quite a bit of discussion on the merits of each option.

Today I was looking at some of the older blog postings and I noticed that a few weeks ago someone had posted a question in the comments section. I'll quote from the comment:

What is your view in the WIL vs. Pre-boot debate? In light of the cold boot and firewire tools recently posted, do you believe Pre-boot is better? Or will it just encourage users to leave their machines turned on to avoid the inconvenince of the pre-boot login?

The answer to this question largely depends on the culture of the organization that you work for and how much power the IT department has in the organization. But before we get into the political side of SSO and WIL, let's talk about the technical merits.

The biggest advantage to using Windows Integrated Login is that you have configured Pointsec to be nearly transparent to the end user. The user will be pleased that he is able to log in at the same screen that he always did using the same password that he always did. There isn't anything new to learn and there aren't any scary screens that he hasn't seen before. However, you're sacrificing security to gain that usability. Consider this, if your computer boots directly into Windows without going through the Pre-Boot authentication then you're opening yourself up to any attack that could penetrate your Windows machine. Time is on your attackers side in this scenario. For example, let's say that I steal your computer and it is configured to use WIL. I might decide to leave it shut down in a drawer for six months to see what vulnerabilities are released. After a really good remote vulnerability is released, I can boot up your computer (which hasn't been patched in six months) and attack it over the network with some newer exploit code. A perfect example is the winlockpwn tool, which takes advantage of firewire's weak security model. Even if a patch were released, I now know that your computer is vulnerable to this attack, so I win.

Single Sign On is much more secure than WIL, but of course security comes at a price. With SSO the computer actually boots into a Pre-Boot Environment, a 32 bit super bare-bones operating system. Once the user has successfully authenticated in the Pre-Boot Environment then Windows is loaded. The security of the Pre-Boot Environment comes from it's stripped down nature. Obviously you can't use Windows exploits against the system because Windows isn't running yet. You can't really use any network attacks against it because the network stack is barely functioning. Firewire isn't active, so you're not going to be using that tactic to get into the system either. Single Sign On also securely caches the credentials that the user logs in with so that he doesn't have to log in twice. All this security comes at a price though. For one thing, you have to make sure that your users don't freak out when they see a new screen to log in to. That means that you're going to have to invest in training. It's also possible for the passwords to fall out of sync, which can be difficult for users to understand. If you change your password from within Windows, then Pointsec will automatically updated the Pre-Boot Environment Password, but if you have your password reset at the server then you still have to log in one time with the old password. Users might not understand that a password reset at the server doesn't magically make it into the Pointsec local database.

Is there a way to strike a balance between these two options? Well, maybe. Network Location Awareness is a feature that was added to Pointsec around version 6.2. The idea behind NLA is that you only need the added protection of the Pre-Boot Envionrment if your laptop is in an unsafe location. So you provide Pointsec with some IP addresses on your local network. When the computer boots Pointsec will attempt to reach these IP addresses, and if it is successful then it will bypass Pre-Boot authentication and load Windows. If not, then the user will have to authenticate in the Pre-Boot Environment.

You of course will have to decide which of these options works best for you. Do you need the enhanced security of SSO? Do your users have enough political power to force you into using WIL? Are they too easily confused to deal with NLA? One thing I've never heard is someone complaining that Pointsec gives you a lack of options.

Valuing Disk Encryption

I recently finished taking a finance class where we talked about concepts like Net Present Value (NPV), present values of perpetuities, Weighted Average Cost of Capital (WACC) and Capital Asset Pricing Model (CAPM). Part of the class covered project management and how to select projects based on the benefit that will come to the company while adjusting for the time value of money. This led me to wonder how I could use this new information to put a value on our Pointsec full disk encryption project.

First, I'm going to give a brief description of these finance terms that I used above since this is a security blog and I don't know if everyone reading this knows these terms. Net Present Value provides you with a way of putting a concrete value on a future stream of money. So, for example, if you were going to save $1000 each year for three years, and you paid $1200 to do so, was it a good investment? Generally, if NPV is a positive number then you should take the project. Present Value of a perpituity is the same concept. If you want to get a 4% return on your money and some investment is going to pay you $1000 per year forever, then what is it worth paying to get that? For the sake of this conversation, WACC shows how much it costs your organization to raise money, and it is used to calculate the required rate of return for a project to be profitable.

Let's use this information to examine our Pointsec disk encryption project. We have a laptop computer lost or stolen approximately once each year. I have estimated that when the laptop is not encrypted it costs my organization about $2000 in employee time and notification costs. If the laptop is encrypted then it probably only takes about $200 in employee time to verify that, file the report, and move on. So if we encrypt all of our laptop comptuers then we can expect to save $1800 per year.

In order to put a present value on these cash flows, we need to know what the discount rate is going to be. I have no idea what is a good number, but I figure since I work for a government entity, our cost of capital is pretty low. I'm going to estimate a 3% discount rate. Someone can tell me later if that number is way off.

Next we need to decide how long we expect to receive that $1800 cash flow. My first answer was to take the average lifetime of a laptop computer before it is refreshed. In our case, that is about five years. So what is the value of that cash flow? $1800/year at 3% for five years is worth $8,243.47. That means that if we can do the project for less than $8243.47 then we used the money well. I'm not going to go into specifics on how many machines we own or what kind of pricing we have with Checkpoint software, but it cost us about $8000 for licensing. That means in order for the project to be profitable we would have to have implementation costs of less than $243.47. Not likely. Also, if we were to buy a few dozen more laptop computers, then the benefit wouldn't even cover the cost of licenses. To be fair, though, if we bough a few dozen more laptop computers then we might have more theft which would increase the value of the benefit.

But then I started to think more about the project. When each computer reaches its five year mark, it gets replaced with a new laptop that will need to be protected. So it isn't really accurate to put a five year life on the project. We're really looking at a savings of $1800/year forever. The present value of a perpetuity that pays $1800/year at 3% is $60,000! So by valuing the project this way, we can have implementation costs of up to $52,000 and still be profitable. That seems really high to me. I also think that it isn't fair to say that we're going to have this cash flow every year forever. For one thing, we don't even know if this technology is going to be necessary in ten years. Maybe all hard drives will be encrypted and we wont need to use software to do the job.

So how do we answer this question? I think for most pieces of equipment you would take the useful life of the asset and consider the cash flows for that lifespan plus the salvage value if you're able to sell the asset. Depending on the asset, this might be easy or difficult. If we were talking about a firewall, then you might look at your other assets and say "I usually get about five years out of something I purchase." Or you might talk to other companies of similar size and find out that most people get 7 years out of the asset. There was a four year gap between Office 2003 and Office 2007, so maybe when trying to decide the benefit of upgrading to Office 2007 you should assume a four year life.

Even without perfect information there are a few questions we can answer by taking the known variables to come up with the unknown to see if things pass the smell test. For example, we know that we're going to spend $8000 in licensing costs and we can estimate that we're going to spend another $6,000 in labor to install, maintain, and troubleshoot the product. If we assume that our required rate of return is 3% and that each incident costs us $1800, then how long would we have to get this benefit for it to be a profitable use of our money? According to my spreadsheet the answer is about 8 years, which seems fairly reasonable to me. We could also rearrange the equation to answer what the required rate of return must be for this project to be profitable after some number of years and see if that number is reasonable too.

In previous posts, I've compared the practice of information security to the Jedi and Sith of the Star Wars Universe. Using numbers like these to make a security decision is a great example of Form II lightsaber combat, which I'll be talking about in a future blog post.

Pointsec for PC: Upgrading

This morning I was looking at our download point where we grab our Pointsec for PC software and I found that a new version had been released. My clients are currently running 6.3.1 HFA 2 (HFA stands for Hot Fix Accumulator), and now HFA3 has been released. Of course now I need to upgrade all of my clients to make sure that they have the latest version.

The first step in my process is to test. You don't ever want to roll out software to a group of customers without making sure that your process is going to work. The easiest and fastest way to make sure that it's going to work properly on your own machine is to copy the contents of the 1_Pointsec for PC folder into your work folder. I downloaded the zip file, expanded the 1_Pointsec for PC folder and copied the contents into c:\program files\pointsec\pointsec for pc\work. After a few seconds all the file disappeared from my work folder and after another minute I saw the installer start running. I was asked to reboot and everything I was fine. I was now running 6.3.1 HFA3.

The next question is how to upgrade my clients. The best thing to do is call Pointsec support and ask for their advise, which is what I did. The person I spoke to recommended that I use a logon script to run an MSIEXEC command on each of the computers running an older version of Pointsec. He pointed me to the administrator guide on page 163 where it says

"msiexec.exe /i "pointsec for pc.msi" REINSTALLMODE=vomus REINSTALL=ALL REBOOT=ReallySuppress /q"

That is the recommended way of doing the upgrade, but I don't really have a way of running a login script on all of my clients. For one thing, it seems like a lot of work since I would have to get one of the Windows admins to actually write the script. The script would have to check if Pointsec was installed on the machine and then run the .msi. I just didn't want to do it that way, so I decided to use the upgrade path instead. According to the admin guide, you can use this option for any computer running Pointsec for PC 6.2 or later. So I rolled back the changes on my virtual machine, installed 6.3.1 and waited for the encryption to complete.

Once the encryption was complete, I had a fully functioning installation of Pointsec with no hot fixes. I went into my local computer settings and changed the upgrade path from what was set in there to another folder of my choosing. The reason for this is that I don't want all my clients to download and install the upgrade until I'm sure that it works. I then copied the .msi file and the modules folder from the 1_Pointsec for PC folder into my new upgrade folder and waited patiently. After a while, I saw the installer start on my client and was prompted to reboot. I now have Pointsec for PC 6.3.1 HFA 3 running on my machine without having to visit the client or mess with a login script.

The last thing you want to check out is that something gets put into the log files so that you'll know if all your computers have upgraded properly. I checked the logs on the central server and found this message to confirm that everything worked alright.

Pointsec for PC: Creating a Boot Disk

Edit: November 30, 2010: Stop building your boot CD using this method. It is much easier to do now and instructions can be found here: http://www.blackfistsecurity.com/2010/11/easier-way-for-full-disk-encryption.html

Quick Note: I am not an authorized distributor of Checkpoint's software. Please don't ask me to send you software that I do not have permission to send. I'm sorry if you lost your installation media, but I'm sure the people at Checkpoint can work something out with you. I will delete comments asking me to send software.

Did you know that you take a computer that is encrypted with Pointsec for PC and boot it to a CD? Maybe you did know that, but finding the documentation that describes how to create the CD is actually more difficult than creating the CD itself. Here I will outline the steps that I used to create a bootable CD that can read the encrypted contents of a hard drive protected by Pointsec.

The procedure that I'm going to describe was written for Pointsec for PC version 6.2. I have verified that it is the same process for Pointsec 6.3.

There is one thing that I need to clear up right away. This is not a way of getting around the encryption on a computer, and it is not evidence that your computer is not being protected by Pointsec. This bootable disk will still require that you enter valid credentials for the hard drive that you are trying to access. In fact, once we've finished creating the CD, we're actually going to boot to the hard drive first, authenticate, and then boot to the CD. This is very valuable as a troubleshooting step when the Pre-Boot Environment is working properly but the operating system is not. A good example I can think of is when a device driver becomes corrupted. You might log into the Pre-Boot Environment, but then Windows blue screens while it is loading. You might normally just image the machine and move on, but this one has some files that your user hasn't backed up. If you don't have one of these boot CDs handy then you would have to use your recovery file to create a boot device and remove the encryption. This takes a while and is a real pain when you just want to recover a couple files. Another item of interest is that since you're going to authenticate to working Pre-Boot Environment, you don't need to use the computers recovery file and you don't need to create a unique CD for each computer that you're going to recover from.

Materials Needed: In order to create a boot disk you will need the following

• 1 working computer running Pointsec for PC. The version running needs to be the same as the version on the computer you are going to recover from.
• 1 Windows XP installation CD
• The latest version of PE Builder, available at http://www.nu2.nu/pebuilder/
• The installation media for the version of Pointsec that you are running.

Install PE Builder
Download the latest version of PE Builder and install it on a working computer that is running the same version of Pointsec for PC as the machine you're going to recover from. You can accept the defaults for the installation. In the version that I used, it installed itself to c:\pebuilder3110a. If this is different for you, that's fine, just make sure in the next step that you provide the real path not the path that I list. Do not run the program once the installation is complete.

Seriously, don't ask me to distribute Check Point software! People seem to have trouble reading the note at the begining of this post. If you ask in the comments it wont even show up on the blog because I'll reject it. I do not have permission to distribute Check Points software and neither does anyone else who is likely to be reading this blog. So please dont ask me.

Install the Pointsec plugin for PE Builder
Included with your installation media is a folder called Resource Kit, and in that folder you'll find another folder called BartPE Pluginbuilder. Inside that folder you'll find another zip file that needs to be extracted. Extract the zip file to c:\pebuilder3110a\plugin.

When the extraction is complete you should have a folder in c:\pebuilder3110a\plugin called Pointsec. This Pointsec folder should have two subfolders called files and images. Make sure that the directory structure is correct. It is very easy to accidentally extract the zip file and end up with a path like c:\pebuilder3110a\plugin\pointsec\pointsec\files, which is not correct. There should only be one folder called pointsec.

Next you have to copy the Pointsec filder driver to the plugin folder. You will probably have to stop the Pointsec service and the Pointsec Service Start Service because the file you need will be locked. Navigate to c:\windows\system32\drivers and copy the file prot_2k.sys. Navigate to c:\pebuilder3110a\plugin\pointsec\files and paste the prot_2k.sys file.

Create the boot image
Insert your Windows XP installation CD into the CD ROM on your machine. Open PEBuilder, which will give you the option to search for Windows installation files. You may want to skip that step and just type d:\ or whatever your disk drive letter is. Click the plugins button and make sure that the Pointsec for PC Encryption filder driver is included in the list and that it is enabled. Click the close button to go back to the builder screen and then click build to create your ISO image.

Burn to a CD
Burn the ISO to a CD using the software of your choice.

Boot to the CD
It seems counter-intuitive, but the way to boot from the CD is to boot from the hard drive first. Remember, your Pre-Boot Environment must be working properly for this to work. You may need to configure your BIOS to boot to the hard drive and not the CD.

If you're using Windows Integrated Login then you wont have the opportunity to authenticate to the Pre-Boot Environment. You can turn off WIL even if your computer isn't working properly by following these directions.

When you get to the Pre-Boot Environment screen, press CTRL+F10. Nothing visible will happen when you press the key combination, but after you login you will be taken to the Alternate Boot Menu. From here you can instruct Pointsec to boot to the CD that you created. Once the boot process is complete you should be able to read the hard drive and copy files to a network share.

Pointsec for PC: Recover from installation failure

A couple weeks ago I talked about customizing the Pre-Boot Environment in Pointsec for PC and how you can use this information to troubleshoot some Pointsec problems. Essentially what I was saying is that before you move into aggressive troubleshooting, you need to make sure that you've tried the easy fixes first. Well, what if the easy fixes don't work? In this post I'll talk about how to deal with a computer that is somewhat broken.

What do I mean by somewhat broken? Sometimes when you install Pointsec for PC, the computer will reboot, install the Pre-Boot code, reboot again, and then come to a black screen, or even a blue STOP error. This happened to me today, which is what prompted me to write this entry. The computer is somewhat broken because it will not boot, but the disk hasn't been encrypted. That means that you can boot the computer to an alternate operating system and read the contents of the drive.

Essentially Pointsec for PC consists of two parts: the Pre-Boot Environment that authenticates users, and the Windows drivers that allow the operating system to read the encrypted disk. In the situation I described above it is the Pre-Boot Environment that is broken, but the operating system is intact. What we need to do is remove or get past the Pre-Boot environment, get into the operating system and completely remove Pointsec. Here is how you do that.

I think the easiest way to do it is to boot the computer to a Windows XP or Vista CD, whichever applies to your operating system. When the installation starts you can opt to repair an existing installation of windows. You will be brought to a command prompt that will ask you which instance of Windows you want to repair (most of the time there is only one to choose from). Then you can enter the administrator password for that Windows instance and you get a command prompt.

You may be tempted to run fixmbr and see if that does anything for you. It wont, and the reason is that Pointsec for PC does not make changes to the Master Boot Record; it makes changes to the Partion Boot Record. So instead of running fixmbr, run fixboot. That will put the Partition Boot Record back the way it was. Now boot the computer and you should get into Windows. Go to add and remove programs and remove Pointsec for PC.

This morning when this happened to me and I went to remove Pointsec with Add & Remove Programs it gave me an error that an installation was in progress and it wouldn't let me go on. I've noticed with Pointsec that sometimes when it gives you an error, you can just wait for a minute and try again and things will work fine for you. However, in this case I was in a hurry so I decided to start shutting down services to see if that would help me. I went into the local services and disabled the Pointsec service and the Pointsec Start service. Then I was able to remove Pointsec completely.

Once I had completely removed Pointsec, I ran the installation again and everything worked properly. I'm not sure why it failed the first time. Maybe something didn't copy right or maybe there was a bad block in the disk. Either way, the computer was fit for full duty in about 15 minutes. And now if you're having this problem you've got some tips for fixing it.

By the way, Pointsec for PC ships with a tool called reco_img.exe that you can use to create bootable media that will strip away the Pointsec Pre-Boot code. Essentially it does the same thing as the procedure that I described above. I like to use the Windows CD because reco_img doesn't always work for me. Sometimes I've got a computer that doesn't want to boot to a USB stick and I don't have a floppy disk. Also, reco_img makes you jump through some hoops to expose hidden options to remove Pointsec. I haven't had anyone explain to me yet why I should use reco_img instead of the Windows CD, so that's what I use.

Pointsec for PC: Preboot Customization

One question I get asked from time to time is what you should do if you boot a computer that is encrypted with Pointsec and nothing happens. I've personally seen this happen one time and my first instinct was to freak out. Here is the story of why I almost freaked out and how I was able to resolve the problem.

It all started when I was rolling Pointsec for PC out to our beta test group. I went over to the Office of Such-and-Such and had a conversation with the office director. Here is how the conversation went:

Me: "Hi. We're testing some disk encryption software and since your office deals with sensitive information, I'd like to test this on some of your computers. I'd like to start with a small group of about five machines that are not mission critical for your office."
Director: "What do you consider non-mission-critical?"
Me: "Any machine that you could live without for a day in case I have to do some major fixing on it."
Director: "OK, let me give you a few."

So I installed Pointsec on a few machines and went on with life. But then I got a call a few days later and was told that Mr So-and-So was not able to log into his machine, in fact the machine wouldn't boot at all. I went over and verified it for myself, when I booted the computer (which worked fine a couple days ago) all I got was a black screen. I decided that I was going to have to do some major fixing on this machine. Here is how the conversation went:

Me: "I need to take this back to my office and start doing some fixing to get it back in working order."
Director: "How long is it going to be gone?"
Me: "A day at the most."
Director: "A whole day? Our office can't work without this computer!"
Me: "What do you mean it can't work without this computer? You were supposed to give me machines that aren't mission critical!"
Director: "We don't have any computers that aren't mission critical!"
Me: "Then you shouldn't have let me install this on any of your computers! Crap, I'll get this done as quickly as possible."

So I disconnected everything from the computer (it was a laptop) and brought it up to my office. When I opened the lid I saw the Windows login screen looking at me. So I brought the machine back and plugged it into everything and when I turned it on I got the black screen again. Through a process of removing devices and booting I was able to narrow down the problem to a USB smart card reader that he had on his desktop. This left me with a couple of options. I could have told Mr. So-and-So that he had to disconnect the smart card reader when he booted his computer and the plug it in after Windows loads, but that isn't the most user-friendly way of doing things. Instead, I used an update profile to turn off USB devices in the Preboot Environment.

However, there was something I could have done that would have made my troubleshooting process much easier, using the Preboot Customization menu. As you may know, even if you're using Windows Integrated Logon, your computer still moves through the Preboot Environment on the way to Windows. You can alter the Preboot environment by holding down both shift keys at the same time when the words Pointsec for PC appear on the screen. Now, instead of the usual login, you'll be brought to a menu where you can disable USB devices or switch into a low graphics mode and see if any of that fixes your problem.

So for future reference, this should probably be the first thing you take a look at when you're having problems booting a computer running Pointsec for PC. If this had been a desktop I probably would have built a recovery CD right there and gone through a very painful decryption process when there was a very simple fix available.


I especially want to point out the option of disabling Windows Integrated Login from the Preboot Customization menu. This can be a great way to narrow down if your boot problem is Pointsec related, or a problem with Windows itself. Disable WIL and see if you can log in. If that works then you can boot to a CD and try to fix Windows or at least recover some files before you reimage the machine. When I point this out a lot of people ask me if you can enable WIL from this menu and use that to bypass logging into the Preboot Environment. The answer is yes, you can enable WIL from this menu, but only if it is also enabled in the management console. So if your users are logging into the Preboot Environment and they try turning on WIL from the Preboot Customization menu, they will not be successful in skipping the login. For all practical purposes, the Preboot menu can be used to turn off WIL, and turn it back on it it was set in the management console, but if WIL is disabled in the management console then you can't use the Preboot menu to turn it on.

Walkthrough Full Disk Encryption for Mac OS X

In the previous post, I talked about the release of Pointsec for Mac, which to my knowledge is the only Full Disk Encryption product available for the Mac. I also mentioned the installation process and how it differs from installing Pointsec for PC. I want to continue the discussion by walking through the menu options available once you've installed Pointsec for Mac on your machine.

I am a big fan of Pointsec for PC. I think that it is the easiest full disk encryption product to install and administer out there. Having said that, I also know that the large set of options available can be daunting for people when they first set it up. This probably wont be the case for people that set up Pointsec for Mac. Since the product isn't as full-featured as its cousin the main screen isn't as intimidating.


On the main page you have your Update Validation Password (which is used to authenticate update profiles that it downloads) and the paths that you set for the software to put recovery files and search for update profiles. That's it!

As I said, there aren't as many options because the software isn't as full featured. One of the features not present is the logging that you get with Pointsec for PC. When you install Pointsec on a PC you can remotely view the logs through the event viewer or the logs that get written to the server. You can verify that the installation went properly and that the disks are encrypting. You wont get that same assurance from Pointsec for Mac without visiting the desktop.

I also mentioned in the previous post that we don't have anything like Single Sign on or Windows Integrated Login with the Mac product. The only way I have found to get a single sign on environment is to have the Mac automatically log in after you authenticate with Pointsec. Smartcard support and the ability to customize the Pre-Boot Environment are also missing.

Under System Settings you'll find the mount points that were configured at setup time. Since you can't make any changes to these settings there really isn't anything to worry about here.

Finally we get to the System Passwords Policy. Just like with Pointsec for PC you can have a password policy for each group of users, but you can also have a master password policy for your system. So you might set up all of the groups for your organization with their appropriate password requirements. Then, if you have some computers that hold particularly sensitive data, you may set even stronger password requirements for those machines regardless of which users are logging into them. When I talk about Pointsec for PC I usually recommend setting the password policy to be as permissive as possible and let Active Directory be the password policy enforcer. However, since you're not going to be using Single Sign on with Pointsec for Mac, you won't be able to rely on an outside policy enforcer so you're going to have to do something with these settings. They are pretty self explanatory though.

I think in my next post I'm going to talk about creating a remote installation profile and see if that is much different from the process on Pointsec for PC.

Full Disk Encryption for Mac OS X

Last month Checkpoint software released their Pointsec full disk encryption product for the Mac. I believe this is the only FULL disk encryption product available for the Mac. Pointsec for Mac runs on OS X Leopard and Tiger. I've been teaching some classes around the state on how to install and administer Pointsec for PC, and since most of my students are University IT workers, I get a lot of questions about Pointsec for Mac. Up until now, I haven't been able to provide much in the way of answers. I should also mention that the product seems to be called Endpoint Security Full Disk Encryption for Mac.

Over the last week I have had the opportunity to use a Macbook. I actually ordered my own Macbook but it hasn't arrived yet so in the meantime I'm using a loaner. And since I don't need to worry about what kind of damage I do to a loaner computer, I put Pointsec for Mac on right away.

The installation was pretty straightforward. If you've installed Pointsec for PC then installing Pointsec for Mac shouldn't be a problem for you. Just as with Pointsec for PC, you have to create two Pointsec administrator accounts which are necessary if you want to remove Pointsec later. You also have to provide a path for writing your recovery file in case things go really bad on the machine. One thing that is different is the licensing. All the releases of Pointsec for PC that I've had the chance to use have used the same evaluation license key. And even though the key is good for ten licenses, there doesn't seem to be any checking to see if that key has been used elsewhere. I know this because in my classes I have all the students use the same license key and there has never been a problem. With Pointsec for Mac you have to get a license file from Checkpoint and the evaluation key will expire in 30 days. I haven't tried using the same license key on multiple computers since I only have one Macbook.

Once the installation is complete your computer will reboot and you'll be looking at a login screen for Pointsec. This is the Mac version of the Pre-Boot Environment in Pointsec for PC. Log in with one of the admin accounts you created during setup. One of the weird things that I've noticed is that there is a check box for Single Sign On which is disabled. That suggests that there is a way to enable Single Sign On in the management console, but I haven't found anything. So far, the only way to get Single Sign on that I can find is to have your Macbook auto login. That works fine for most people, but if the machine is shared by several people then this is not ideal.

When you get logged into your Mac, you'll see a new Icon in the tool bar. You can click on that icon to get the encryption status or log into Management Console and make changes to your setup. I'll cover the Management Console in a later post.

There are a couple things that I want to mention about the installation. Based on my first impression of the software, it seems to make major changes to the EFI partition, possibly even completely replacing it. If you're using something like rEFIt to dual boot your Mac you will find that it doesn't work anymore. I don't know if there is a way to fix it, but I'm pretty sure that there is no solution that is supported. The other thing I'd like to point out is that even though the software has many of the same features as Pointsec for PC, you can't use a Pointsec for PC installation profile to automate the installation of Pointsec. If you're going to be deploying this software alongside Pointsec for PC then you're going to have to use a separate installation point.