Device Encryption

[mgzwepaing]

We currently have CSA and NAC and would like to have suggestions on what could be the best way to handle device encryption/endpoint security, mostly on laptops for remote users.

Our main goal is to have file/folder encryption enabled on the device. Would Windows built-in encryption or any third party software (Synmantec/Zenworks) do the job and what would you recommend?

We were lead to believe that CSA have the capability to do encryption on the end device but found out the hard way that it's not true or is it?

We have both NAC and CSA in place and would like to do anything we can to enforce or have the device secured without adding another Cisco appliance if at all possible.

Thank you.

[mhellman]

No, CSA does not provide endpoint encryption.

What exactly are you trying to accomplish with endpoint encryption? i.e. what risks are you trying to mitigate? If you're worried about stolen laptops, your best bet IMHO is probably full disk encryption. If there is some very specific data you're trying to protect or if you can trust your users to encrypt everything that needs encrypting, then consider file/folder encryption. There are lots of solutions to do either, even some free ones. see:

http://www.truecrypt.org/

[mgzwepaing]

I believe, in this case, there will be two pieces involved for the encryption, CSA and TrueCrypt or other similar app.

We are trying to prevent remote users from abusing/losing the sensitive data as they work off-site and would like to have it accomplished (secure data) without too much user's action involved and no education or training on how to operate. We were hoping that the software/agent can take care of everything. But I don't think we could in this case.

I will have to get back to the planning game again. Do you have any suggestions on how to best use of available CSA policies and rules combining with TrueCrypt or will they be just two separate process with more user's action?

Thank again.

[srue]

my old company uses "Pointsec" and has been pretty pleased w/ that for laptop encryption.

it's now owned by checkpoint:

http://www.checkpoint.com/products/datasecurity/pc/index.html

[mhellman]

Sorry, just noticed your other question in there about CSA and truecrypt. I'm pretty ignorant of the CSA product at that level, but there are some really sharp folks in this forum that are all over it. You may have better luck reposting as its own topic.