Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 405
  • Last Modified:

Mobile encryption without being admin

Hi experts.

In a perfect world, there would be a software that would encrypt USB drives and let anyone access the data that knows the password. That person should not need administrative privileges.

What windows software solution comes next to this? [Hardware is not being looked at here]
Bitlocker to go is already considered an option, yes.
0
McKnife
Asked:
McKnife
  • 6
  • 5
1 Solution
 
Rich RumbleSecurity SamuraiCommented:
BL-2Go is one option, I'm not understanding a lot of the push to USB encryption and I work with several regulated/mandated clients across the world. TrueCrypt of course can be used in this way, but it requires the executables to be present on the USB drive [See Traveler Mode](or already installed in the system), as will most 3rd parties if you think about it. OEM/Manufacturer solutions are going to be the most ubiquitous ones.
If hardware isn't being looked at then it's looking like BL all the way, however that leaves XP and Vista (in the case of BL-2Go that is).

I don't throw encryption around like I used to, now I try to fix the problems before it comes to that. Got any other requirements or concerns about USB and or mobile devices? Since the data can leave so many other ways, USB is probably the least of my concerns when I consult for a client. It's very low on the radar unless USB is a commonly used item for sensitive data/air gap transfers. Otherwise, there are much faster and "better" ways to transfer data within just a browser.
-rich
0
 
McKnifeAuthor Commented:
Hi Rich.

Truecrypt portable needs admin rights. BL2Go cannot be used for different reasons and was already considered, as I wrote.

I found a solution which I already tested and it works alright, at least on win7: http://translate.google.com/translate?u=http%3A%2F%2Fwww.withopf.com%2Ftools%2Fsecurstick%2F&langpair=de%7Cen

I think we will use hardware as that software has some caveats and the hardware isn't too expensive.
0
 
Rich RumbleSecurity SamuraiCommented:
TC does not need admin in Traveler Mode, you include the TC.exe on a the plain-text unencrypted portion of the USB, and use the executable on any machine and not need to install. Hardware is the more obvious choice over BL because you don't need to install any software (typically, but some do, like Kingston has a central manager, can't use the USB without it).
I like the kinds with keypads: http://www.apricorn.com/products/hardware-encrypted-drives/aegis-secure-key.html
Don't believe a drive that is certified FIPS140-2 is better than any other: http://www.h-online.com/security/news/item/NIST-certified-USB-Flash-drives-with-hardware-encryption-cracked-895308.html
Nonetheless I prefer TC or FreeOTFE over BL and or Hardware, and you already know I don't use Admin rights anywhere :)
-rich
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
McKnifeAuthor Commented:
Rich, Truecrypt portable was tested. It does need Admin rights to use encrypted containers, see http://www.truecrypt.org/docs/truecrypt-portable
You need administrator privileges in order to be able to run TrueCrypt in portable mode
0
 
Rich RumbleSecurity SamuraiCommented:
It doesn't for us... Maybe you can try FreeOTFE which works the same way, place the executables and dll's on the plain-text partition of the drive, and create a container there too: http://sourceforge.net/projects/freeotfe.mirror/
Both work on User accounts, not power not admin... hmm TC doc's need updated or we are not talking about the same thing. We don't use any wizard, we just copy the files to the USB and create a file/container there...
-rich
0
 
McKnifeAuthor Commented:
That's the same we do.
You are a local admin and UAC is off or it's xp, right? ;)
0
 
McKnifeAuthor Commented:
I think I know what your "problem" is: you are testing it on computers that also have truecrypt installed, right? Then the driver is already loaded automatically at startup, that's why no admin rights are needed for portable TC in your case.
Right?
0
 
Rich RumbleSecurity SamuraiCommented:
I'll triple check, I doubt we are including the drivers for TC in the image, but just in case I'll have a look. FreeOTFE I can confirm does not need admin to do the same portable drive.
-rich
0
 
McKnifeAuthor Commented:
Fact is, TC 7.1a does not work on x64 OS (Vista/win7) in portable mode without administrative rights. Neither does free OTFE as it does not support x64 at all.
0
 
Rich RumbleSecurity SamuraiCommented:
Yeah looks like IT slipstreamed the MSDN ISO's with the TC driver! FreeOTFE hasn't been developed in some time now. There is always encrypted containers like GPG or even 7zip.
hardware is the most universal, but it was discounted at the onset of the question, I'm all for it being deleted.
-rich
0
 
McKnifeAuthor Commented:
self-solved
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

  • 6
  • 5
Tackle projects and never again get stuck behind a technical roadblock.
Join Now