gaz629
asked on
Best File Encryption Software
Hi,
background
Server 2012
Windows 10 PCs
I have a law firm client which wants to encrypt its file.
Its worry is that an employee who is leaving will take data with them.
The new practice manager had a software at her old firm which, if a file was copied to a USB drive, it was encrypted.
Please can you recommend such a software? If the software was available as monthly SAAS it would be great.
Thanks
Gareth
background
Server 2012
Windows 10 PCs
I have a law firm client which wants to encrypt its file.
Its worry is that an employee who is leaving will take data with them.
The new practice manager had a software at her old firm which, if a file was copied to a USB drive, it was encrypted.
Please can you recommend such a software? If the software was available as monthly SAAS it would be great.
Thanks
Gareth
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
David Johnson, CD
why don't you must disable access to USB media but allow other items
- Go to the client machine and
- go to start button and type in to search box gpedit.msc
- then your group policy window will open
- left side of window - search Administrative Templates and double click on it
- then click on System
- next you will see Removable Storage Access just click on it
- then you will see lots of group policy name
- see the All Removable Storage Access: Deny All Access
- double click on it and select the option Enable and click on OK button
- you will success to block USB media on that machine
ASKER
Thanks Arana,
It is a domain.
And when this USB stick gets inserted into a non-domain PC, it will be encrypted? Just want to make sure.
It is a domain.
And when this USB stick gets inserted into a non-domain PC, it will be encrypted? Just want to make sure.
Yes, when you take the drive out it will be encrypted, readable only on your domain network, or if you have it setup somewhere else if you have the master key/password
@David I remember that on windows 7 when we wanted to disable USBs using GPO, users could bypass the policy by simply inserting the USB before the computer booted, then once already on windows it would block only newly inserted sticks, but the ones that where there before booting were not restricted, I don't know if this still applies to windows 10.
ASKER
Thank you both, i will take a look and get back to you.
ASKER
OK, my next question.
A user copies a file to their domain laptop, takes the laptop home, connect to a share on a home PC, copies the file to the home PC.
Is the file still encrypted?
A user copies a file to their domain laptop, takes the laptop home, connect to a share on a home PC, copies the file to the home PC.
Is the file still encrypted?
This is where usability and security are at odds.
If the company policy is that laptops must be encrypted then yes it is encrypted BUT the laptop must have cached logins disabled and the user must always connect via vpn (network must be up before login prompt) to decrypt the contents as they are not encrypted while in use. Only at rest.
If the company policy is that laptops must be encrypted then yes it is encrypted BUT the laptop must have cached logins disabled and the user must always connect via vpn (network must be up before login prompt) to decrypt the contents as they are not encrypted while in use. Only at rest.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
BitLocker protects the volume and once you can access the drive, you can also copy the data, using the GPO is just to prevent people from taking the files in a usb device unencrypted, but if they can carry the laptop and are authorized users , then theres little you can do, except maybe configure their laptops to not connect to home networks
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
it is also common to embed macros in office documents so they notify a remote server whenever they are opened. do not think this is bulletproof if you face competent users
No comment has been added to this question in more than 21 days, so it is now classified as abandoned.
I have recommended this question be closed as follows:
Split:
-- 'Arana (G.P.)' (https:#a43189839)
-- 'McKnife' (https:#a43189988)
-- 'skullnobrains' (https:#a43194215)
-- 'David Johnson, CD' (https:#a43189884)
If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.
seth2740
Experts-Exchange Cleanup Volunteer
I have recommended this question be closed as follows:
Split:
-- 'Arana (G.P.)' (https:#a43189839)
-- 'McKnife' (https:#a43189988)
-- 'skullnobrains' (https:#a43194215)
-- 'David Johnson, CD' (https:#a43189884)
If you feel this question should be closed differently, post an objection and the moderators will review all objections and close it as they feel fit. If no one objects, this question will be closed automatically the way described above.
seth2740
Experts-Exchange Cleanup Volunteer