Pointsec® for PC

I am wondering if anyone here has used or even heard of a product called Pointsec® for PC . I met with the sales guys a few months ago and got the "our system is unbreakable" :rolleyes: story. Whenever I hear those words I tend to tune out for the rest of the meeting. Anyways, My CIO is invoking the 'Golden Rule' (he who has the gold makes the rules), and has asked me to bring in a copy and test it out.

Quote:

---

Pointsec's award winning enterprise security product, Pointsec® for PC, ensures that the intellectual property stored on your laptops and desktops remains private and secure.

---

If anyone has got any experience or comments about the product, I'd sure like to hear it.

Thanks
Cheers:

DjM,
Nothing but questions from me.

Has EFS been cracked............(anytime soon)

Does the product do some stuff you can na t do within wiindowzy??

Quote:

---

Originally posted here by jinxy
DjM,
Nothing but questions from me.

Has EFS been cracked............(anytime soon)

Does the product do some stuff you can na t do within wiindowzy??

---

Hey jinxy.

Can't answer the EFS question, I don't know.

As for the product, their claim is the whole is protected and the protection kicks in prior to the boot sequence, therefore taking the OS and all the data out of the picture.

Not sure if that answers your question or not.

Cheers:

Well perhaps, before your company spends some money on a product, it maybe in there interest to see what can be achieved within what they have already paid for??

Quote:

---

Originally posted here by jinxy
Well perhaps, before your company spends some money on a product, it maybe in there interest to see what can be achieved within what they have already paid for??

---

I don't disagree with you jinxy, however, like I said:

Quote:

---

The CIO is invoking the 'Golden Rule' (he who has the gold makes the rules), and has asked me to bring in a copy and test it out.

---

This guy signs the cheques, therefore if he wants me to check something out, it's in my best (career) interests to do just that. That's why I am here asking, I was/am hoping someone here has had some contact with the company and some exposure to the product.

Cheers:

My organisation uses it on our notebook fleet to encrypt the contents of a hard drive so that if the notebook is stolen then the data is not accessible.

Personally we have not had a problem with the security of the product at all and we have found it quite good. I am not involved with deploying or managing it so I can't comment on that side. I have deployed Pointsec ME (Pointsec Media Encrytion) which is another product worth a look from Pointsec and aside from a couple of early hiccups it was fine.

From a security perspective this product has been certified under the common criteria project to EAL 4 level which I guess isn't too bad depending on the classification of data.

See this page under the Data Protection category
http://www.commoncriteriaportal.org/...owcatagories=0

a couple of good pointsec write ups......

https://kb.berkeley.edu/jivekb/servl...tsecdeploy.pdf

http://www.securiteinfo.com/ebooks/p...view083100.pdf

Hmmm,

I have never used the product but it does seem rather "snakeoilish" in its promotional statement. If you are keeping seriously sensitive/valuable "intellectual property" on desktops and laptops you don't need Pointsec, you need to take a long hard look at your security model.

You should NOT have anything sensitive on a laptop............won't anybody learn from the Department of Veteran's Affairs, Japan's DoD and British MI5?:rolleyes:

The first move has to be a risk assessment exercise?...............like exactly what are you trying to protect, how desirable is it, and to whom, how valuable is it, how marketable is it and so on.......................

You don't say, but I would imagine that you are mainly looking to secure laptops?

I must say that my approach is to lean towards layered security:

1. Power up password on an EEPROM chip.
2. Operating System Password.
3. Hard Drive Password (very difficult to circumvent).
4. Drive encryption.
5. Network logon password.
6. Windows network/user security........particularly access and authority.

The real question is exactly what have you got worth stealing, and what would stop a determined individual/organisation from either infiltrating you or bribing/coercing an employee?

Just a few thoughts:D

Quote:

---

Originally Posted by nihil

Hmmm,

I have never used the product but it does seem rather "snakeoilish" in its promotional statement. If you are keeping seriously sensitive/valuable "intellectual property" on desktops and laptops you don't need Pointsec, you need to take a long hard look at your security model.

You should NOT have anything sensitive on a laptop............won't anybody learn from the Department of Veteran's Affairs, Japan's DoD and British MI5?:rolleyes:

---

Oh come now! How dare you suggest they do things PROPERLY! ;)

Hey Jonn-o, long time no see.

I've heard of Pointsec and seen it compared to several other whole-drive/removable-device/all-encompasing enterprise protection/encryption schemes (how appropriate, the word "scheme").

These vendors sell a "silver bullet solution" to these problems, when the problem/opportunity/solution is actually founded in user behavior and corporate/agency policy. Unfortunately (or fortunately, depending on which vendor you are), the way things have gone with the data disclosures and devices thefts in the last 18 months, it's probably better to consider a laptop as a simple thin-client front end for initiating the VPN tunnel into the protected fortress. It's a simple fact that if your data walks out the door (in any format), your odd's of being splashed on the main page of BBC or CNN just rose drastically.

So this may make your manager happy, but I doubt it will actually improve your security posture significantly. If you build it, they will come (and break it). "They" being your users. "Every day, man is making bigger and better fool-proof things, and every day, nature is making bigger and better fools." -- Albert Einstein

Anything that leaves the logio-physical perimeter of your (organizations) direct technical control is at higher risk of theft, accidental loss, and potential disclosure, and no amount of fancy software, hardware, schemas, and sales hullubaloo is going to change that.

And with that, I'm gone for another 3 months! Haha, no, I'll try to hang around more.

Quote:

---

Originally Posted by zencoder

Oh come now! How dare you suggest they do things PROPERLY! ;)

Hey Jonn-o, long time no see.

I've heard of Pointsec and seen it compared to several other whole-drive/removable-device/all-encompasing enterprise protection/encryption schemes (how appropriate, the word "scheme").

These vendors sell a "silver bullet solution" to these problems, when the problem/opportunity/solution is actually founded in user behavior and corporate/agency policy. Unfortunately (or fortunately, depending on which vendor you are), the way things have gone with the data disclosures and devices thefts in the last 18 months, it's probably better to consider a laptop as a simple thin-client front end for initiating the VPN tunnel into the protected fortress. It's a simple fact that if your data walks out the door (in any format), your odd's of being splashed on the main page of BBC or CNN just rose drastically.

So this may make your manager happy, but I doubt it will actually improve your security posture significantly. If you build it, they will come (and break it). "They" being your users. "Every day, man is making bigger and better fool-proof things, and every day, nature is making bigger and better fools." -- Albert Einstein

Anything that leaves the logio-physical perimeter of your (organizations) direct technical control is at higher risk of theft, accidental loss, and potential disclosure, and no amount of fancy software, hardware, schemas, and sales hullubaloo is going to change that.

And with that, I'm gone for another 3 months! Haha, no, I'll try to hang around more.

---

Thanks for the input Zen and nihil, I don't disagree with either of you. Sometimes there is just not a technical solution to a management problem. That said, I am getting more and more pressure as the data theft cases hit the head lines. At this point if they want to spend the money (it ain't cheap) I'll figure some way to implement it. :rolleyes:

Cheers:

DjM................."it ain't cheap"..............so they figure how to implement it:D

I would still look at a composite solution along the lines I enumerated.

Quote:

---

Originally Posted by DjM

Thanks for the input Zen and nihil, I don't disagree with either of you. Sometimes there is just not a technical solution to a management problem. That said, I am getting more and more pressure as the data theft cases hit the head lines. At this point if they want to spend the money (it ain't cheap) I'll figure some way to implement it. :rolleyes:

Cheers:

---

It's not an easy position you are in. Fortunately, the burden is taken off of you if this boss-manager-person says "Here is the budget, you will implement product X".

I would mention the underlying problems, evangelize that while this solution may be a step in the right direction, it is NOT going to remove the risk or liability, and be vocal of your point but supportive of the change.

Hi Zen~ good ta see ya "General McArthur" ("I shall return"):D

DjM you might like to look at the thread "Pointsec Problems" by TurdFirgusson that is in the Cryptography Steganograpy forum at the moment?

Please feel free to PM me if you would like to discuss some aspects in a bit more privacy.............it being your company's security and your bosses brainchild an all:D