Sophos SafeGuard Disk Encryption for Mac

Overview:

Strong full-disk encryption for Macs

Protect private and confidential data on MacBooks and Apple desktop computers with full-disk encryption that is transparent and easy to use. If a SafeGuard-encrypted Mac falls into the wrong hands, the data is inaccessible even if the hard disk is removed and connected to another computer.

Whether for a single MacBook or for a mix of tens of thousands of Apple and Windows PCs and laptops, the SafeGuard product family allows easy implementation and enforcement of data protection.

Protect data on lost or stolen Macs
Protect your data on MacBooks and Apple desktops with full disk encryption that's easy to use and to deploy. SafeGuard encrypts Macs to protect from data breaches, even if the computer is lost or stolen.

Stay compliant with data security regulations
SafeGuard encrypts the entire disk, including the operating system, page files and data. It provides secure power-on authentication for multiple users as well as comprehensive logs of encryption status and user activities. Even if the hard disk is physically removed, your data is secure.

Maintain end-user productivity
SafeGuard for Mac works quickly in the background for user-transparent encryption. Users can recover their forgotten passwords or data in emergencies. The Mac-style graphical interface enhances the end-user experience.

Improve IT efficiency
With a small standardized install file, SafeGuard features simple local or remote deployment. Its simple administrative features — managed via graphical user interface or command-line scripts — are compatible with Apple Remote Desktop and other administration tools. SafeGuard also allows for automated creation of admin and user accounts.

Key benefits

• Unmatched data security with proven encryption algorithms to protect lost or stolen Macs
• Encryption of operating system including page files for complete security
• Fast, user-transparent background encryption for high productivity
• Powerful controls for administration and recovery includes power-on authentication
• Comprehensive logging for compliance reporting
• Full set of recovery tools that provide multiple recovery options
• Easy administration and deployment with both UI and scripting options
• Supports Apple's Boot Camp for compatibility with Windows

Features & Benefits:

Strong, transparent encryption

• Sector-based encryption of disk volumes, including the Mac OS boot volume and data volumes
• Strong, standardized AES 256-bit encryption algorithm
• Encrypted data cannot be accessed even if hard drives are removed from Macs, except by authorized users or security administrators
• Highly optimized encryption/decryption algorithms, minimal performance impact

Secure power-on authentication and authorization

• EFI-based power-on user authentication (POA), with username and password,which allows the encrypted volume to boot and be read only after a successful logon
• Hardened log-on process, which prevents password penetration attacks
• Comprehensive logs of user interactions during the power-on, authentication process, including failed logon attempts
• Multi-user power-on authentication for shared computers
• SafeGuard administration independent from OS X ("sudo") administration, enforcing separation of duties between system and security administration
• User-friendly graphical power-on authentication UI with Mac look and feel
• Administrator accounts that allows IT to securely access computers while end users retain password privacy

Flexible administration

• GUI on the client for user management and disk management
• Finder/System Menu icon for encryption status and progress
• Command line tool for scripting and remote administration and status reporting (e.g., through ARD or third-party PC lifecycle management systems)
• SafeGuard administrator credentials required for changes to POA user accounts and disk encryption status; multiple independent admin accounts can be registered
• Full audit trail of POA interaction and SafeGuard administrative actions stored in the OS X secure log

Secure recovery of passwords, data and systems

• One-time recovery credentials to securely access systems and renew forgotten passwords
• Ability to create emergency POA on a USB key or CD, to securely boot and unlock Macs with damaged EFI partitions
• Secure emergency volume decryption option available at the POA, to enable easy access and repairs to damaged operating systems

Easy deployment

• The small ".dmg" installation package is suitable for local and remote install.
• Installation of the client is simple and fast. It doesn't require prior knowledge or document studies. Once the client software is installed, an Administrator account and the necessary user accounts are created with a few clicks or through the command line. Finally, a credential and/or kernel backup for future recovery purposes completes the installation.
• Initial encryption runs transparently in the background. Secure resume of initial encryption after power down or hard-reset of the Mac. "Fast" mode available if foreground responsiveness of computer during initial encryption is not needed.

System requirements:

Hardware¹

• MacBook Pro, MacBook, MacBook Air, Mac Pro, iMac, Mac mini
• 40 MB free disk space

Operating system

• OS X, 10.5.x, 10.6.x
• Keyboard support

Language support

• English, French, German
• Runs on all international OS X languages

Interfaces

• Command line tool for scripting and remote administration
• GUI for intuitive local administration

Standards

• Encryption: AES-256
• Key Derivation: PKCS # 5v2
• Hash functions: SHA-256

1 Intel-based systems/EFI 32- and 64-bit.

Platforms supported	x86 32-bit	x86 32-bit	IA-64 (Itanium) 64-bit	Minimum disk space	Minimum memory
Sophos SafeGuard Disk Encryption for Mac for full disk encryption
MAC OS X 10.6 (Snow Leopard)				40 MB	512 MB
MAC OS X 10.5 (Leopard)				40 MB	512 MB

Documentation:

Sophos SafeGuard Disk Encryption for Mac Data Sheet (.PDF)