Sophos SafeGuard Disk Encryption Advanced
Combining the two SafeGuard modules SafeGuard Device Encryption and SafeGuard Native Device Encryption

Overview:

The new SafeGuard Disk Encryption Advanced subscription license provides users with a convenient licensing solution for full disk encryption. Combining the two SafeGuard modules SafeGuard Device Encryption and SafeGuard Native Device Encryption makes this the ideal subscription offering when customers for example use a mix of operating systems or are migrating from legacy versions of Windows to Windows 7 or 8/8.1. For added convenience, SafeGuard Disk Encryption Advanced is licensed per user instead of per device.

SafeGuard Native Device Encryption (formerly SafeGuard Partner Connect)

For the fastest, easiest and most reliable full-disk encryption, the SafeGuard Native Device Encryption module takes advantage of the encryption technology built into the operating system. Seamlessly manage keys, recovery functions and security policies on Microsoft BitLocker- and Apple FileVault 2-encrypted drives from the SafeGuard Management Center.

SafeGuard Device Encryption

For the cases where BitLocker is not available or suitable, the SafeGuard Device Encryption module uses Sophos' industry leading encryption technology for fast and secure full-disk encryption that is certified by organizations across the world (FIPS, CC EAL4 and more). Encryption is completely transparent and it integrates in the Management Center alongside all other devices.

Other modules

To cover a broader range of operating systems and scenarios, the SafeGuard Disk Encryption Advanced subscription also contains the module SafeGuard Disk Encryption for Mac (OS X 10.5 to 10.7).

Features:

Strong, transparent encryption

• Get sector-based encryption of disk volumes. This includes the Mac OS boot volume and data volumes.
• Protects your sensitive data with our strong, standardized AES 256-bit encryption algorithm.
• Your encrypted data cannot be accessed, even if the hard drives are removed from the Macs. Only your authorized users or security administrators have access to your data.
• Highly optimized algorithms include support for Intel's AES-NI instruction set extensions in Core i5 and i7 processors.

Secure power-on authentication and authorization

• Our EFI-based, power-on user authentication (POA) requires a username and password. Only after your users successfully logon will the encrypted volume boot and be readable.
• Hardens the log-on process. Prevent password penetration attacks.
• Generates comprehensive logs of user interactions during the power-on, authentication process, including failed logon attempts.
• Provides multi-user power-on authentication for shared computers.
• SafeGuard administration—independent from OS X ("sudo") administration—enforces the separation of duties between system and security administration.
• Maintain the Mac look and feel with our user-friendly, graphical power-on authentication UI.
• Allow your users to retain password privacy while still accessing their machines. Administrator accounts allow IT to securely access computers without requiring user passwords.

Flexible administration

• Our GUI on the client allows for simplified user management and disk management.
• SafeGuard Management Center integration lets you keep an eye on compliance. Get full visibility into your encryption status on the Mac.
• Track your encryption status and progression using our Finder/System Menu icon.
• Capture scripting and remote administration and status reporting using our command line tool (e.g., through ARD or third-party PC lifecycle management systems).
• Requires SafeGuard administrator credentials for changes to POA user accounts and disk-encryption status. Allowing the registering of multiple independent admin accounts prevents bottlenecking.
• Stores full audit trails of POA interaction and SafeGuard administrative actions in the OS X secure log.

Secure recovery of passwords, data and systems

• One-time recovery credentials allow you to secure access systems and renew forgotten passwords.
• Create emergency POAs on a USB key or CD. Securely boot and unlock your Macs with damaged EFI partitions.
• Our secure emergency volume decryption option is available at the POA. Know that you can easily access and repair damaged operating systems.

Easy deployment

• Our small ".dmg" installation package suits local and remote install.
• Installation of the client is simple and fast. It requires no prior knowledge or document studies. Once you install the client software and create an administrator account, create the necessary user accounts with a few clicks or through the command line. Finally, a credential and/or kernel backup for future recovery purposes completes the installation.
• Initial encryption runs transparently in the background. You can securely resume the initial encryption after powering down or a hard-reset of your Mac. If you don't need foreground responsiveness from your computer during initial encryption, try our "Fast" mode.

Specifications:

Operating systems

• Windows 7 (32 and 64 bit)
• Windows Vista (32 and 64 bit; SP 1, SP 2)
• Windows XP (32 bit; SP 2, SP 3)
• MAC OS X 10

Cryptography

• Uses FIPS 140-2 validated cryptography
• AES.NI hardware support
• Symmetrical encryption: AES 256 bit

File systems

• Supported file systems: FAT, NTFS, DFS, CD, DVD
• Supported file servers: Windows 2003/2008/2008 R2

Language versions
English, French, German, Italian, Japanese and Spanish Unicode-based support for other languages

Documentation:

Download the Sophos SafeGuard Enterprise Data Sheet (PDF).

Download the Sophos SafeGuard Disk Encryption Advanced Data Sheet (PDF).