Using The Zenworks Storage Encryption Solution; Understanding The Zenworks Storage Encryption Solution; Sharing Encrypted Files; Section 5.7, "Using The Zenworks Storage Encryption Solution - Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 - ADMINISTRATION Administration Manual

5.7 Using the ZENworks Storage Encryption
Solution
The ZENworks Storage Encryption Solution provides complete, centralized security management of
all mobile data by actively enforcing a corporate encryption policy on the endpoint itself.
The ZENworks Storage Encryption Solution lets you do the following:
Centrally create, distribute, enforce, and audit encryption policies on all endpoints and
removable storage devices.
Encrypt all files saved to, or copied to, a specific directory on all fixed disc partitions on the
hard drive.
Encrypt all files copied to removable storage devices.
Share files freely within an organization, while blocking unauthorized access to files.
Share password-protected, encrypted files with people outside the organization through an
available decryption utility.
Easily update, back up, and recover keys via policy without losing data.
The following sections contain additional information:
Section 5.7.1, "Understanding the ZENworks Storage Encryption Solution," on page 71
Section 5.7.2, "Sharing Encrypted Files," on page 71
5.7.1 Understanding the ZENworks Storage Encryption
Solution
Data encryption is enforced on fixed disk volumes and removable storage devices through the
creation and distribution of data encryption security policies.
When a data encryption policy is activated on an endpoint device, an encrypted Safe Harbor folder is
added to the root directory of any fixed disk volumes on the endpoint. Any data stored in a Safe
Harbor folder is encrypted. Attempts to read the data by anyone who is not an authorized user for
that endpoint device are unsuccessful.
Any removable storage device connected to the device is encrypted. Data placed on the removable
storage device is immediately encrypted and can only be read on endpoint devices in the same
policy group. If desired, you can configure the policy to provide a sharing folder (the default name is
Password Encrypted Files) on the removable storage devices. This folder enables users to share the
folder's files with persons outside their policy group via a password (see
page 91).

5.7.2 Sharing Encrypted Files

Each Management Console contains its own encryption key. Users assigned policies created by the
same Management Console can access encrypted files created by each other. For example, if User A
and User B are assigned data encryption policies created with the same Management Console, User
A can log in to User B's machine (as User A) and access User B's encrypted files. User A can also
read any files on an encrypted removable storage device supplied by User B.
Using the ZENworks Storage Encryption Solution Management Console
"Data Encryption" on
71