Policies

User and Group Policies

Overview

Before users can use Smartcrypt successfully, system administrators must establish effective data encryption policies. Smartcrypt policies, defined on this tab, are responsible for controlling the end user experience, configuring and locking program options and most importantly, specifying administrative policy keys for use by Audit, Discovery and Data Loss Prevention (DLP) people, processes and technology.  

Each client device's agent application checks in with the manager at a standard (configurable) interval.  When the client checks in, Smartcrypt Enterprise Manager (SEM) applies any policy changes. Policy order on the Policies page is important; the client agent processes the Policies list from the top down. The agent uses the first one that applies to its particular user. Each policy has a defined scope of users that it applies to. When group policies are applied to a client, those policies always override the site-wide policy. If no policy is defined for a particular user, they will receive the site-wide-default policy.

For example, let's say you want to define a policy that applies to your Admin group, composed of one person from each of your departmental groups (Sales, Executive, Marketing, IT). When you add a new policy, it assumes the top position. For the Admin group policy to be applied to those departmental representatives, you should define the departmental policies first. Otherwise, you can adjust the processing order by dragging policies Up or Down in the Order column. The Site-wide Default policy cannot be re-ordered.

Most policy controls will have four drop-down options:

Affected policy controls and their default settings are listed in this table.

For administrative access to enterprise-wide encrypted content, Smartcrypt supplies two options for customers. Contingency Keys and Contingency Groups. A contingency key is included with any encrypted file created in an organization, and can be opened by anyone with access to the contingency key's private key. A Contingency Group allows all members of that group to open files encrypted by the other group members.

Contingency Public Keys

Contingency keys enable an organization to decrypt files encrypted by anyone in the organization, whether the files were passphrase-encrypted or were encrypted for specific recipients.

Contingency keys are third-party OpenPGP or X.509 formatted public keys that will be automatically included in every encryption operation performed by Smartcrypt.  These can be keys that you generate outside of the Smartcrypt ecosystem in accordance with your organization's security policy.

Whether the files are password-encrypted or encrypted for specific recipient public keys, contingency keys provide a safeguard to be sure that important information belonging to the organization does not become inaccessible because no one in the organization can decrypt it.

Contingency keys must use RSA-2048 (or stronger) encryption. To add a contingency key to Smartcrypt Enterprise Manager (SEM) for use in a Policy:

1. Go to Archive > Policies.
2. Click Add in the Contingency Public Keys section.
3. Browse your system for the public key file.
4. Click Upload.

When you need to open a file encrypted with a contingency key, be sure the private key is accessible.

Changing a Key Name

SEM uses the key file name to identify the Contingency Key. If you wish to change this Name, click Edit and type in the new Name.

Defining Policy

Smartcrypt provides a default Site-wide Default policy that Admins can edit. To add a group policy, you enter a similar form, but you will need to define the Group that the policy applies to.

General Settings

These settings regulate how often clients must connect with connect with Smartcrypt Enterprise Manager (SEM) for different purposes.  

FIPS Mode

FIPS is an abbreviation for Federal Information Processing Standards, a set of standards for information processing in federal agencies in the United States. In FIPS 140 mode, encryption and decryption are done using only encryption and hashing algorithms that have been validated for compliance with FIPS 140-2 security requirements for cryptographic modules by NIST (National Institute of Standards and Technology), a branch of the US government.

Click your preferred FIPS compliance options. Your selection will turn a bright blue; this is the default for clients that this policy applies to. The site-wide policy by default displays all the options, allowing clients to change from the default. To enforce just one selection (such as Use FIPS 140 Mode), delete the remaining options.

Note: FIPS mode is not supported on MacOS X.

Integration

If your user receives a ZIP archive with a single file in it, often they will want to open and read the zipped file without having to manually extract (decompress) it first. With the Integration section, administrators can define a set of file extensions that will automatically open. A default set of extensions, including Microsoft Office files, PDF and graphics files, are included.

To add a file type to the list, type the extension into the edit box. You'll be asked to confirm the addition.

To remove a file type from the list, select the extension by clicking the box and press Delete. You may undo the choice.

Save changes as soon as possible

By default, when someone opens a single-file ZIP archive, the ZIP container stays open until the file is closed. If the user makes changes to the file, the archive container doesn't record the change until the file is closed and returns to the container. Use the drop-down menu to change the policy to allow users to edit documents and update the archive.

If your policy allows this feature, client Office Integration settings will display this option; the user can turn this on or off. If your policy requires the feature, the setting will be checked; the user cannot change this. If your policy Disables the feature, the setting will not display in the client.

Caution

If the user continues making changes in the file while Smartcrypt is saving the previous changes, the data in the ZIP archive could be corrupted. It is always safer to enable the default behavior.

File Collaboration Options

These options set priorities for when single-file ZIP archives are auto-opened, accessible to anyone.

Collaboration Mode: Anyone can open and view a document inside a single-file ZIP, but only the first person to save a single-file archive is allowed to edit/change/save the source file. If others attempt to save changes, they are prompted to save a new ZIP, which can be merged into the original document later.

Exclusive Mode: Only one user can open and edit a document inside a ZIP. Anyone else attempting to open and read the document in this file will get an announcement that the file is open. They may optionally ask to be notified when the archive is available.

Collaboration and Exclusive Mode: If a file is auto-opened, Collaboration Mode applies. All other file types operate in Exclusive Mode.

No Collaboration Mode: Anyone can open an archive and view its content. If a second person opens the file (in read-only mode), the first person cannot save changes to the archive.

Caution

If Save changes as soon as possible and Collaboration Mode are both enabled, it's possible that two separate versions of the same document may exist. That is, User #1 opens DocumentX.docx, and while that document is being edited, User #2 opens DocumentX.docx, edits the same section. Both users save the document into a ZIP archive. User #3 might not know what wording is correct.

Users / Groups

Use these settings to define who is subject to this Group Policy.

Advanced Definitions of Users and Groups

Admins can use Boolean expressions to identify people and groups that expand beyond the limits of standard Active Directory Groups. You can select multiple users and groups, exclude some users with the NOT operator, and add other users

In this example, the LargeData Marketing group is the Group that this policy applies to, but the policy excludes user mig1@qanet.com.

To generate this result:

1. Click

   

   In the Users/Groups field to display your options.
2. Start typing the name of the User or Group you want to apply this policy to. Smartcrypt Enterprise Manager will display a list you can select from.
3. Click Add Row.
4. In the left-most field, change to User.
5. To exclude a user, change the second field to not equal.
6. Start typing the user name and select the user you want to exclude from this policy.
7. At the top, change the Boolean operator. By default, the OR operator is selected. Change this to AND.
8. Click outside the box to confirm the changes.

Note: The Smartcrypt Manager will query Active Directory to auto-complete an entry.

ZIP File Creation

Set encryption and signing policies for creating ZIP archives with the following.

Alternate Data Streams

In a sense, a file is a stream of data stored on a hard drive. When you open a file, the stream takes up space in a computer's memory. On modern Windows computers using the NTFS file system, individual files can contain multiple data streams. The content of a file is one data stream, but the same file can contain one or more alternate data streams. In the relatively rare instance that an alternate stream is created, it usually contains additional information about a file. For example, when Internet Explorer downloads a file from the Internet, it adds an alternate stream noting that the file originated outside the local network. Smartcrypt always retains this stream in archives. These streams are not common, but can add size to a file.

Encryption

Administrators can choose whether to require every ZIP archive to be encrypted, and whether to allow users to Skip encrypting files on a case-by-case basis. Default: Allowed (default on)

Algorithm

Smartcrypt supports AES in several key lengths as well as AE2 (256-bit) and 3DES (168-bit). By default, Smartcrypt uses the strongest available algorithm and key length (AES-256). This displays in bright blue. Other allowed key lengths are displayed in a grayer blue. Admins can delete any algorithm to prevent its use.

Passphrase

Smartkeys

Default: Allowed (default on)

In addition to the basic usage settings, these options are available when Smartkeys are allowed:

Certificates (X.509)

Default: Allowed (default on)

If you allow users to employ public key encryption In addition to Smartkeys, check the appropriate box to configure these options:

Strict Checking Options

Signing and Certificate Options

Default: Allowed (default on)

OpenPGP File Creation

OpenPGP File Creation is optional in Smartcrypt. If you want to permit clients to create OpenPGP files, check Allow OpenPGP file creation.

Configuring Passphrase Complexity

To secure passphrase-encrypted files, use passphrases that are long enough and are not easy to guess. Smartcrypt helps administrators set requirements for both minimum and maximum passphrase lengths. Check the Enforce passphrase complexity rules box to do this.

For example, you can require a minimum passphrase length of 15 characters, or even 260 characters, instead of the default minimum of eight. Whenever your user encrypts with a passphrase, Smartcrypt enforces your rules by rejecting any proposed passphrase that does not comply.

You define these requirements after checking the box:

Configuring Contingency Keys

Choose from a list of existing contingency keys associated with this installation.

To define a contingency key, return to the main Policies page and click Add New Contingency Key.

Configuring Contingency Groups

A Contingency Group allows all members of that group to open files encrypted by the other group members. Choose from a list of Active Directory users to define Smartcrypt users that will be able to decrypt all information encrypted by users in this policy.

Outlook Plugin Policy Settings

The Smartcrypt Desktop application on Windows has a plugin that can run to control encryption operations for outgoing email in Outlook. There are several policies that dictate the use and control of the encryption settings.

Check the Enforce Outlook Integration box to set policy options for the Smartcrypt Outlook  Plugin. The following options will display.

General Settings

Mail Encryption Settings

Use these settings to determine how Microsoft Outlook encrypts email message under this policy. Any changes made here to encrypting with Smartkeys, X.509 certificates or passphrases will apply to all Outlook messages, regardless of how encryption behaves outside of email.

Click inside the Email Encryption Options box to activate any of these option settings: PKWARE Identity, Certificates, Smartkey or Passphrase. Whatever you activate is available to Outlook users; to require an encryption option, click your choice again.

Depending on how SEM is configured, PKWARE Identity may not appear.

When you activate one or more options, these settings appear:

Recipient Filtering

Recipient filtering allows for specific rules to apply based on who the email is being sent to. The Smartcrypt Outlook Plugin can scan the To, and Carbon Copy (CC) fields and mandate certain Smartcrypt Outlook Plugin actions occur based on recipients.

To enable recipient filtering, type the email address to filter in the field next to the action you want done. Use wildcards to identify multiple addresses, as you see in the following example.

Example Recipient Filtering Rules

In this example, any email addressed to legal@pkware.com will automatically apply the action to encrypt message body and attachments, regardless of what the user has selected.

An email to any other @pkware.com email address will skip all processing. In this example, all email to @pkware.com except to the legal mailbox would be un-encrypted, and un-compressed.

You can further define any other Internal Mail Recipients to ensure that your organization's users skip any special handling for external recipients.

External Recipient Handling

These settings force users to take extra care when emailing people outside your organization. Check the Configure external recipient warnings box to display these settings.

Use the following check boxes to prompt your users (under this policy) when these conditions apply:

Prompt user on ...

• Emails to external recipients
  
• Emails to external recipients with attachments
• Meeting invitations to external recipients
• Meeting invitations to external recipients with attachments

By default, all these conditions are enabled. Clear the box to turn off the prompt.

When any of these boxes are enabled, you can configure how much information is included in the user prompt.

• Display Recipient Expand Limit: When a user mails content to a list of external recipients subject to the policy, Smartcrypt will display all the addresses in the list by default, where the user can deselect individual recipients from processing. As an admin, you can define a top limit of how many individual emails to display. If, for example, the recipient list contains 1500 external addresses, you may not want Smartcrypt to individually process all of them to check for existing Smartkeys. With this setting, you can limit the number of list recipients to display.
• External Email Recipient Prompt Instructions: Type the message you want to display when prompting the user. Tell the user what to do next. You are allowed to use Mini HTML rich-text features, including bold, underlined and italic formatting, line breaks <br>, and changing text fonts and colors in these instructions.
• Distribution Exemptions: If you have a large distribution list, such as an "All Employees" list, type the list address (such as AllEmployees@MyCompany.com) here to prevent Smartcrypt from displaying every name in the list.

Content Filtering

Content filtering allows you to mandate a Smart Filter Bundle for Discovery purposes. Click in the Discovery Filter field, and use the drop-down menu to display the current list of Smart Filter Bundles (defined on the Discovery page). Select a filter bundle, or leave it blank.

For more complex filtering, click

Check Override Recipient Filtering to resolve conflicts between the actions mandated by the Discovery Filter and the actions mandated by the Recipient Filter.

You can also identify Outlook elements to apply Discovery rules to. These elements are activated by default:

• Email Subject
• Email Body
• Email Attachments
• Meeting Subject
• Meeting Body
• Meeting Attachments

Advanced Discovery Filters

Admins can use Boolean expressions to identify people and groups that expand beyond the limits of standard Active Directory Groups. You can select multiple Smart Filter Bundles, exclude some items with the NOT operator, and add others. In this example, the filter will search for all Personally Identifiable Information, but not credit cards or Social Security numbers.

To generate this result:

1. Click

   

   in the Smart Filter Bundles row to display your options. The icon changes to

   

   .
2. Start typing the name of the bundle. Smartcrypt Enterprise Manager will display a list you can select from.
3. Click Add Row.
4. To exclude a subset of information, change the second field to not equal.
5. Again, type the bundle to select the information you want to exclude.
6. At the top, change the Boolean operator. By default, the OR operator is selected. Change this to AND.
7. Click outside the box to confirm the changes.

Outlook Plugin Behavior Settings

The Outlook Plugin has some basic behaviors that trigger a different user experience. The same 4-state drop down options apply here as well (Allowed On, Allowed Off, Required, Disabled) to the following options:

If a standard name is required for all ZIP attachments (to possible be allowed through a mail gateway or to skip some other processing), a standard name can be defined as well by entering a name in the Default Zip Name field.

MacOS Settings

Performance Management

Agent/Service

This setting can be enabled from the support page:

Cloning a Policy

Administrators can develop very finely-grained policies. Policies can be applied to individual users and groups, defined narrowly or widely. As an administrator, you might find that an effective set of permissions for one group simply do not work for one group. In cases where administrators want to tweak some policy settings for some users, you can Clone a policy to copy all its settings in a separate policy. You can then use the cloned policy as a template for the clone. When you have completed changing the settings in the clone, save the changes.

In the User and Group Policies section, click Clone to the right of the Policy you want to serve as the template for your new version. The new policy is named "Policy cloned from <original policy name> at <timestamp>.

You can then Edit the cloned policy as you would any other.

Note: You do not need to clone the Site-wide Default policy. It is the template for any new policy.

Performance Policies

Performance policies are policies that can be defined to customize the performance consumption by PKWARE clients. When policies defined here can be applied to clients by selecting devices on the "Archive/Devices" page and selecting a performance policy. It is recommended to read Microsoft's documentation on scheduling priorities here and that these policies be tested in lab environments before they are deployed in production.

You can Clone a policy to copy all its settings in a separate policy. You can then use the cloned policy as a template for the clone. When you have completed changing the settings in the clone, save the changes. In the User and Group Policies section, click Clone to the right of the Policy you want to serve as the template for your new version. The new policy is named "Policy cloned from <original policy name> at <timestamp>. You can then Edit the cloned policy as you would any other.

The "Default" policy settings are what all PKWARE clients start with unless given a different performance policy. These default settings include "Normal" thread priorities for both the agent and discovery. There are three PKWARE pre-defined performance policies that can be customized,

• Normal User Workstation - Designed for a standard user workstation that will keep Agent thread priority at "Normal" and the Discovery Thread Priority at "Below Normal"
• Minimal User Workstation - Created for user work stations with less resources and therefore may require PKWARE clients to consume reduced resources.
• Dedicated Server - Meant for stand alone server machines that are dedicated to running Smartcrypt clients with lockers or assignments. Agent thread priotiy and Discovery thread priority are set to "Above Normal" with a higher worker max count and redaction process count.