The vast majority of business computers use the Microsoft Windows operating system. Most companies have Windows workstations, networked to servers which may also run a version of Windows. Since Windows rules the corporate world, it is a fair question to ask whether it natively provides the security that enterprises need to protect themselves and conduct efficient business operations.
Security software and Soultions at IanWalkerGroup provide a proactive approach to security that integrates information correlation, application analysis and network level defense. It secures both large scale integrations as well as standalone systems.
Security for Standalone systems: BitLocker Encryption
Windows can encrypt entire operating system drives and removable devices with its built-in BitLocker encryption. When TrueCrypt controversially closed up shop, they recommended their user’s transition away from TrueCrypt to BitLocker.
BitLocker Drive Encryption and BitLocker To Go require a Professional or Enterprise edition of Windows 8, or 8.1, or the Ultimate version of Windows 7. However, the “core” version ofWindows 8.1 includes a “Device Encryption” feature that works similarly.
There are two types of BitLocker encryption you can enable here:
- It is a supported version of the Windows operating system. Currently, MBAM supports only Windows 7 Enterprise and Windows 7 Ultimate, Windows 8 Enterprise, and Windows To Go, when Windows To Go is running on Windows 8 Enterprise.
- It is a physical computer. Virtual machines are not supported.
- Trusted Platform Module (TPM) is available. A compatible version of TPM 1.2 or later is required for Windows 7. Windows 8 and Windows To Go do not require a TPM.
Security for Large Scale systems: MBAM 2.5
Overview of Microsoft BitLocker Administration and Monitoring (MBAM)
In MBAM 2.5 we support the use of fully qualified domain names (FQDN) and single MBAM infrastructure managing clients across two or more trusted forests. Organizations around the world rely on Windows® BitLocker® Drive Encryption and BitLocker To Go™ to protect data on Windows 7, Windows 8, Windows To Go and removable storage devices. To make large-scale BitLocker implementations easier to manage, many are turning to Microsoft® BitLocker Administration and Monitoring (MBAM).
Microsoft BitLocker Administration and Monitoring 2.0 – from the Microsoft Desktop Optimization Pack (MDOP) for Software Assurance – takes BitLocker to the next level by simplifying deployment and key recovery, centralizing compliance monitoring and reporting, and minimizing the costs associated with provisioning and supporting encrypted drives within your organization.
Some of the key benefits of MBAM are:
Simplified BitLocker Deployment:
Microsoft BitLocker Administration and Monitoring lets you choose the deployment scenario that makes the most sense for your business. You can provision BitLocker as part of your Windows 7, Windows 8, or Windows To Go deployment or you can configure BitLocker encryption to be provisioned after the operating system is installed. Using the additional Group Policy controls in MBAM, it's easier for IT to provision BitLocker in a way that meets your business needs. The controls are checked periodically and if a device is detected as non-compliant, MBAM will help put it back into the desired state.
With out-of-box reports you can get a better view of your compliance status, enabling you to easily determine if lost or stolen devices were encrypted. IT staff can also create custom compliance reports using built-in SQL Server Reporting Services tools to show them just the information that they need to see. MBAM also provides you the ability to store BitLocker recovery keys in an encrypted database with granular access controls and creates an audit trail of who has accessed recovery key information, keeping this information protected and only accessible to the right people in the organization.
Reduce support costs:
By making it easier for end users to quickly support themselves MBAM will reduce costs by minimizing the burden on IT and support staff. Using the Self Service and Helpdesk recovery portal, users and authorized help-desk staff will find it easy to support recovery scenarios if they run into issues. Also by automating pre-BitLocker setup steps and making it easy for end users to perform basic tasks such as starting the encryption process and managing their BitLocker PIN, your IT staff has more time to help drive your business forward. MBAM’s integration into System Center Configuration Manager also helps reduce costs by enabling you to deploy MBAM within the infrastructure that you’ve already deployed.
Announcing the availability of MBAM 2.5 which includes a substantial update to this BitLocker management solution. Learn more about MBAM 2.5.
Today’s an exciting day for the Microsoft BitLocker Administration and Monitoring (MBAM) team, as we just announced general availability of the Microsoft Desktop Optimization Pack (MDOP) 2014 for Software Assurance, which includes a substantial set of improvements for MBAM. As mentioned in our announcement on the Windows for your Business blogthe big star of the MDOP 2014 release is MBAM 2.5 which is designed to help further reduce the costs associated with provisioning, managing, and supporting BitLocker encrypted devices (Windows 7, Windows 8, and Windows To Go) within your environment.
MBAM 2.0, which was released about a year ago, represented the break through release for the product, and we’ve seen tremendous adoption within organizations of all shapes and sizes including Siemens, BT, General Mills, and Yes Prep Public Schools just to name a few. It’s inclusion of the following features made broad adoption and appeal possible:
Self-Service Portal: The Self-Service Portal helps end users recover devices (e.g.: lost PIN) without the need of help desk assistance
System Center Configuration Manager Integration: Integration with System Center Configuration Manager (ConfigMgr) 2007 and 2012 enables organizations to integrate MBAM’s compliance management and reporting capabilities within your existing ConfigMgr infrastructure.
Windows 8 Support: Support for managing BitLocker on Windows 8 and Windows to Go devices has been included along with the ability to take advantage of new Windows PE capabilities that dramatically reduce encryption times.
With the 2.0 release there seems to be consensus amongst customers that MBAM addresses the vast majority of their key requirements, however with that said there were a number of improvements that many customers were still waiting for us to prioritize. These included:
Support for Federal Information Processing Standard (FIPS 140-2) Improved compliance and enforcement policies Support for enterprise scenarios and topologies
Support for Federal Information Processing Standard (FIPS 140-2)
While BitLocker has a long history of FIPS support MBAM has not supported managing devices in this configuration. MBAM 2.5 changes that by adding support for the two most popular FIPS configuration options for BitLocker. The first option is with the Data Recovery Agent (DRA) protector option which uses a public key infrastructure (PKI) certificate to protect and recover volumes. This option is supported for Windows 7, 8, and 8.1 devices. The second option is specific to Windows 8.1 where the Windows team updated the Recovery Key Password protector to be FIPS compliant. The challenge in previous version of Windows was that the Recovery Key Password was generated using a non-FIPS compliant algorithm and in Windows 8.1 that was updated. This change makes achieving FIPS compliance in Windows 8.1 devices simple to provision and support.
Improved compliance and enforcement policies
MBAM 2.0 was effective at driving high levels of compliance when IT provisioned BitLocker encryption during the imaging process however when unencrypted devices appeared on the network IT’s ability to enforce and move devices into a compliant state was somewhat limited. The challenge was that IT lacked the ability to initiate the encryption process and users had the ability to postpone the encryption process to a later date.
To address this limitation in MBAM 2.5 we’ve included a grace period option that enables IT to define the amount of time that a user has to initiate the encryption process before MBAM will automatically enforce it. If the policy requires TPM-only protection the process will automatically initiate and run in the background, and since the process run as a low priority thread the user very likely won’t notice any performance degradation. If policy requires TPM + PIN protection the encryption process will initiate once the user completes the MBAM client wizard which will require them to provide a PIN before resuming their work. Organizations now also have the ability to prevent postponement of encryption.
Another feature customers had asked about was regarding the ability for users to create easily guessable BitLocker PIN’s. The MBAM 2.5 client now inherently prevents the use of PIN’s composed of sequenced or repetitive values like: 123456, 654321, 456789, 222111, etc. This capability is also supported for Enhanced PIN’s where alpha, numeric, and symbols can be used.
Support for enterprise scenarios and topologies
While MBAM has been deployed in some of the world’s largest and most complex environments there were some topologies and configurations that MBAM 2.5 didn’t support, at least ideally. The first was related to organizations that consisted of multiple forests. To support this type of network topology in MBAM 2.0 required separate MBAM infrastructures within each forest. In MBAM 2.5 we support the use of fully qualified domain names (FQDN) and a single MBAM infrastructure managing clients across two or more trusted forests.
In addition to cross forest support MBAM 2.5 now supports high availability configurations on Windows Server, IIS, and SQL Server. MBAM supports load balancing of its web components using software or hardware based load balancers and its databases can now be deployed to SQL Server failover clusters.
In the end MBAM 2.5 includes something for everyone and it addresses some of the top customer requests that we’ve received over the last year. It even ships with the localized versions on day one so customers no longer have to wait ~6 months for non-English builds! If you’re already running MBAM 1.0 or 2.0 in your environment moving to 2.5 is an easy transition that will provide many new benefits. If you’re not using BitLocker or MBAM today now is the perfect time to start evaluating it for your organization. To learn more about MBAM 2.5 please refer to the product documentationon TechNet.
Installing Microsoft BitLocker Administration and Monitoring (MBAM) allows to choose a topology that integrates MBAM with System Center Configuration Manager. In the integrated topology, the hardware compliance and reporting features are removed from MBAM and are accessed from Configuration Manager.
The integration of MBAM is based on a new Configuration Pack that installs the following three items into System Center Configuration Manager.
Configuration data that consists of configuration items and a configuration baseline
The configuration data installs a configuration baseline, called “BitLocker Protection,” which contains two configuration items: “BitLocker Operating System Drive Protection” and “BitLocker Fixed Data Drives Protection.” The configuration baseline is deployed to the collection, which is also created when MBAM is installed. The two configuration items provide the basis for evaluating the compliance status of the client computers. This information is captured, stored, and evaluated in Configuration Manager. The configuration items are based on the compliance requirements for operating system drives (OSDs) and Fixed Data Drives (FDDs). The required details for the deployed computers are collected so that the compliance for those drive types can be evaluated. By default, the configuration baseline evaluates the compliance status every 12 hours and sends the compliance data to Configuration Manager.
MBAM creates a collection that is called MBAM Supported Computers. The configuration baseline is targeted to client computers that are in this collection. This is a dynamic collection that, by default, runs every 12 hours and evaluates membership. Membership is based on three criteria:
The collection is evaluated against all computers and creates the subset of compatible computers that provides the basis for compliance evaluation and reporting for the MBAM integration.
There are four reports used to view compliance. They are:
BitLocker Enterprise Compliance Dashboard – gives IT administrators’ three different views of information on a single report: Compliance Status Distribution, Non-Compliant – Errors Distribution, and Compliance Status Distribution By Drive Type. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select.BitLocker Enterprise Compliance Details – lets IT administrators view information about the BitLocker encryption compliance status of the enterprise and includes the compliance status for each computer. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select.
BitLocker Computer Compliance – lets IT administrators view an individual computer and determine why it was reported with a given status of compliant or not compliant. The report also displays the encryption state of the operating system drives (OSD) and fixed data drives (FDDs).
BitLocker Enterprise Compliance Summary – lets IT administrators view the status of the compliance of the enterprise with MBAM policy. Each computer’s state is evaluated, and the report shows a summary of the compliance of all computers in the enterprise against the policy. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select.
High-Level Architecture of MBAM with Configuration Manager
The following image shows the MBAM architecture with the Configuration Manager topology. This configuration supports up to 200,000 MBAM clients in a production environment.
A description of the servers, databases, and features of this architecture follows. The server features and databases in the architecture image are listed under the computer or server where we recommend that you install them.
Database Server – The Recovery Database, Audit Database, and Audit Reports are installed on a Windows server and supported SQL Server instance. The Recovery database stores recovery data that is collected from MBAM client computers. The Audit Database stores audit activity data that is collected from client computers that have accessed recovery data. The Audit Reports provide data about the compliance status of client computers in your enterprise.
Configuration Manager Primary Site Server – The Configuration Manager Server contains of the MBAM server installation with the System Center Configuration Manager Integration stopology, which must be installed on a Configuration Manager primary site server. The Configuration Manager Server collects the hardware inventory information from client computers and is used to report BitLocker compliance of client computers. When you run the MBAM Setup server installation, a collection and the configuration data are installed on the Configuration Manager Primary Site Server.
Administration and Monitoring Server - The Administration and Monitoring Server is installed on a Windows server and consists of the Administration and Monitoring website and the monitoring web services. The Administration and Monitoring website is used to audit activity and to access recovery data (for example, BitLocker recovery keys). The Self-Service Portal is also installed on the Administration and Monitoring Server. The Portal enables end users on client computers to independently log onto a website to get a recovery key if they lose or forget their BitLocker password. The Audit reports are also installed on the Administration and Monitoring Server.
Management Workstation - The Policy Template consists of Group Policy Objects that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation that is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. MBAM Client and
Configuration Manager Client computer The MBAM Client performs the following tasks:
Uses Group Policy Objects to enforce the BitLocker encryption of client computers in the enterprise.
Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives
Collects recovery information and computer information about the client computers.
Configuration Manager Client – The Configuration Manager client enables Configuration Manager to collect hardware compatibility data about the client computers, and enables Configuration Manager to report compliance information.