Symantec Endpoint Encryption - how encryption for removable media works

[Migration User]

Hello,

Could you please share your experience about encrypting removable media devices?

Symantec.com has the document entitled "How Endpoint Encryption Works". The section on encrypting removable media provides overall information, but it is not enough:

How Removable Media Encryption Works

Removable media encryption software provides the ability to encrypt files on removable storage devices.

When a user copies files of a system onto a removable storage device, each file is encrypted to a password, a shared key or a certificate. At the same time, utilities for Windows or Mac systems can be copied (if permitted by policy) allowing authorized access to data without the endpoint client installed on a machine.

This file encryption can be governed by policy, user action, or Symantec DLP. In the case of Symantec DLP, the Endpoint Prevent software monitors users’ machines and understands when a person is moving a sensitive file off his computer. With the integration of Symantec DLP and Symantec Endpoint Encryption, administrators can ensure files with sensitive information that are moving to removable media are encrypted rather than blocked, allowing business processes to continue in a secure manner.

To access the information, when the user inserts a removable media device like a USB drive with encrypted files into a computer system, the removable media encryption software will prompt for passphrase, and upon successful authentication, the user can access the file.

Does removable media encryption allow to encrypt the whole removable disk, not only files? What are detais (screnarios) on accessing encrypted USB-flash drive without any SEE agent installed?

Thank you. 

[Migration User]

UFO, good morning, I can provide further information for you regarding your questions:

 

Question – part 1: " Does removable media encryption allow to encrypt the whole removable disk, not only files?

Answer – part 1: With SEE RME, the external device will be protected depending on the specific client package settings used. For most customers, a SEE RME client package is used (with default settings) that will protect the entire external drive. So when a file is saved to, extracted from the external drive, all files are encrypted/decrypted/protected. Here is an example of protection settings you may encounter with this product:

Removable Media Encryption secures data in one of the following ways:

• By allowing no access to removable media
• By allowing only read access to removable media
• By automatically encrypting all of the files that you write to a removable media
• By automatically encrypting files according to Symantec Data Loss Prevention
• By encrypting the files

 

Question – part 2: What are details (scenarios) on accessing encrypted USB-flash drive without any SEE agent installed?"

Answer – part 2: Removable Media Encryption also provides you the ability to encrypt or decrypt files on the computers that do not have the Removable Media Encryption functionality. Your policy administrator can enable a policy to copy a utility on your removable media when you connect the media to your computer. With this utility, you can get most of the features of Removable Media Encryption even on the computers that do not have Removable Media Encryption installed.

Also, I have attached a quick start guide for you  on this product in case needed.

 

Does this answer your questions? Thank you

Attachment(s)

symcEE_11.0.0_RemovableMedia_GettingStarted_en.pdf   130 KB 1 version

[Migration User]

Kyle, thank you

Just what was needed. I think more information could be retrieved from hands-on product usage.

[Migration User]

thank you and have a good day