SafeConsole Secure USB Management Server

Remote Password Reset

Reset passwords remotely over any channel. Administrators can get remote offline users back to work within minutes, without any loss of stored data. The short 8-character recovery codes are easily read over the phone yet maintaining the robust security of a 128-character code using a pre-buffer method. No data is lost and the process is protected against social engineering directed against the helpdesk. The user password is never exposed and there is NO master password. Read the Password Management Best Practice Paper.

Password Policy

Ensure that all data is protected by strong, compliant passwords by enforcing password policies on the devices

Secure Self-Service Password Reset and Unlock with ZoneBuilder

With ZoneBuilder enabled, a user can reset a forgotten password on a trusted user account. This radically lowers support costs while still remaining as secure as the user account. The ZoneBuilder uses a unique certificate to unlock the drive on the trusted user account. The certificate can be stored on the trusted user account or on a smartcard device.

Web Login – One Click Logins

Save time and add safety by enabling one-click log-in from the unlocked device to users’ preset web mail (such as Outlook Web Access) or other web service. Protects against key loggers.

Device Auditing – See Who Did What, When and Where

Device auditing makes taking stock of the entire portfolio of SafeConsoleReady devices easy as it creates an automatic inventory list. The logs then include unsuccessful unlocking attempts, device states and log-ins. This gives the administrator a full overview of all drives in use in the organization.

File Audit Trail – Achieve Compliance Requirements

File Audit Trail is an extension of the Device Audit. It allows an administrator to see what files have been copied to or deleted from the devices, as well as a trail of the files that have had their names changed.

Device State Management – Full Control Over Devices

As an extra security precaution when drives are lost, or to protect your organization’s sensitive information from access by former employees, you can remotely ‘kill’ rogue drives and erase them of all data. In the Device Overview in SafeConsole, an authorized administrator can set the device state to ‘killed’, ‘disabled’ and ‘lost’. Devices can later be recovered using the Remote Password Reset and/or Backup features. SafeConsole can also be set to handle the devices’ states entirely on autopilot. This will require the drives to return to base by connecting to the SafeConsole server within a configurable time period.

Content Audit – Full Content Traces

An administrator can recreate the current content of a device for auditing purposes. Data tracing puts a powerful tool in the hands of the administrator that can play a crucial role in resolving a multitude of situations such as crisis management.

Inactivity Lock – Forgotten Drives Lock Down

Preset (and override the users’ own settings for) the Inactivity Lock to lock down the secure USB drive after a configurable number of minutes. If a user forgets an unlocked drive in a computer, the drive will automatically lock down in accordance with the set policy.

File Restrictor – Restrict File Types to be stored EXE, MP3

By taking a white-list approach to preventing storage of unauthorized file-types the FileRestrictor relieves the users from protecting their device. Rogue files can simply not reside on a SafeConsoleReady Device as it only allows storage of file-types specified by the administrator in the SafeConsole settings.

Authorized Autorun – Stop Autorun Viruses

The onboard autorun-protection that chokes self-copying viruses such as StuxNet and Conficker – by denying unauthorized autorun files from residing on the drive altogether.

Write Protection – Set Devices in Ready-Only Mode

With Write Protection, users can set their drive in a read-only mode when unlocking it on non trusted machines and thereby gain protection from malware trying to infect the drive or its content. It is also possible for an administrator to enforce this protection when a user leaves the company network ensuring that no malware can be copied to the drives and brought back to the company.

Sophos Antivirus for SafeConsoleReady Devices

The SafeConsoleReady Sophos Antivirus is deployed onto existing SafeConsoleReady drives by the SafeConsole server administrator and offers the device end-user a quick and resource effective, on access protection against malware on and off the corporate network. This is the first enterprise mature antivirus solution made available for secure USB drives.

Smart Backup and Recovery

A lost drive or an inadvertently overwritten file would normally make you lose hours of work. In the event of a lost SafeConsoleReady device, an administrator can easily recreate the drive by sending its backup and settings to a new device. The continuous incremental backup is a transparent procedure that does not affect the users’ everyday routines or work. The recreate procedure is handled remotely and involves no end-user actions other than plugging a SafeConsoleReady drive into their machine. The versioning of the backup information makes it possible to retrieve a file that was accidentally erased or overwritten.

Web Login – One Click Logins

Save time and add safety by enabling one-click log-in from the unlocked device to users’ preset web mail (such as Outlook Web Access) or other web service.

EasyShare – Share Files, Not Passwords

EasyShare enables a social-engineering proof solution where the users can share the few intended files by setting them aside and protecting them by a temporary PIN. The rest of the secure files stay protected by the user’s regular strong, exclusive password.

Secure Quick Automatic Unlock with ZoneBuilder

When your users have entered a username and password to log on to their workstations they get automatic access to their secure USB drive using a trusted certificate on the account(or their smartcard). On any other machine the user will enter the regular device password when prompted for it.

Device Lockout – Quick Port Control

Device LockOut complements your secure USB drives by ensuring the network administrator that no other USB storage devices can access your network. Device LockOut enforces a policy decision to exclusively use SafeConsoleReady USB drives as removable storage on all selected end points in the network.

DeviceDiscovery – What Is Your Status?

Track the usage of all USB connected removable storage media within your organization. The free DeviceDiscovery command line tool searches through and generates a report containing all devices used within the entire domain, when they were last used and to which computers they have been connected. Request the software here

Authorized Autorun – Stop Autorun Viruses

To prevent the spreading of autorun malware a SafeConsoleReady device always overwrites the autorun.inf files stored on the encrypted storage volume, which chokes the effect of viruses such as Conficker. To still be able to have authorized applications autorun off the devices, you can specify trusted commands in SafeConsole. That way you can keep the benefits and convenience of autostarting working-tools, but disallow a gateway for malware infection.

Device User Information

Customize the devices with user information for identification and secure lost and found, thus saving time and pain.

By defining “token” questions, a SafeConsole administrator can ask device users to enter unique information about themselves. The “token” information allows the administrator to create a custom message about the user in the “About” window. This can be used, for example, to identify whose device was left behind in the company conference room, without needing permission to unlock the drive.

An autostart application that requires a password to start can also make use of “token” information by letting one of the tokens be the necessary password. This way the application can start up without any interruption.

Device User Settings

Tailor the SafeConsoleReady device to your organization’s and users’ needs by changing specific settings on the user device. Device User Settings enable you to disallow users from factory-resetting their devices. It is also possible to enforce a preselected user interface language and to preapprove the device warranty to get quicker device deployment times.

Suppress Volume Browser on Citrix

Mainly organizations running Citrix thin client this will make sure that the Explorer Volume Browser does not interrupt the user when the device is unlocked.