www.microsoft.com/technet/security/topics/crypto/efs.mspx
Summary An Overview of the Encrypting File System The Encrypting File System (EFS) is a component of the NTFS file system o n Windows 2000, Windows XP Professional, and Windows Server 2003. Any individual or program that doesn't possess the appropriate cryptog raphic key cannot read the encrypted data. Encrypted files can be protec ted even from those who gain physical possession of the computer that th e files reside on. Even persons who are authorized to access the compute r and its file system cannot view the data. While other defensive strate gies should be used, and encryption isn't the correct countermeasure for every threat, encryption is a powerful addition to any defensive strate gy. EFS is the built-in file encryption tool for Windows file systems. However, every defensive weapon, if used incorrectly, carries the potenti al for harm. EFS must be understood, implemented appropriately, and mana ged effectively to ensure that your experience, the experience of those to whom you provide support, and the data you wish to protect aren't har med. This document will Provide an overview and pointers to resources on EFS. Name the dangers and counsel mitigation and prevention from harm. The major sources of in formation are the Microsoft resource kits, product documentation, white papers, and Knowledge Base articles. This paper provides a brief overvie w of major EFS issues. Wherever possible, it doesn't rework existing doc umentation; In short, i t maps the list of desired knowledge and instruction to the actual docum ents where they can be found. In addition, the paper catalogs the key el ements of large documents so that you'll be able to find the information you need without having to work your way through hundreds of pages of i nformation each time you have a new question. However, using EF S without knowledge of best practices and without understanding recovery processes can give you a mistaken sense of security, as your files migh t not be encrypted when you think they are, or you might enable unauthor ized access by having a weak password or having made the password availa ble to others. It might also result in a loss of data, if proper recover y steps aren't taken. Therefore, before using EFS you should read the in formation links in the section "Misuse and Abuse of EFS and How to Avoid Data Loss or Exposure." The knowledge in this section warns you where l ack of proper recovery operations or misunderstanding can cause your dat a to be unnecessarily exposed. To implement a secure and recoverable EFS policy, you should have a more comprehensive understanding of EFS.
Top of page What EFS Is You can use EFS to encrypt files stored in the file system of Windows 200 0, Windows XP Professional, and Windows Server 2003 computers. EFS isn't designed to protect data while it's transferred from one system to anot her. EFS uses symmetric (one key is used to encrypt the files) and asymm etric (two keys are used to protect the encryption key) cryptography.
Understan ding both of these topics will assist you in understanding EFS. A solid overview of EFS and a comprehensive collection of information on EFS in Windows 2000 are published in the Distributed Systems Guide of th e Windows 2000 Server Resource Kit.
mspx) details Windows XP and Windows Se rver 2003 modifications. The section below, "Key Differences between EFS on Windows 2000, Windows XP, and Windows Server 2003," summarizes these differences. The following are important basic facts about EFS: EFS encryption doesn't occur at the application level but rather at the f ile-system level; therefore, the encryption and decryption process is tr ansparent to the user and to the application. If a folder is marked for encryption, every file created in or moved to the folder will be encrypt ed. Applications don't have to understand EFS or manage EFS-encrypted fi les any differently than unencrypted files. If a user attempts to open a file and possesses the key to do so, the file opens without additional effort on the user's part. If the user doesn't possess the key, they rec eive an "Access denied" error message. File encryption uses a symmetric key, which is then itself encrypted with the public key of a public key encryption pair. The related private key must be available in order for the file to be decrypted. This key pair is bound to a user identity and made available to the user who has posse ssion of the user ID and password. If the private key is damaged or miss ing, even the user that encrypted the file cannot decrypt it. If a recov ery agent exists, then the file may be recoverable. If key archival has been implemented, then the key may be recovered, and the file decrypted. EFS is an excellent file encryption syste mthere is no "back door." File encryption keys can be archived (eg exported to a floppy disk) and kept in a safe place to ensure recovery should keys become damaged. Any user who can obtain th e user ID and password can log on as that user and decrypt that user's f iles. Therefore, a strong password policy as well as strong user educati on must be a component of each organization's security practices to ensu re the protection of EFS-encrypted files. EFS-encrypted files don't remain encrypted during transport if saved to o r opened from a folder on a remote server. The file is decrypted, traver ses the network in plaintext, and, if saved to a folder on the local dri ve that's marked for encryption, is encrypted locally. EFS-encrypted fil es can remain encrypted while traversing the network if they're being sa ved to a Web folder using WebDAV. This method of remote storage isn't av ailable for Windows 2000.
Top of page Basic How-tos How to Encrypt and Decrypt Files, Recover Encrypted Files, Archive Keys, Manage Certificates, Back Up Files; and Disable EFS EFS functionality is straightforward, and you can find step-by-step instr uctions in many documents online. Links to specific articles for each po ssible EFS function, as well as some documents which summarize multiple functionality, follow. If the document is a Knowledge Base article, the Knowledge Base number appears in parentheses after the article title. Encrypting and Decrypting The process of encrypting and decrypting files is very straightforward, b ut its important to decide what to encrypt and to note differences in EF S based on the operating system.
Encrypting Files in Windows 2000" (222054) explains setting folder e ncryption. Remember, once a folder is marked for encryption, it isn't ne cessary to manually mark for encryption the files placed within it.
HOW TO: Remove File Encryption in Windows XP" (308993) tells how to decrypt a file by removing the file encryption property. Sharing Encrypted Files The GUI for sharing encrypted files is available only in Windows XP and W indows Server 2003.
Top of page Planning for and Recovering Encrypted Files: Recovery Policy A recovery policy can be an organization's security policy instituted to plan for proper recovery of encrypted files. It's also the policy enforc ed by Local Security Policy Public Key Policy or Group Policy Public Key Policy. In the latter, the recovery policy specifies how encrypted file s may be recovered should the user private key be damaged or lost and th e encrypted file unharmed. Recovery can be either data recovery (Windows 2000, Windows XP P rofessional, and Windows Server 2003) or key recovery (Windows Server 20 03 with Certificate Services). Windows 2000 EFS requires the presence of a recovery agent (no recovery agent, no file encryption), but Windows X P and Windows Server 2003 don't. By default, Windows 2000 and Windows Se rver 2003 have default recovery agents assigned. The user account bound to the recove ry agent certificate is used to decrypt the file. The file should then b e delivered in a secure manner to the file owner, who may then encrypt t he file. Recovery via automatically archived keys is available only with Windows Server 2003 Certificate Services. Additional configuration beyo nd the installation of Certificate Services is required. In either case, it's most important that a written policy and procedures for recovery a r...
|
http://csua.com/feed/