McAfee Encrypted USB

Overview:

Today's mobile workforce often carries sensitive corporate data on portable USB drives, unaware of the security risk if the drives are lost or stolen. McAfee Encrypted USB devices keep sensitive data safe and secure, wherever it goes. A variety of Encrypted Device options are available- hard disks range in storage size from 160 GB to 750 GB, while sticks range from 1 GB to 64 GB.

Description:

USB devices are widely used and convenient because of their small size, huge storage capacity, and high portability. However, with convenience comes risk. These devices, along with the confidential data they contain, are easily lost or stolen. To make the data on these devices unreadable by unauthorized parties, McAfee offers Encrypted USB drives to keep mobile data secure with strong encryption and an advanced management platform.

Automatic encryption — Encrypt data transparently, automatically, and on the fly, with no special training required.

Industry-leading technology — Protect sensitive information with AES-256 encryption and FIPS-140-2 validation. With hardware-based encryption, encryption keys can’t be obtained or copied because they never leave the USB drive.

Advanced management platform — Extend company security policies and compliance requirements to mobile USB drives in a strategic, comprehensive, and managed way. With the McAfee ePolicy Orchestrator (ePO) platform, companies can centralize deployment, management, policy administration, monitoring, reporting, and auditing.

Compliance ready — Extensive auditing capabilities and reporting tools allow companies to prove that data on devices were encrypted, even if a device is lost or stolen.

Keep Data Safe and Secure — All the information copied onto McAfee Encrypted USB devices is encrypted and can only be read by authorized individuals. Built-in user access control and strong hardware data encryption keeps sensitive data secure wherever it travels.

Centralized Management — Deploying and managing portable storage devices across an enterprise can be complex and expensive. And, USB drives are typically not managed by the IT organization, so they are often not covered by company-wide security policies. The McAfee ePolicy Orchestrator® (McAfee ePO™) platform addresses those issues by deploying and managing McAfee Encrypted USB devices centrally from a single console—which improves corporate security while reducing total cost of ownership. Users simply initialize devices by plugging them into a McAfee ePO-managed computer.

Strong Hardware Encryption — All data on McAfee Encrypted USB devices is encrypted using the strongest, hardware-based, industry-standard encryption algorithms available, including AES-256, as well industry certifications, such as Federal Information Processing Standards (FIPS) 140-2. With built-in hardware encryption, key generation, and certificate storage, encryption keys can not be obtained or copied, as they never leave the USB drive. Optionally, you can store other encryption keys and/or public key infrastructure (PKI) certificates.

To access data on McAfee Encrypted USB devices, users must authenticate themselves using a password or fingerprint, preventing unauthorized access to data. For maximum security, twofactor authentication can be used. If users have forgotten a password or if they don't have the ability to perform biometric authentication, they can easily regain access to the data via a centralized password reset or self-rescue enabled by McAfee ePO software.

Demonstrate Regulatory Compliance — Because they are integrated with the McAfee ePO management console, McAfee Encrypted USB devices support your compliance efforts, from corporate security policies to industry-specific regulations to data privacy legislation. You can prove that the data on a stolen or lost USB device was encrypted, and you can run reports that detail data access and USB usage for auditing purposes.

Benefits and Features:

1 The newest McAfee Encrypted USB Bio devices are standalone only and are not yet manageable by McAfee ePO
2 Optional on some models
3 Third-party software required

System Requirements:

Note: System requirements vary depending on the devices chosen by your organization.

Encrypted USB Comparison:

This guide includes both simple and detailed tables summarizing features and specifications for the complete range of McAfee® Encrypted USB devices (flash and hard drives) and storage sizes (1 GB to 500 GB). McAfee Encrypted USB devices are either powered by MXI or Sandisk.

McAfee Encrypted USB Comparison
	McAfee Encrypted USB Standard	McAfee Encrypted USB Bio	McAfee Encrypted USB Hard Disk Non-Bio	Encrypted USB Hard Disk
Password or CAC/PIV Card Authentication
Biometric Authentication
AES-256 Bit Hardware Encryption
Virtualization Capable (PC-on-a-Stick)1	Optional	Optional	Optional	Optional
FIPS 140-2 validated
Centralized management via McAfee ePolicy Orchestrator (McAfee ePO)
McAfee Anti-Malware Protection

1 Third-party software required at additional cost.

McAfee Encrypted USB Devices Product Features Guide
	McAfee Encrypted USB Standard (Powered by MXI)	McAfee Encrypted USB Bio (Powered by MXI)	McAfee Encrypted USB Hard Disk Non-Bio (Powered by MXI)	Encrypted USB Hard Disk (Powered by MXI)
SKU	USB-ST02	USB-BI02	USB-HDN2	USB-HD02
Secure Data Storage	Yes	Yes	Yes	Yes
Strong Authentication	Yes	Yes	Yes	Yes
Remote Access	Yes	Yes, Optional	Yes, Optional	Yes, Optional
Virtualization (PC-on-a-Stick)1	Yes, Optional	Yes, Optional	Yes, Optional	Yes, Optional
Anti-Malware Protection	Yes	Yes	Yes	Yes
Installation
“Zero-Footprint” Technology	Yes	Yes	Yes	Yes
Device Driver Installation Required	No	No	No	No
Administrator Rights Required	No	No	No	No
Authentication
Authentication Mechanisms	Password, CAC/PIV	Password, Fingerprint, CAC/PIV	Password, CAC/PIV	Password, Fingerprint, CAC/PIV
Password Complexity Rules	Yes, Configurable	Yes, Configurable	Yes, Configurable	Yes, Configurable
Password Lifetime Rules	Yes, Configurable	Yes, Configurable	Yes, Configurable	Yes, Configurable
Failed Authentication Threshold	Yes, Configurable	Yes, Configurable	Yes, Configurable	Yes, Configurable
Maximum Number of Users on a Single Device (McAfee ePO)	10 (1)	10 (1)	10 (1)	10 (1)
Secure Data Storage Options
Storage Capacity	1, 2, 4, 8, 16, 32, 64 GB	1, 2, 4, 8, 16, 32, 64 GB	250, 320, 500 GB	250, 320, 500 GB
AES-256 Bit Hardware Encryption	Yes, CBC Mode	Yes, CBC Mode	Yes, CBC Mode	Yes, CBC Mode
Public Non-Encrypted Area	No	No	No	No
Configurable Partition Sizes (Encrypted USB Manager Only)	Yes	Yes	Yes	Yes
Data Transfer Rate (Read/Write) in Mb/s	25/20	25/20	22/22	22/22
Administration with McAfee ePO platform (Encrypted USB Manager)2
Central Policy Enforcement and Deployment	Yes	No3	No3	No3
Password Recovery—Self Rescue (McAfee ePO Only)	Yes	No2	No2	No2
Password Recovery—Helpdesk	Yes	No2	No2	No2
Data Recovery	Yes	No2	No2	No2
Data Destruction	Yes	No2	No2	No2
Device Revocation (McAfee ePO Only)	Yes	No	No	No
Reporting	Yes	No	No	No
Data Backup (McAfee ePO Only)	Yes	No	No	No
Device Control (with McAfee Device Control )	Yes	Yes	Yes	Yes
Compatibility
System Requirements for USB Devices	Microsoft Windows 7 and Apple Mac OS 10.6 support: standalone only	Microsoft Windows 7 and Mac OS 10.6 support standalone only. No Linux support	Microsoft Windows 7 and Mac OS 10.6 support standalone only. No Linux support	Microsoft Windows 7 and Mac OS 10.6 support standalone only. No Linux support
Supported by McAfee ePO4	Yes	No3	Yes	Yes
Supported by McAfee Data Loss Prevention	Yes	Yes	Yes	Yes
Supported by McAfee Encrypted USB Manager	No	No	Yes	Yes
McAfee Endpoint Encryption Token Support	Yes	Yes	Yes	Yes
Physical
Dimensions (cm)	2.15 (W) x 1.25 (H) x 7.60 (L)	2.6 (W) x 1.3 (H) x 8.5 (L)	7.62 (W) x 2.41 (H) x 12.07 (L)	7.62 (W) x 2.41 (H) x 12.07 (L)
Weight (grams)	22	26	300	300
USB Bus Powered	Yes	Yes	Yes, 2 ports	Yes, 2 ports
Temperature	~ 0 to 60 C	~ 0 to 60 C	~ 0 to 50 C	~ 0 to 50 C
Relative Humidity (Non-Condensing)	~ 5% to 95%	~ 5% to 95%	~ 5% to 95%	~ 5% to 95%
Tamper-Evident, Dustproof, Waterproof	Yes	Yes	Yes (TE), No (D/W)	Yes (TE), No (D/W)
Certifications
EMI Certifications	FCC and CE	FCC and CE	FCC and CE	FCC and CE
FIPS 140-2	Yes, Level 3	Yes, Level 3	Yes, Level 3	Yes, Level 3
Common Criteria	No	No	No	No

Note: Italicized items indicate functionality that is only available with McAfee ePolicy Orchestrator/McAfee Encrypted USB.
1 Third-party software required at additional cost.
2 McAfee Encrypted USB Manager software is optional and provided for non-McAfee ePO customers and digital identity options.
3 The newest McAfee Encrypted USB Bio and Hard Disk devices are standalone only and are not yet manageable through the McAfee ePolicy Orchestrator platform.
4 See McAfee.com for McAfee ePO system requirements.

McAfee Encrypted USB Manager:

Manage and protect your McAfee Encrypted USB devices

McAfee® Encrypted USB Manager is a full-featured, centralized management software solution for McAfee Encrypted USB devices. It enforces compliance with corporate standards for data, authentication, and mobile application usage. As government and industry-specific regulations increase, and the penalties for non-compliance become more severe, corporations must protect sensitive information better—not only within the enterprise but also when data leaves via portable devices.

Centralized Management
McAfee Encrypted USB devices provide the ability to easily and securely transport data outside of an organization. They have the highest levels of encryption and authentication. By centrally managing and administering corporate standards and audit requirements for USB devices, McAfee Encrypted USB Manager ensures compliance.

The centralized management of McAfee Encrypted USB devices will:

• Demonstrate compliance with data security legislation. Security policies are enforced on the end user, ensuring that all data stored on a device is protected if the device is lost or stolen.
   
• Protect your assets and brand by providing empirical proof that a device was encrypted at the time of loss with extensive auditing.
   
• Recover user passwords centrally using a challenge-response mechanism. Even if a user leaves the organization, the organization can always access the data by performing a device rescue.
   
• Control the way in which your organization manages its user devices through one central management workstation or thousands of workstations in various locations around the world.

User Identification
Your organization needs to know who is carrying what USB device. Furthermore, the identity of these individuals needs to come from the corporate identity store (typically a Lightweight Directory Access Protocol, or LDAP, directory). The last thing a company needs is another identity silo.

Tailored Authentication
Policies for authentication, such as password complexity rules, biometric security levels, and retry limits, must be tailored to the needs of each group of users in accordance with their role and operating environment. For example, mobile users may need biometric authentication, while internal users may only need password devices.

Digital Credentials
Some portable security devices have the capability to perform digital identity functions, such as generating one-time passwords and public key operations. Having one central point to provision digital credentials such as private keys, token seeds, and static credentials greatly simplifies the process of enabling these devices for use with your various authentication systems.

Portable Applications
One of the benefits of portable storage is that it can provide greater mobility for applications. Organizations can decide to control the set of applications that are appropriate for different groups of users. For example, mobile workers may need a remote access client on their devices, while internal employees do not need this type of access. The Portable Content Manager (PCM) allows IT administrators to simply drag and drop corporate applications that will be pre-loaded on portable security devices, such as single sign-on for web forms, portable secured Internet browsers, remote access clients, and virtual desktops.

User Rescue
Easy to implement password and biometric recovery options must be available to rescue blocked users, even if they’re away from the corporate network.

Data Recovery
Data recovery options are available to security officers so that they can perform audits on the stored information and, if necessary, without the user being present. Help desk operators can re-establish device access or permanently erase all data.

Data Destruction
In some scenarios, consecutive failed user authentications indicate a potential attack. Organizations can decide to destroy data completely without the possibility of recovery if authentication becomes blocked on the portable security device.

Integrated Reporting Capability Helps Ensure Regulatory Compliance
Organizations must be compliant with regulations on data security and corporate governance. To fully ensure compliance when deploying security devices, administrative roles for different tasks must be separable and administrative operations must be logged.

Reuse and Recycle
When employees no longer need to use a USB device, there is no need to throw them away. Organizations can recycle and re-issue devices to other users.

Figure 1. McAfee Encrypted USB device reuse and recycle management

Documentation:

Download the McAfee Encrypted USB Datasheet (PDF).

Download the McAfee Encrypted USB Manager Datasheet (PDF).

Download the McAfee Encrypted USB Devices Product Features Guide Datasheet (PDF).