Although I’ve yet to see the one product that can encrypt data on all OSes and media, PGP’s suite of encryption products offers a competitive enterprise solution to protect a variety of content on Microsoft Windows.

The Bottom Line PGP NetShare v.9.6 PGP Corporation, pgp.com Very Good  8.4 criteria score weight Data protection 9 30% Management 8 20% Ease-of-use 9 20% Scalability 8 10% Setup 8 10% Value 7 10% Cost: NetShare pricing starts at $149 per user; also requires PGP Desktop; pricing for PGP Universal Server starts at $169 per user, minimum 10-seat license requirement Platforms: Windows 2000 32-bit and later clients Bottom Line: PGP NetShare is a solid encryption product, with a friendly GUI and useful wizards, and it does a good job of protecting folders and files. However, most of its enterprise functionality -- such as sharing encryption keys across media sources -- is provided only when NetShare is installed with PGP Universal Server. About our Reviews and Scoring Methodology

This time, I focused on one of PGP’s newer offerings: PGP NetShare Version 9.6. NetShare is available as an add-on optional component to PGP Desktop or is included as a component of PGP Desktop Storage 9.6.

In a nutshell, NetShare allows files on local and remote SMB (Server Message Block) shares (Windows or Samba) to be easily encrypted. (It is intended to work with folder shares, but individual files can be encrypted as well. It also supports NAS and SAN volumes.) If used with PGP’s Universal Server, the same cryptographic keys can be applied across disk drives, shares, USB keys, tape, and other media sources, which simplifies key archival and recovery.

Encryption roulette

I tested NetShare across three Windows client versions (Windows 2000, Windows XP, and Windows Vista), using two server versions, Windows 2000 and 2003. I installed both the stand-alone NetShare product with PGP Desktop, and as an enterprise client managed by PGP Universal Server. Searches for plain-text data remnants were conducted with a binary disk editor and inspected in transit using a network protocol sniffer.

NetShare uses a 256-bit symmetric AES (Advanced Encryption Standard) encryption key in EME (parallelizable block cipher) mode. It is compatible with fully patched 32-bit versions of Windows 2000 and later Windows operating systems and can use X.509 certificates or OpenPGP RFC 2440 keys, with support for smart card and USB tokens -- about average coverage for top-tier products.

With NetShare, all encryption and decryption takes place on the local client; no NetShare-specific serverside software is needed. This ensures that transferred files are securely shipped between locations without denigrating network or server performance. Users without the necessary authorization may be able to see the files and folders, but cannot open up decrypted copies.

Click for larger view.

If PGP Desktop is already installed, the NetShare add-on can be installed as a separate package. In my test environment, installation was smooth and uneventful. After a reboot, NetShare shows up as an additional option under the PGP Desktop Control Box (see Figure 1).

To protect one or more folders, you use the PGP NetShare Assistant wizard (see Figure 2), which walks you through selecting folders and choosing which users should be authorized to access the protected files. You can also add folders by dragging and dropping them into the PGP Desktop folder area, although this feature does not yet work on Windows Vista.

The user selecting the folder to be protected must be sure to include themselves along with the other authorized users, and it’s vitally important to remember that all added users have equal rights in the folder. That means that not only can all selected users encrypt and decrypt files, but they can also add and remove other authorized users.

Newly assigned users are not notified of their involvement in the protect share, and they must also have PGP NetShare installed to seamlessly access the protected files. Users without PGP NetShare can copy files into protected folders, but those files are not encrypted until an authorized user modifies the file or re-encrypts the folder.

PGP-related encryption information is stored in the protected file’s header and/or within a hidden PGP file within the protected folder. The wizard prompts the user to select a Signer when encrypting a folder; the Signer's key is used to protect the configuration information for the folder.

Click for larger view.

Measuring performance

The encryption/decryption performance was average to slightly slower than other products I've tested, including Microsoft’s EFS (Encrypting File System), OpenPGP, TrueCrypt, and DataGuard. Encryption speed was average, but decryption speed lagged when large remote folders were decrypted in a single action. As suggested by PGP, performance increased if the PGP folder icons feature (which gives a visual indication of what folders are protected) was disabled. With single files, the encryption/decryption process was almost unnoticeable either way.

Any small performance trade-offs are offset, however, by NetShare's solid encryption and particularly useful GUI. The GUI was invisible most of the time, but user wizards popped up when appropriate. After encryption, I searched for plain-text remnants that might have been left behind accidentally on disk and in network traffic. PGP was flawless.

Another nice behind-the-scenes feature is that files do not have to be re-encrypted when the list of authorized users is modified. Some encryption products require that previously protected content be re-encrypted to ensure an encryption orphan event does not occur. PGP NetShare simply updates the configuration information protecting the file.

Additional useful components in NetShare include: PGP Virtual Disk Volumes to create virtual encrypted disk volumes; PGP Zip to create encrypted, compressed, portable archives; PGP Self-Decrypting Archives to allow encrypted folders and folders to be transported and decrypted on computers without PGP; PGP Shredder for secure file wiping; and a command-line tool, pgpnetshare.exe, that is useful for scripting automation.

Stronger together

Small touches here and there, such as indicative folder icons, end-user wizards, and readable help make this NetShare tool especially friendly. On its own, it's t's a solid encryption product and should help secure shared files and folders.

However, most of NetShare's enterprise functionality is provided by PGP Universal Server. For example, you won't be able to share keys across media sources without Universal Server, and Universal Server also adds enterprise management, easy key archival, directory service enumeration, granular controls, and policy management. Consequently, I recommend looking at NetShare as an add-on product to Universal Server, rather than for stand-alone use.