PGP NetShare locks down shared folders and files

Although I’ve yet to see the one product that can encrypt data on all OSes and media, PGP’s suite of encryption products offers a competitive enterprise solution to protect a variety of content on Microsoft Windows.

This time, I focused on one of PGP’s newer offerings: PGP NetShare Version 9.6. NetShare is available as an add-on optional component to PGP Desktop or is included as a component of PGP Desktop Storage 9.6.

In a nutshell, NetShare allows files on local and remote SMB (Server Message Block) shares (Windows or Samba) to be easily encrypted. (It is intended to work with folder shares, but individual files can be encrypted as well. It also supports NAS and SAN volumes.) If used with PGP’s Universal Server, the same cryptographic keys can be applied across disk drives, shares, USB keys, tape, and other media sources, which simplifies key archival and recovery.

Encryption roulette

I tested NetShare across three Windows client versions (Windows 2000, Windows XP, and Windows Vista), using two server versions, Windows 2000 and 2003. I installed both the stand-alone NetShare product with PGP Desktop, and as an enterprise client managed by PGP Universal Server. Searches for plain-text data remnants were conducted with a binary disk editor and inspected in transit using a network protocol sniffer.

NetShare uses a 256-bit symmetric AES (Advanced Encryption Standard) encryption key in EME (parallelizable block cipher) mode. It is compatible with fully patched 32-bit versions of Windows 2000 and later Windows operating systems and can use X.509 certificates or OpenPGP RFC 2440 keys, with support for smart card and USB tokens -- about average coverage for top-tier products.

With NetShare, all encryption and decryption takes place on the local client; no NetShare-specific serverside software is needed. This ensures that transferred files are securely shipped between locations without denigrating network or server performance. Users without the necessary authorization may be able to see the files and folders, but cannot open up decrypted copies.

Click for larger view.

If PGP Desktop is already installed, the NetShare add-on can be installed as a separate package. In my test environment, installation was smooth and uneventful. After a reboot, NetShare shows up as an additional option under the PGP Desktop Control Box (see Figure 1).

To protect one or more folders, you use the PGP NetShare Assistant wizard (see Figure 2), which walks you through selecting folders and choosing which users should be authorized to access the protected files. You can also add folders by dragging and dropping them into the PGP Desktop folder area, although this feature does not yet work on Windows Vista.

The user selecting the folder to be protected must be sure to include themselves along with the other authorized users, and it’s vitally important to remember that all added users have equal rights in the folder. That means that not only can all selected users encrypt and decrypt files, but they can also add and remove other authorized users.