Data Protection
Suggest, discuss, and vote on new ideas for Sophos Data Protection products. Protecting your data, wherever it goes.
-
SGN8: application based encryption: prevention of decryption
With SGN8 and application based encryption users also have the possibilty to manually decrypt encrypted files or to create password protected HTML5 containers (which has the same effect) by using the context menue. One of the first questions customers ask us: can I prevent users from doing this?
Actually I can't. So the feature request is: policy based elimination of the possibility to manually decrypt encrypted files to prevent data leakage.48 votesThis is currently planned for the release after SGN 8.1.
-
windows 10 poa
Implement Windows 10 POA with Smartcards like in Windows 7. Only the BitLocker PIN is not Enterprise ready in my humble opinion..
47 votes -
Define Password Complexity from Central
Please add some more Bitlocker configuration possibilities, like the option to configure the password complexity, as described here:
http://windowsitpro.com/security/q-how-can-i-set-password-complexity-removable-bitlocker-protected-devices35 votesThis is on the backlog for a future release.
We can’t control the GPO settings for the password complexity which means that if the Admin overrides password rules via central GPO settings then we can’t enforce the Central Device Encryption password rules on the endpoint. However, if there are no password rules defined via GPO, the Central Device Encryption password rules will apply. -
Support for Central Device Encryption on Server platforms
Manage BitLocker on Server platforms and also support a cost-effective decommissioning process of drives.
35 votes -
Please add YubiKey to the supported smartcards
Could you please add YubiKeys to your supported smartcards as it's a convient smartcard with multiple use cases. e.g. certificate based user authentication, otp functionality, code signing
33 votes -
Remotely trigger a PIN reset from the Central Dashboard for machines using encryption.
Having the ability to force a user to change their PIN via a request from the Central dashboard would be useful. We've gotten a number of requests for the ability to do this from sysadmins.
30 votes -
Enable User Switching?
Didn't catch this lack of support of a basic Windows feature until launching our wide rollout to the hospital PCs. Disabling U.S. might be fine in enterprise large office environments where a cube-dweller uses their dedicated PC for an 8 hour shift. But your product strangles a feature that's ingrained in smaller medical / industrial / retail PC usage. Without U.S. ability, using SafeGuard means a nurse has to close their apps (usually an EMR, Radiology, Lab reports web-view, security system monitor, etc.) and log out completely every time she has to leave the station to bring a new mother…
29 votes -
network aware POA
Ability to have Network Aware POA on machines (especially BitLocker as there is no user-based POA).
Many customers need the ability to disable POA on devices in the office - for example shared machines. If the device is stolen, then POA should be enabled immediately. We are currently working on a 3,000 user company with Call Centre who love what we can do in Win7 but need a comparable approach for BitLocker managed machines.
This would apply for Central as well however we have a larger SGN deployment base today so SGN is the most important starting place.
26 votes -
Filestream Google
Although Google Drive Encryption files is supported by Sophos, FileStream it is not. It would liberate resources from computer as it is not mandatory to have files downloaded. As Safe Guard 8.1 encrypts files in local it doesn't work with this cloud resource.
Dropbox has a similar resource.23 votes -
Support for BitLocker To Go
Manage full disk encryption on removable media by introducing a new policy setting for BitLocker To Go.
21 votes -
Windows Lockscreen Configuration
At the moment it is not possible to configure the windows 10 locksreen if Safeguad is installed.
Please make it possible to let the admin choose if it is possible or not.
Best would be to configure it via Windos GPO. To configure it via Safeguard policy would be an alternative way.17 votes -
Bitlocker GPO/Policy-RSOP-Tool
Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption
It is possible, that SafeGuard (or Central) Policies collide with Bitlocker GPO without recognizing it.
It might be confusing to separate SGN local cache values with Bitlocker registry-entries.A simple Client tool should match HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE with die LC-Policies and create a *.xml into %ALLUSERSPROFILE%\Utimaco\SafeGuard Enterprise\
In this folder the log is automatically gathered by the SDU without changing and can be used even on older SG-versions.
The shortly described values should be matched as a simple "match"/"mismatch"/"not configured" to easily see possible configuration errors.
The tool is independent from the client itself and can…
17 votes -
Support Apple Open Directory with SGN
OSX client based on Apple Open Directory should be fully manageable with the SGN Management Center.
FileVault2 and File Encryption policy should be fully applicable for those kinds of objects (machines and users).
Use cases like re-image of client or re-name of user should be part of implementation.15 votes -
Official support for VMWare Horizon (former VMWare VDI)
Customer switch its desktop environment to VDI environment. They need official support for this VDI platform.
14 votes -
Allow Mass Verification of Key Presence in SGN Database
There should be a process, field, alert, literally ANYTHING that allows us to check, en masse, the presence of a valid recovery key. The only way to make sure that a valid key exists is to check the machines manually.
We have had issues with Surfaces, where the key becomes corrupted or lost or something, and we don't realize there is a problem until we have to actually do a recovery.
Other products have an alert or something that says when a client is in a state that isn't optimal. SGN does not. It should be easy to query the…
11 votes -
AD Sync check
Our customer had an issue recently, with the SGN console not able to push the AD modifications to the SQL database ; as a consequence, all the users went out of the domain, and were not having the regular policy. Customer found the root cause of this issue, which is the adding of a domain in self-reg, with the Netbios name "XX" (existing one), followed with the renaming of the correct one. We know that this action is not done by our APIs, which are only getting the information.
In order to no longer have this situation reproduced (it happened…
11 votes -
Ubuntu
to allow the encryption and management of Ubuntu workstation as part of SafeGuard Enterprise
10 votes -
Filestream Google
Although Google Drive Encryption files is supported by Sophos, FileStream it is not. It would liberate resources from computer as it is not mandatory to have files downloaded. As Safe Guard 8.1 encrypts files in local it doesn't work with this cloud resource.
Dropbox has a similar resource.10 votes -
Add SGN 8 policy to automatically Decrypt outbound Outlook file attachments
SGN 8 Synchronized Encryption requires an add-in to manually specify that outbound attachments should be decrypted, or encrypted with a password, or sent as is, but this is not necessary or desirable if there is already an email encryption system in place. I don't want to have to force my users to decision each attachment with SGN when I already have a better email encryption solution in place. There should be auto-decrypt zones such as "outbound outlook attachments".
10 votes -
SafeGuard Watchdog should also monitor status of SGNAuthService and reset it if it hangs
SafeGuard Watchdog should also monitor status of SGNAuthService and reset it if it hangs. Customers provide feedback that if the SG Credential Provider will not show up when trying to login a manual restart of SGNAuthService will help.
So why not using our own watchdog to get rid of this issue?9 votes
- Don't see your idea?
