HP Dc5700 - Microtower PC Manuale utente

HP ProtectTools Security Manager Guide

HP Compaq Business Desktops

Development Company, L.P. The

information contained herein is subject to

change without notice.

Microsoft and Windows are trademarks of

Microsoft Corporation in the U.S. and other

countries.

Intel and SpeedStep are trademarks of Intel

Corporation in the U.S. and other countries.

The only warranties for HP products and

services are set forth in the express warranty

statements accompanying such products

and services. Nothing herein should be

construed as constituting an additional

warranty. HP shall not be liable for technical

or editorial errors or omissions contained

herein.

This document contains proprietary

information that is protected by copyright. No

part of this document may be photocopied,

reproduced, or translated to another

language without the prior written consent of

Hewlett-Packard Company.

HP ProtectTools Security Manager Guide

HP Compaq Business Desktops

First Edition (August 2006)

Document Part Number: 431330-001

About This Book

This guide provides instructions for configuring and using HP ProtectTools Security Manager.

WARNING! Text set off in this manner indicates that failure to follow directions could result in

bodily harm or loss of life.

CAUTION Text set off in this manner indicates that failure to follow directions could result in

damage to equipment or loss of information.

NOTE Text set off in this manner provides important supplemental information.

ENWW iii

iv About This Book ENWW

Table of contents

1 Introduction

HP ProtectTools Security Manager ...................................................................................................... 1

Accessing the ProtectTools Security Manager .................................................................... 1

Understanding Security Roles .............................................................................................................. 2

Managing ProtectTools Passwords ...................................................................................................... 2

Multifactor Authentication Credential Manager Logon ......................................................... 5

Creating a Secure Password ............................................................................................... 5

Advanced Tasks ................................................................................................................................... 6

Managing ProtectTools Settings .......................................................................................... 6

Enabling and Disabling Java Card Power-On Authentication Support ............... 6

Enabling and Disabling Power-On Authentication Support for Embedded

Security ............................................................................................................... 6

Managing Computer Setup Passwords ............................................................................... 7

Setting the Power-On Password (if available) ..................................................... 7

Changing the Power-On Password (if available) ................................................ 7

System Setup ...................................................................................................... 8

Changing Power-On Authentication Support ...................................................... 8

Changing User Accounts .................................................................................... 8

Setting the Computer Setup Administrator Password ......................................... 9

Changing the Computer Setup Administrator Password ..................................... 9

Dictionary Attack Behavior with Power-On Authentication ................................ 10

Dictionary Attack Defense ................................................................ 10

2 HP BIOS Configuration for ProtectTools

Basic Concepts .................................................................................................................................. 11

Changing BIOS Settings .................................................................................................................... 11

3 HP Embedded Security for ProtectTools

Basic Concepts .................................................................................................................................. 13

Setup Procedures ............................................................................................................................... 14

4 HP Credential Manager for ProtectTools

Basic Concepts .................................................................................................................................. 15

Launch Procedure .............................................................................................................................. 15

Logging On for the First Time ............................................................................................ 16

5 HP Java Card Security for ProtectTools

Basic Concepts .................................................................................................................................. 17

ENWW v

6 Third-Party Solutions

7 HP Client Manager for Remote Deployment

Background ........................................................................................................................................ 21

Initialization ......................................................................................................................................... 21

Maintenance ....................................................................................................................................... 21

8 Troubleshooting

Credential Manager for ProtectTools ................................................................................................. 23

Embedded Security for ProtectTools .................................................................................................. 27

Miscellaneous ..................................................................................................................................... 33

Glossary ............................................................................................................................................................. 37

Index ................................................................................................................................................................... 41

vi ENWW

1 Introduction

HP ProtectTools Security Manager

ProtectTools Security Manager software provides security features that help protect against

unauthorized access to the computer, networks, and critical data. Enhanced security functionality is

provided by the following modules:

●HP BIOS Configuration for ProtectTools

●HP Embedded Security for ProtectTools

●HP Credential Manager for ProtectTools

●HP Java Card Security for ProtectTools

The modules available for the computer may vary, depending on the model. ProtectTools modules may

be preinstalled, supplied on CD that shipped with the computer, or available for purchase from the HP

Web site. Visit http://www.hp.com for more information.

NOTE Refer to the ProtectTools Help screens for specific instructions for the ProtectTools

modules.

To use the Trusted Platform Module (TPM), platforms containing a TPM require both a TCG Software

Stack (TSS) and embedded security software. Some models provide the TSS; if the TSS is not provided,

it can be purchased from HP. Additionally, TPM-enabling software must be purchased separately for

some models. Please see Third-Party Solutions for more details.

Accessing the ProtectTools Security Manager

To access the ProtectTools Security Manager from the Microsoft Windows Control Panel:

▲Windows XP: Click Start > Control Panel > Security Center > ProtectTools Security

Manager.

▲Windows 2000: Click Start > All Programs > HP ProtectTools Security Manager.

NOTE After you have configured the Credential Manager module, you can also log in to

Credential Manager directly from the Windows logon screen. For more information, refer to HP

Credential Manager for ProtectTools.

ENWW HP ProtectTools Security Manager 1

Understanding Security Roles

In managing computer security (particularly for large organizations), one important practice is to divide

responsibilities and rights among various types of administrators and users.

NOTE In a small organization or for individual use, these roles may all be held by the same

person.

For ProtectTools, the security duties and privileges can be divided into the following roles:

●Security officer—Defines the security level for the company or network and determines the security

features to deploy, such as Java Cards, biometric readers, or USB tokens.

NOTE Many of the features in ProtectTools can be customized by the security officer in

cooperation with HP. For more information, visit http://www.hp.com.

●IT administrator—Applies and manages the security features defined by the security officer. Can

also enable and disable some features. For example, if the security officer has decided to deploy

Java Cards, the IT administrator can enable Java Card BIOS security mode.

●User—Uses the security features. For example, if the security officer and IT administrator have

enabled Java Cards for the system, the user can set the Java Card PIN and use the card for

authentication.

Administrators are encouraged to perform “best practices” in restricting end-user privileges and

restrictive access to users.

Managing ProtectTools Passwords

Most of the ProtectTools Security Manager features are secured by passwords. The following table lists

the commonly used passwords, the software module where the password is set, and the password

function.

The passwords that are set and used by IT administrators only are indicated in this table as well. All

other passwords may be set by regular users or administrators.

Table 1-1 Password Management

ProtectTools Password Set in this ProtectTools Module Function

Computer Setup administrator

password

NOTE Also known as BIOS

administrator, F10 Setup, or

Security Setup password

BIOS Configuration, by IT administrator Protects access to the BIOS Computer

Setup utility and security settings.

Power-On password BIOS Configuration HP ProtectTools Power-On

Authentication Support is a TPM-based

security tool designed to prevent

unauthorized access to the computer as

it is powered on. Power-On

Authentication Support uses the HP

ProtectTools Embedded Security Basic

User password. Once Power-On

Authentication is enabled in Computer

Setup, the password is set when the first/

2 Chapter 1 Introduction ENWW

next Embedded Security Basic User Key

is initialized. The Embedded Security

TPM chip protects the password for

Power-On Authentication.

Java Card administrator password

NOTE Also known as BIOS

administrator card password

Java Card Security, by IT administrator Links the Java Card to the computer for

identification purposes.

Allows a computer administrator to

enable or disable Computer Setup

passwords, generate a new

administrator card, and create recovery

files to restore user or administrator

cards.

Java Card PIN Java Card Security Protects access to the Java Card

contents and to computer access when

an optional Java Card and reader is

used. Checks to see if Java Card user

password is duplicate to pin; it is used to

Java Card recovery file password (if

available)

Java Card Security Protects access to the recovery file that

contains the BIOS passwords.

Java Card user password (if available)

NOTE Also known as BIOS

user card password

Java Card Security Links the Java Card to the computer for

identification.

Allows a user to create a recovery file to

restore a user card.

Basic User password

NOTE Also known as:

Embedded Security password,

TPM Preboot password

Embedded Security Used to access Embedded Security

features, such as secure e-mail, file, and

folder encryption. When enabled as the

BIOS Power-On Authentication support

password, protects access to the

computer contents when computer is

turned on, restarted, or restored from

hibernation. Also used to authenticate

the Personal Secure Drive (PSD) and to

Emergency Recovery Token password

NOTE Also known as:

Emergency Recovery Token

Key

Embedded Security, by IT administrator Protects access to the Emergency

Recovery Token, which is a backup file

for the TPM embedded security chip

Owner password Embedded Security, by IT administrator Protects the system and the TPM chip

from unauthorized access to all owner

functions of Embedded Security.

Credential Manager logon password Credential Manager This password offers 2 options:

●It can be used in place of the

Windows logon process, allowing

access to Windows and Credential

Manager simultaneously.

●It can be used in a separate logon

to access Credential Manager after

logging on to Microsoft Windows

Credential Manager recovery file

password

Credential Manager, by IT administrator Protects access to the Credential

Manager recovery file.

Table 1-1 Password Management (continued)

ENWW Managing ProtectTools Passwords 3

Windows logon password Windows Control Panel Can be used in manual logon or saved

on the Java Card.

Backup scheduler password

NOTE A Windows user

password is used to configure

the backup scheduler for

embedded security.

Embedded Security, by IT administrator Sets backup scheduler for embedded

Security

PKCS #12 Import password

NOTE Each imported

certificate has a password

specific to that certificate.

Embedded Security, by IT administrator Password used for Encryption key from

other certificates, if imported

NOTE Not required for normal

software operation; user may

opt to set this password when

using embedded security to

send important certificates

Password Reset Token Embedded Security, by IT administrator Customer provided tool allowing the

owner to reset the Basic User password

if lost; password is used to perform this

reset operation

Microsoft Recovery Agent administrator

password

NOTE The Recovery Agent

can be any local machine

Administrator. If the Recovery

Agent is created, then one

would need to log in as that

administrator and a password is

required. The Recovery Agent

can decrypt all users’ encrypted

data just by opening it (no

Wizard required).

Microsoft, by IT Security administrator Ensure that the Personal Secure Drive

(PSD) encrypted data can be recovered.

See http://www.microsoft.com/technet/

prodtechnol/winxppro/support/

dataprot.mspx for more information.

NOTE Not required for normal

software operation; user may

opt to set this password when

using embedded security to

send important certificates

Virtual Token Master PIN Credential Manager Customer option to store owner

credentials with Credential Manager

Virtual Token User PIN Credential Manager Customer option to store owner

credentials with Credential Manager

Backup Identity wizard password Credential Manager, by IT administrator Used to protect access to an identity

backup when using Credential Manager

Virtual Token Authentication password Credential Manager Used to register virtual token

authentication by Credential Manager

TPM authentication alias Credential Manager Used in place of the Basic User

password by credential manager, at the

option of administrator or user

Fingerprint logon Credential Manager Credential Manager allows the user to

replace the Windows password logon

with a convenient and secure fingerprint

logon. Unlike Password, fingerprint

credentials cannot be shared, given

away, stolen, or guessed. Used by

Credential Manager

USB Token authentication Credential Manager Used by Credential Manager as a token

authentication instead of a password

Table 1-1 Password Management (continued)

4 Chapter 1 Introduction ENWW

Altri manuali per dc5700 - Microtower PC

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali HP Software

HP HPE XP P9500 Manuale utente

HP 500 G2 Manuale utente

HP HP-UX 11i Manuale di servizio

HP BladeSystem bc2000 - Blade PC Manuale utente

HP StorageWorks SN6000 Manuale utente

HP D7171A - NetServer - LPr Manuale utente

HP Surestore Tape Library Model 10/180 Manuale utente

HP C7791C - DesignJet 130 Color Inkjet Printer Guida alla configurazione

HP D6030A - NetServer - E50 Manuale utente

HP e3000 Manuale utente

HP SysMan Manuale utente

HP BB118BV - StorageWorks Data Protector Express... Istruzioni operative

HP StorageWorks 8/8 - SAN Switch Manuale di istruzioni

HP Integrity BL860c Manuale di istruzioni

HP HP Integrated Lights-Out Manuale utente

HP PROLIANT 56976839 Come usare

HP StorageWorks SSL1016 Istruzioni utente

HP 6300C - ScanJet - Flatbed Scanner Manuale utente

HP Surestore Disk Array 12h - And FC60 Manuale di riferimento

HP vc4825T - Thin Client Manuale di servizio

HP NonStop SQL/MP Manuale del proprietario

HP NonStop RDF J-series RVUs Manuale di programmazione

HP 345646-001 - StorageWorks NAS 2000s External Storage... Istruzioni per l'installazione e il funzionamento

HP Xw460c - ProLiant - Blade Workstation Manuale utente

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuale utente

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Novell

Novell SP2 - S Manuale di istruzioni

HP dc5700 - Microtower PC Manuale utente

Manuali Software popolari di altre marche