1. (Presented by Eric Nobel)
Disk & File Encryption
Rob Bandler 21 June 2016
(Presented by Eric Nobel)

2. Agenda Introductions Service Description Value Proposition Metrics
Costs
Security
More Information
Q&A

3. Introductions Service owner: Rob Bandler Service manager: Eric Nobel
Other service delivery team members:
Meryl Bursic
Lillian Isacks
Tim Bradish, Tom Horton, Glenn Larratt
Kris Barth, Pete Caforio (Desktop Engineering)

4. Service Description Service name: Disk & File Encryption Product(s):
Windows devices: Microsoft BitLocker Administration and Monitoring (MBAM) via Configuration Manager 2012 (CM2012) or standalone BitLocker
Macintosh devices: FileVault2 via Casper or standalone FileVault2
Pretty Good Privacy (PGP) (sunsets October 2016)
Brief text description: Disk and file encryption is available to all faculty, staff, and students at no cost for both major platforms (Windows and Macintosh) and both institutionally- and personally-owned devices. Encryption is the process of scrambling data to make it unreadable to anyone who does not possess the proper key
Available to:
MBAM – CM2012 subscribers only via their Technical Support Provider (TSP)
FileVault2 via Casper – Casper subscribers only via their TSP
MBAM, BitLocker and FileVault2 (standalone) - all Faculty, Staff, TSPs, and Students
Fee? No
Service tier: One

5. Value Proposition Value proposition Customer impact Key benefits
Mitigates risk of unauthorized data access in the event of asset loss
Campus site license for MBAM – no additional fee
Native/free solutions for non-Cornell owned &/or non-managed/personally owned devices
Customer impact
Little to no impact on functionality
Improved security of data
Key benefits
Saving institutional money & improved data security in the event of asset loss
Provides compliance with Cornell University Policy 5.10 “Information Security”
Ease of use, reliability, and maintainability will be vastly better with the native solutions
Flexible models for standalone, managed, or unmanaged devices

6. Metrics FY16 Q3 FY 16 Q3 Metrics User/Unit* 2,965
Service & Support Hours 58
Customer Contacts (questions, requests, etc…) 6
Availability
100%
Changes (upgrades, patches, etc.) 2
600 - Casper/FileVault2 639)
956 - CM/MBAM (now there are 925 fully encrypted)
= 1556
1409 – PGP (376 unique users and 442 unique host names/devices)
Q3 total = 2965
MBAM server reports 1462 devices, 1295 of which are Compliant with deployed policies the primary reasons for non-compliant are: “System Partition not available or large enough” and “Unable to find compatible TPM”
CURRENT TOTOAL DEVICES ENCRYPTED ACROSS ALL PRODUCTS = 3301
* NOTE: User/Unit = devices encrypted with PGP or BitLocker

7. Current Costs Cost to deliver the current service:
FY 16 Total Cost
$64,156
Hardware & Software
$16,091
Labor
$42,233
Staff Support
$2,916
Administrative Overhead
$21.63 per encrypted device
Cost per device: $21.63
Fee for service: No

8. Future Costs Cost to deliver the service: Cost per device: $16.41
FY 17 Estimated Cost
$48,657
Hardware
$2,000
Labor
$42,233
Staff Support
$2,212
Administrative Overhead
$16.41 per encrypted device
Cost / device continues to go down as more user get onboard with the central encryption services
$14.74 per encrypted device based on current number of encrypted devices and estimated costs….will continue to change....
Cost per device: $16.41
Fee for service: No

9. Security What risks does use of the service mitigate?
Financial loss
Reputational harm
Information security and data loss
How does the service mitigate risks?
Secure/consistent default Group Policy Object (GPO) configuration provided
Makes data access by outsiders virtually impossible in the event of asset loss

10. More Information Service web page: Service level expectations:
Start here: and click on “Security”
Service level expectations:
Service catalog entry:
Service quarterly report:

11. More Information

12. Questions?