Revision as of 14:22, 26 July 2011

Protecting sensitive information is important to Virginia Tech and ECE. Virginia Tech’s Standard for Storing and Transmitting Personally Identifying Information defines 7 data elements that must be protected with encryption when kept on your computer.

• Social security number
• Bank account numbers
• Driver’s license numbers
• Credit card numbers
• Debit card numbers
• Passport numbers
• Date of Birth in the same document as first and last name

Finding these data elements can be challenging. To help find this sensitive information, Virginia Tech has purchased a site license for Identity Finder. Identity Finder is commercial software that searches for sensitive data such as social security numbers, credit card numbers, and a variety of other data elements. It is a powerful tool that faculty and staff can use to find sensitive data on their Virginia Tech owned machines and storage. For more information on the VT Policies for securely storing and using sensitive data, please see the following:

• VT Policy for Standard for Storing and Transmitting Personally Identifying Information
• VT Security Standards for Social Security Numbers

The Bradley Department of Computer and Electrical Engineering encourages using Identity Finder to find any sensitive information on your computer(s). When this information is found, we recommend either removing it securely or by encrypting the data using using TrueCrypt and the VT eToken

Installing Identity Finder

The Bradley Department of Computer and Electrical Engineering recommends registering your copy of Identity Finder with our ECE Server Console. By registering with our Console, your Identity Finder install will be centrally managed by the ECE IT team and your computer will be scanned automatically once a month.

If you want to install a stand-alone version of Identity Finder, please see the instructions at the VT Identity Finder page.

Install and Register Identity Finder with the ECE Server Console (Windows)

1. Open a web page to https://identity.ece.vt.edu/Services
2. Click the link for your version of Windows and save the file to your computer
   • How to check if Windows is 32-bit or 64-bit
   • See below if you are using a Macintosh
3. Open the containing folder and double click the ClientSettings.reg file
   • Note: Firefox appends a .txt to the file, you need to rename the file to remove the .txt
4. Accept the prompts to edit the registry
5. Download Identity Finder from http://network.software.vt.edu
6. Install Identity Finder
   • Windows Install Instructions
   • Macintosh Install Instructions
7. Once Identity Finder is installed, you're done. You can scan the computer on your own, or let the ECE Server Console handle the scheduling.

• Note: If you have already installed Identity Finder and wish to register your copy with the ECE Server Console, please follow Steps 1-4 above and then restart the Identity Finder Endpoint Service
  • Click Start, click Control Panel, double-click Administrative Tools, and then double-click Services.
  • In the Details Pane, scroll down to Identity Finder Endpoint Service, right-click and select Start

Install and Register Identity Finder with the ECE Server Console (Macintosh)

Instructions forthcoming

Using TrueCrypt and VT Personal eToken to encrypt your data

• Note: This method uses a keyfile on your VT Personal eToken instead of a normal password. This provides both physical security and lets you to copy the keyfile to a remote secure location for backup and recovery. The ECE IT Group strongly recommends backing up your keyfile, and offers backup services to this end. Please see your local ECE IT for more information.

Creating the TrueCrypt Volume and Keyfile

• Download and install TrueCrypt and the Virginia Tech eToken software

1. Open TrueCrypt
2. Click on Settings menu -> Security Tokens...
3. In the dialog box enter the following and click OK:
   • Windows: C:\Windows\system32\etpkcs11.dll
   • OS X: /usr/local/lib/libeTPkcs11.dylib
4. Click on Tools menu -> Keyfile Generator
   • Note: Technically any file can be a keyfile, however we recommend creating a new one with the built-in tool
5. Follow the instructions at the top of the window, then select Generate and Save Keyfile... and choose a easy-to-remember filename.
6. Click OK to close the Keyfiles window
7. Insert your VT eToken into a USB slot
8. Click on Tools menu -> Manage Security Token Keyfiles... and enter the eToken password
   • Note: If you are not prompted for your eToken password, please make sure that you have properly installed the eToken software.
9. Click on Import Keyfile to Token...
10. Select the keyfile you created in step 5 and click Open
11. Click OK twice to close out of the Security Token windows.
12. Click on Settings menu -> Default Keyfiles...
13. Click on Add Token Files...
14. Select your eToken name and click OK twice to close the windows.
15. Read the prompt and click Yes
16. Click on Create Volume to start the Volume Creation Wizard
17. Select Create an encrypted file container and click Next
18. Select Standard TrueCrypt volume and click Next
19. Click Select File..., choose a filename and location for your TrueCrypt volume and click Next
    • IMPORTANT: This file is the encrypted "folder" where you will be putting your sensitive data, remember where you save it!!
20. Select AES in the drop-down menu and click Next
21. Choose a volume size appropriate for your files. This is a static volume size, you will need to make a new TrueCrypt volume if you run out of room for your files.
22. Leave the password boxes clear, check Use keyfiles and click on Keyfiles...
23. Select your eToken name and click OK,
24. Click Next
25. Enter your eToken password
26. Keep the default Filesystem options (FAT, Default, uncheck Dynamic) and move your mouse as randomly as possible for a brief time before clicking Format
27. Click OK, then Next, then Cancel to close the Volume Creation Wizard
28. Click Settings menu -> Preferences
29. Under the Auto-Dismount section:
    • Check "User logs off" (default)
    • Check "Screen saver is launched"
    • Check "Auto-dismount volume after no data has been read/written to it for _____ minutes" (Recommended 25 minutes)
    • Check "Force auto-dismount even if volume contains open files or directories" (default)
30. Click OK to close the preference window
31. See the next section for instructions on mounting the TrueCrypt Volume you have just created

Mounting your TrueCrypt Volume

1. Open TrueCrypt
2. Insert your VT eToken into a USB slot
3. Select a drive letter in the main window
4. In the "Volume" section, click on Select File...'
5. Select the TrueCrypt Volume file you created in the section above and click Open
6. Click on Mount
7. Enter your eToken password and click OK
8. Your TrueCrypt Volume will open in a new Windows Explorer window, and you can move your files to the folder. The volume is mounted as an additional drive under Computer
   • Remember that your TrueCrypt Volume will dismount automatically if you do not use it for the ___ minutes set in the instructions above
9. When you are finished working with your TrueCrypt volume, remember to Dismount!