HP dc5700 - Microtower PC User manual

HP ProtectTools Security Manager Guide
HP Compaq Business Desktops

© Copyright 2006 Hewlett-Packard
Development Company, L.P. The
information contained herein is subject to
change without notice.
Microsoft and Windows are trademarks of
Microsoft Corporation in the U.S. and other
countries.
Intel and SpeedStep are trademarks of Intel
Corporation in the U.S. and other countries.
The only warranties for HP products and
services are set forth in the express warranty
statements accompanying such products
and services. Nothing herein should be
construed as constituting an additional
warranty. HP shall not be liable for technical
or editorial errors or omissions contained
herein.
This document contains proprietary
information that is protected by copyright. No
part of this document may be photocopied,
reproduced, or translated to another
language without the prior written consent of
Hewlett-Packard Company.
HP ProtectTools Security Manager Guide
HP Compaq Business Desktops
First Edition (August 2006)
Document Part Number: 431330-001

About This Book
This guide provides instructions for configuring and using HP ProtectTools Security Manager.
WARNING! Text set off in this manner indicates that failure to follow directions could result in
bodily harm or loss of life.
CAUTION Text set off in this manner indicates that failure to follow directions could result in
damage to equipment or loss of information.
NOTE Text set off in this manner provides important supplemental information.
ENWW iii

iv About This Book ENWW

Table of contents
1 Introduction
HP ProtectTools Security Manager ...................................................................................................... 1
Accessing the ProtectTools Security Manager .................................................................... 1
Understanding Security Roles .............................................................................................................. 2
Managing ProtectTools Passwords ...................................................................................................... 2
Multifactor Authentication Credential Manager Logon ......................................................... 5
Creating a Secure Password ............................................................................................... 5
Advanced Tasks ................................................................................................................................... 6
Managing ProtectTools Settings .......................................................................................... 6
Enabling and Disabling Java Card Power-On Authentication Support ............... 6
Enabling and Disabling Power-On Authentication Support for Embedded
Security ............................................................................................................... 6
Managing Computer Setup Passwords ............................................................................... 7
Setting the Power-On Password (if available) ..................................................... 7
Changing the Power-On Password (if available) ................................................ 7
System Setup ...................................................................................................... 8
Changing Power-On Authentication Support ...................................................... 8
Changing User Accounts .................................................................................... 8
Setting the Computer Setup Administrator Password ......................................... 9
Changing the Computer Setup Administrator Password ..................................... 9
Dictionary Attack Behavior with Power-On Authentication ................................ 10
Dictionary Attack Defense ................................................................ 10
2 HP BIOS Configuration for ProtectTools
Basic Concepts .................................................................................................................................. 11
Changing BIOS Settings .................................................................................................................... 11
3 HP Embedded Security for ProtectTools
Basic Concepts .................................................................................................................................. 13
Setup Procedures ............................................................................................................................... 14
4 HP Credential Manager for ProtectTools
Basic Concepts .................................................................................................................................. 15
Launch Procedure .............................................................................................................................. 15
Logging On for the First Time ............................................................................................ 16
5 HP Java Card Security for ProtectTools
Basic Concepts .................................................................................................................................. 17
ENWW v

6 Third-Party Solutions
7 HP Client Manager for Remote Deployment
Background ........................................................................................................................................ 21
Initialization ......................................................................................................................................... 21
Maintenance ....................................................................................................................................... 21
8 Troubleshooting
Credential Manager for ProtectTools ................................................................................................. 23
Embedded Security for ProtectTools .................................................................................................. 27
Miscellaneous ..................................................................................................................................... 33
Glossary ............................................................................................................................................................. 37
Index ................................................................................................................................................................... 41
vi ENWW

1 Introduction
HP ProtectTools Security Manager
ProtectTools Security Manager software provides security features that help protect against
unauthorized access to the computer, networks, and critical data. Enhanced security functionality is
provided by the following modules:
●HP BIOS Configuration for ProtectTools
●HP Embedded Security for ProtectTools
●HP Credential Manager for ProtectTools
●HP Java Card Security for ProtectTools
The modules available for the computer may vary, depending on the model. ProtectTools modules may
be preinstalled, supplied on CD that shipped with the computer, or available for purchase from the HP
Web site. Visit http://www.hp.com for more information.
NOTE Refer to the ProtectTools Help screens for specific instructions for the ProtectTools
modules.
To use the Trusted Platform Module (TPM), platforms containing a TPM require both a TCG Software
Stack (TSS) and embedded security software. Some models provide the TSS; if the TSS is not provided,
it can be purchased from HP. Additionally, TPM-enabling software must be purchased separately for
some models. Please see Third-Party Solutions for more details.
Accessing the ProtectTools Security Manager
To access the ProtectTools Security Manager from the Microsoft Windows Control Panel:
▲Windows XP: Click Start > Control Panel > Security Center > ProtectTools Security
Manager.
▲Windows 2000: Click Start > All Programs > HP ProtectTools Security Manager.
NOTE After you have configured the Credential Manager module, you can also log in to
Credential Manager directly from the Windows logon screen. For more information, refer to HP
Credential Manager for ProtectTools.
ENWW HP ProtectTools Security Manager 1

Understanding Security Roles
In managing computer security (particularly for large organizations), one important practice is to divide
responsibilities and rights among various types of administrators and users.
NOTE In a small organization or for individual use, these roles may all be held by the same
person.
For ProtectTools, the security duties and privileges can be divided into the following roles:
●Security officer—Defines the security level for the company or network and determines the security
features to deploy, such as Java Cards, biometric readers, or USB tokens.
NOTE Many of the features in ProtectTools can be customized by the security officer in
cooperation with HP. For more information, visit http://www.hp.com.
●IT administrator—Applies and manages the security features defined by the security officer. Can
also enable and disable some features. For example, if the security officer has decided to deploy
Java Cards, the IT administrator can enable Java Card BIOS security mode.
●User—Uses the security features. For example, if the security officer and IT administrator have
enabled Java Cards for the system, the user can set the Java Card PIN and use the card for
authentication.
Administrators are encouraged to perform “best practices” in restricting end-user privileges and
restrictive access to users.
Managing ProtectTools Passwords
Most of the ProtectTools Security Manager features are secured by passwords. The following table lists
the commonly used passwords, the software module where the password is set, and the password
function.
The passwords that are set and used by IT administrators only are indicated in this table as well. All
other passwords may be set by regular users or administrators.
Table 1-1 Password Management
ProtectTools Password Set in this ProtectTools Module Function
Computer Setup administrator
password
NOTE Also known as BIOS
administrator, F10 Setup, or
Security Setup password
BIOS Configuration, by IT administrator Protects access to the BIOS Computer
Setup utility and security settings.
Power-On password BIOS Configuration HP ProtectTools Power-On
Authentication Support is a TPM-based
security tool designed to prevent
unauthorized access to the computer as
it is powered on. Power-On
Authentication Support uses the HP
ProtectTools Embedded Security Basic
User password. Once Power-On
Authentication is enabled in Computer
Setup, the password is set when the first/
2 Chapter 1 Introduction ENWW

next Embedded Security Basic User Key
is initialized. The Embedded Security
TPM chip protects the password for
Power-On Authentication.
Java Card administrator password
NOTE Also known as BIOS
administrator card password
Java Card Security, by IT administrator Links the Java Card to the computer for
identification purposes.
Allows a computer administrator to
enable or disable Computer Setup
passwords, generate a new
administrator card, and create recovery
files to restore user or administrator
cards.
Java Card PIN Java Card Security Protects access to the Java Card
contents and to computer access when
an optional Java Card and reader is
used. Checks to see if Java Card user
password is duplicate to pin; it is used to
register Java Card authentication
Java Card recovery file password (if
available)
Java Card Security Protects access to the recovery file that
contains the BIOS passwords.
Java Card user password (if available)
NOTE Also known as BIOS
user card password
Java Card Security Links the Java Card to the computer for
identification.
Allows a user to create a recovery file to
restore a user card.
Basic User password
NOTE Also known as:
Embedded Security password,
TPM Preboot password
Embedded Security Used to access Embedded Security
features, such as secure e-mail, file, and
folder encryption. When enabled as the
BIOS Power-On Authentication support
password, protects access to the
computer contents when computer is
turned on, restarted, or restored from
hibernation. Also used to authenticate
the Personal Secure Drive (PSD) and to
register TPM authentication.
Emergency Recovery Token password
NOTE Also known as:
Emergency Recovery Token
Key
Embedded Security, by IT administrator Protects access to the Emergency
Recovery Token, which is a backup file
for the TPM embedded security chip
Owner password Embedded Security, by IT administrator Protects the system and the TPM chip
from unauthorized access to all owner
functions of Embedded Security.
Credential Manager logon password Credential Manager This password offers 2 options:
●It can be used in place of the
Windows logon process, allowing
access to Windows and Credential
Manager simultaneously.
●It can be used in a separate logon
to access Credential Manager after
logging on to Microsoft Windows
Credential Manager recovery file
password
Credential Manager, by IT administrator Protects access to the Credential
Manager recovery file.
Table 1-1 Password Management (continued)
ENWW Managing ProtectTools Passwords 3

Windows logon password Windows Control Panel Can be used in manual logon or saved
on the Java Card.
Backup scheduler password
NOTE A Windows user
password is used to configure
the backup scheduler for
embedded security.
Embedded Security, by IT administrator Sets backup scheduler for embedded
Security
PKCS #12 Import password
NOTE Each imported
certificate has a password
specific to that certificate.
Embedded Security, by IT administrator Password used for Encryption key from
other certificates, if imported
NOTE Not required for normal
software operation; user may
opt to set this password when
using embedded security to
send important certificates
Password Reset Token Embedded Security, by IT administrator Customer provided tool allowing the
owner to reset the Basic User password
if lost; password is used to perform this
reset operation
Microsoft Recovery Agent administrator
password
NOTE The Recovery Agent
can be any local machine
Administrator. If the Recovery
Agent is created, then one
would need to log in as that
administrator and a password is
required. The Recovery Agent
can decrypt all users’ encrypted
data just by opening it (no
Wizard required).
Microsoft, by IT Security administrator Ensure that the Personal Secure Drive
(PSD) encrypted data can be recovered.
See http://www.microsoft.com/technet/
prodtechnol/winxppro/support/
dataprot.mspx for more information.
NOTE Not required for normal
software operation; user may
opt to set this password when
using embedded security to
send important certificates
Virtual Token Master PIN Credential Manager Customer option to store owner
credentials with Credential Manager
Virtual Token User PIN Credential Manager Customer option to store owner
credentials with Credential Manager
Backup Identity wizard password Credential Manager, by IT administrator Used to protect access to an identity
backup when using Credential Manager
Virtual Token Authentication password Credential Manager Used to register virtual token
authentication by Credential Manager
TPM authentication alias Credential Manager Used in place of the Basic User
password by credential manager, at the
option of administrator or user
Fingerprint logon Credential Manager Credential Manager allows the user to
replace the Windows password logon
with a convenient and secure fingerprint
logon. Unlike Password, fingerprint
credentials cannot be shared, given
away, stolen, or guessed. Used by
Credential Manager
USB Token authentication Credential Manager Used by Credential Manager as a token
authentication instead of a password
Table 1-1 Password Management (continued)
4 Chapter 1 Introduction ENWW