HP ProBook 4325s - Notebook PC Instruction Manual

H P Protec tTo ols Sec urity Softwa re 2 010
Technica l whi te paper
Table of contents
Intr oduc ti o n ......................................................................................................................................... 2
H P Pr ote c tTo ols s e c uri ty so ftw a re overview ............................................................................................. 2
HP security setup wizard....................................................................................................................... 4
User management................................................................................................................................ 5
Backup and restore .............................................................................................................................. 5
Security software components for HP ProtectTools .................................................................................... 6
C redential Manager for HP ProtectTools ............................................................................................. 7
C entra l ma na g e ment for H P Pro te c tToo ls ............................................................................................. 8
Device Access Manager for HP ProtectTools........................................................................................ 9
Drive Encryption for HP ProtectTools ................................................................................................. 11
HP Enha nced Pre-B o ot S e c uri ty ........................................................................................................ 12
Embedded Security for HP ProtectTools ............................................................................................. 14
Face Recognition for HP ProtectTools ................................................................................................ 15
File Sanitizer for HP ProtectTools ...................................................................................................... 16
Computrace® LoJack Pro for HP ProtectTools..................................................................................... 17
Privacy Manager for HP ProtectTools................................................................................................ 17
Smart Card Security for HP ProtectTools............................................................................................ 19
Platform Support................................................................................................................................ 20
Frequently Asked Q uesti ons ................................................................................................................ 21
For more information.......................................................................................................................... 25

2
Introduc ti on
Data security can have a direct impact on the health of your business, and most businesses ra nk
security among their top concerns. Threats to data security are increasing in ma gnitude as well a s
complexity as computers become more mobile and better connected.
HP ha s a rich heritage in enterprise security and started devoting resources to solving the mobile
security problem as soon as the trend emerged. Taking a holistic approach to security, HP designed
HP ProtectTools se c ur i ty s o ftw a r e to provide protection for PC s, a nd to ensure tha t PC s do not
become points of vulnerability that threaten the entire IT infrastructure. HP ProtectTools s ec ur i ty
so ftwa re not only helps protect PC s a nd prevent them from becoming points of vulnerability, i t is also
extensible, easy to use, and centrally manageable.
HP ProtectTools security software overview
Security concerns are inherent with the trend towards mobility, but we cannot let security concerns
slow mobility adoption. Thatis why HP decided to invest heavily in building a stro ng se c uri ty
portfolio. O ur goa l is to offer our customers the most comprehensive standard security features out of
the box of any client PC manufacturer.
HP ProtectTools for Microsoft® W indows® includes a complete suite of features that work together to
protect access to your notebook or desktop computer, protect the data on it, and protect the network
you connect to. HP ProtectTools security software provides security features that help protect against
unauthorized access to the computer, networks, and critical data. Enhanced security functionality is
provided by several HP ProtectTools software modules.
Ta b l e 1 sho w s the three p i l la r s o f secur i ty and HP ProtectTools solutions for each.
Table 1. Three pillars of security and HP ProtectTools integrated solutions for total information protection
A ccess p r ot ect i on
(strong authentication)
Data protection
(data at rest)
Communications protection
(data in motion)
Integrated fingerprint sensor,
facial recognition, and smartcard
reader
Drive Encryption (full volume
encryption standard with every
busi ness no teb ook)
Credential Manager single
si g n-o n fea ture keep s passw or d s
in a vault and automatically enters
them when required
Enhanced pre-boot security
(multiple users, multiple factors)
Device Access Manager prevents
unauthorized copying of files to
removable drives
Privacy Manager allows more
secure communication via instant
messaging (IM ) and email
HP SpareKey can recover users
from lost credentials after initial
user setup
File Sanitizer allows you to
securely delete files from hard
drive so they cannot be recovered
in accordance with the DOD
5220.22-M Supplement
HP ProtectTools can be accessed from a single, easy-to-use software interface. It i s ea si l y a cc essi b l e
from the W indows® task bar, start menu, or desktop gadget. Each plug-in module provides a high
level overview of its purpose. The desktop gadget also indicates the overall security status of your
computer using an easy to understand color code. Detailed help files provide additional information.
HP ProtectTools Security Manager i s a t the heart of the security strategy for business notebooks,
desktops and workstations. This single client console application unifies the security capabilities of HP

3
business notebooks, desktops and workstations under a common architecture and single user interface
(Figure 1).
Fi g u r e 1. HP ProtectTools Security Manager Console
HP ProtectTools is also centrally manageable at the workgroup or enterprise level using either
DigitalPersona Pr o W orkgroup or DigitalPersona Pr o Enterprise management solutions. Organizations
have many security needs, which can create a management challenge. Central management allows
administrators to create role based security policies, decide how users log on, remotely recover users
who have lost their credentials, or revoke user credentials, all from a single control point. HP
ProtectTools with DigitalPersona Pro provides a single management platform for multiple security
applications. Client software for legacy computers allows deployment throughout the entire
organization. Mixed deployments of HP ProtectTools and DigitalPersona Pro client software can be
managed through a single management tool (Figure 2).

4
Fi g u r e 2. HP ProtectTools Administrative Console
The HP ProtectTools Security Manager framework allows you to adapt HP ProtectTools functionality
through add-on modules as your security needs change. This approach ensures that all new HP
ProtectTools security modules introduced over time are highly integrated. Ultimately, you benefit from
security features that are easier to use, manageable, and provide enhanced value by taking
advantage of the multiple security hardware attributes of the personal computing device.
HP ProtectTools Security Manager provides global functionality needed by the installed security
modules, as well as security setup features such as the setup wizard, user management and
security backup and restore.
HPsecurity setup wizard
Setting up security should be fast and easy. Getting started with HP ProtectTools is as easy as swiping
your finger on the HP fingerprint sensor or clicking the desktop gadget. This launches the setup
wizard for HP ProtectTools and guides you through a short list of simple questions after which your
notebook is setup protected. Th e setup wizard is designed to help you secure access to your computer
via a password, smartcard, fingerprint sensor, or face recognition. It allows you to safeguard the
information on your hard drive using data encryption, securing both access and data for total
information protection.
Security levels can be selected individually or in combination. At a minimum, HP recommends
accepting the default setting of W indows level and Pre-Boot Security. For total protection, Drive
Encryption can also be selected. The setup wizard then does the rest.

5
Login methods can also be selected either individually or in combination to achieve multifactor
authentication. The HP ProtectTools Java C ard is a two factor authentica tion method, requiring
both possession and a PIN to authenticate. Passwords, fingerprints, and face recognition are
single factor authentication methods. To achieve multifactor authentication with these methods,
users ca n use them in combina ti o ns such a s fingerprint with pa ssword.
User management
In an HP ProtectTools secured computer, security is built in from the ground up and completely
integrated. There is no longer a separate pre-boot password, a separate drive encryption password
and a separate operating system password. Security is global to the computer and users exist in
W indows as well as in the pre-boot environment.
User ma na gement, accessed from HP ProtectTools Administrative C onsole, is designed to allow y o u to
create and delete ProtectTools users system wide. To ensure that users and security policies are
synchronized between the operating system and the pre-boot environment, users should always be
added and deleted using HP ProtectTools user management.
Backup and r e sto re
G ood information security is not simply about the best technologies, it also requires best practices.
Regular backup of security policies, encryption keys, credentials and certificates is a best practice that
imposes small administrative overhead in the short term, but can result in significant cost savings in
the long run.
HP ProtectTools Backup and Restore is not a user data backup solution. It is designed to backup
security related data such as login credentials and encryption keys. Therefore, the backup and restore
process only takes a few minutes. Backup and Restore is available from the Security Manager by
clicking on the A dvanced link (Figure 3).

6
Fi g u r e 3. HP ProtectTools Security Manager Backup and Restore menu
Using HP ProtectTools backup and restore, users have the flexibility to:
•Perform a full HP ProtectTools backup, which backups data from all installed modules
•Perform a selective backup which allows selected modules to be backed up
•Selective Restore
•Full Restore
S e c ur i ty softwa re components for HP Prote c tTools
The modular architecture of the HP ProtectTools Security Manager enables add-on components to be
selectively installed by the end user or IT administra tor. This provides a high degree of flexibility to
customize HP ProtectTools depending on security needs a nd the underlying ha rdwa re configura tion.
Each add-on element is a self contained security application providing targeted security functionality.
Inte g ra te d i nto H P Pr otectTools Security Manager, these applications form a holistic security solution.
They are specifically designed to work with and complement each other. These elements include:
•C redential Manager for HP ProtectTools
•C entral Ma nagement for HP ProtectTools
•Device Access Manager for HP ProtectTools
•Drive Encryption for HP ProtectTools
•Embedded Security for HP ProtectTools
•Face Recognition for HP ProtectTools

7
•File Sanitizer for HP ProtectTools
•C o mputr a c e® LoJack Pro for HP ProtectTools
oTracking and recovery requires a fee based subscription and setup. For details and
country availability, please visit www.absolute.com/ products/ lojackforlaptops.
•Privacy Manager for HP ProtectTools
G oing forward, as new needs are identified, HP expects to continue to expand its PC se c ur i ty
offerings with additional modules for the HP ProtectTools Security Manager.
C redential Manager for HP ProtectTools
C redential Manager gives users the ability to specify how the different available security technologies
will work together to provide increased protection against unauthorized access to the personal
computer (Figure 4). It i s the g lue tha t b r i ng s the different security technologies together to create a
specified behavior.
Fi g u r e 4. Credential Manager for HP ProtectTools
Through Credential M anager, users can create a unique security behavior that requires their chosen
authentication method, including alternatives to passwords when logging on to Microsoft® W i nd o w s.
Credential Manager also provides single sign-on capability that automatically remembers credentials
for websites, applications, and protected network resources. Credential Manager includes a personal
password vault that makes accessing protected information more secure and convenient.
Key features of Credential Manager include:
•Full integration into HP ProtectTools Security Manager
•Centrally manageable

8
•Support for smart cards (including HP ProtectTools Java C ards), biometric fingerprint security, TPM
embedded security chips, USB tokens, virtua l to kens a nd passwords
•Single sign-on capability manages and protects passwords for websites, applications and network
resources
Table 2 shows the features and benefits of Credential Manager for HP ProtectTools.
Table 2. Credential M anager for HP ProtectTools features and benefits
Fe a t u r e Benefit
Multifactor authentication support Brings together the available (integrated and add-o n) securi ty
technologies on a PC into a cohesive and unique behavior that utilizes
these technologies to authenticate users based on user preferences.
Microsoft W indows logon
capability
Enables the use of any supported security technology to logon to
W indows providing a more secure and convenient alternative to
password authentication.
Single sign-o n ma na g es user
credentials fo r w eb si tes,
applications and protected
network resources
Users no longer need to remember multiple passwords for protected
websites, applications and network resources.
Single sign-
on works with multifactor authentication capabilities to add
additional protection requiring users to re-authenticate when accessing
particularly sensitive data.
Registering new websites, applications or network logon dialogues is
si mple, making it easy for users to begin taking advantage of the
added convenience and security.
Central management for HP ProtectTools
Central Management for HP ProtectTools is developed in partnership with DigitalPersona, and is
available in two configurations: DigitalPer so n a Pr o Enterprise and DigitalPersona Pro W orkgroup.
Central Management allows administrators to create and deploy role based policies, revoke a ccess
and recover users w i th l o st cr ed enti a l s. DigitalPersona Pro Enterprise is designed for small to medium
b usi nesses a nd enter p r i ses tha t use A c ti ve Di recto r y. It a l l ow s a d mi ni str a to r s to leverage Active
Directory for maximum scalability. Figure 5 shows the key features of HP ProtectTools with
DigitalPersona Pro. DigitalPersona Pro W orkgroup makes central management accessible to smaller
organizations without Active Directory through simplicity of design and deployment, and attractive
per seat cost. DigitalPersona Pro W orkgroup i s a self -contained solution with no special server
hardware requirements. It makes security easy to deploy by allowing administrators to create role
based policies and implement them within the workgroup. Security keys are managed centrally and
allow the administrator to recover users with lost credentials. DigitalPersona Pro W orkgroup can be
accessed directly from HP ProtectTools and can be deployed for up to five users with no per seat cost.

9
Fi g u r e 5. Key features of HP ProtectTools with DigitalPersona Pro
DigitalPersona Pro protects applications and data by simplifying security controls for multiple
applications. It provides for strong authentication to boost accountability and deter fraud. It simplifies
auditing with comprehensive logging. By consolidating point management tools into one console,
organizations are able to automate processes and reduce costs from passwords and provisioning.
Table 3 sho w s the major features of HP ProtectTools with DigitalPersona Pro.
Table 3. HP ProtectTools with DigitalPersona Pro central management features and benefits
Fe a t u r e Benefit
Support for other PCs Deploy HP ProtectTools-compatible client on legacy or non-H P PC s
Security policy synchronization Keep secur i ty p oli ci es a nd setti ng s the same acr oss PC s
Strong authentication Combine passwords, smart cards, fingerprints, face recognition
Access recovery Unlock pre-boot, disk encryption and PCs for forgotten passwords or
smart cards
Single Sign-on (SSO ) Enable stronger security for password-based enterprise and web
applications
Secure communications Sign or encrypt email and documents quickly and easily
Audit login Simplify forensics and compliance
Device Access Manager for HP ProtectTools
Device Access M anager for HP ProtectTools speaks to HP’s strong commitment to security and its
ability to respond to customer needs with innovative solutions. A common assumption with today’s PC
usage model is that users who are authorized to log on to a personal computer and access sensitive
data are also able to copy that information. In reality, this is not always the case. Companies may
need to allow users to view sensitive data, but restrict their ability to copy that data. Device Access

10
Manager for HP ProtectTools solves that problem. In doing so, i t enables a new usage model for
personal computing devices.
Device Access Manager for HP ProtectTools has two configuration options: Simple C onfiguration
(Figure 6) and Advanced Configuration.
Fi g u r e 6. Device Access Manager for HP ProtectTools Administrative Console
Simple Configuration
The Simple Configuration option is a collection of common options that can be configured with a
single selection. These options include:
•Limit access to all Removable Media
•Li mi t a c c e ss to a l l D V D / C D -RO M Drives
•Limit access to all Bluetooth devices
•Limit access to all 1394 devices
Device Cla ss Configuration
The Device C lass C onfiguration option is where the true power of Device Access Manager lies. Using
Device C lass C onfiguration, policies can easily be created to implement complex security
requirements as well as complex business processes.
Using Device C la ss C onfiguration, IT Managers can create device and peripheral usage profiles
ba sed on the individual user, user type, individual device or device class. Device Access Manager for
HP ProtectTools allows all devices for all users by defa ult. This ensures a normal experience for users
who don’t require device control. If Device C ontrol is needed however, Device Access Manager
creates a black list of devices for individual users, or a class of users. Through Device C lass

11
C onfiguration, Device Access Manager presents a device tree view derived from the W indows Device
Manager. Individual devices or an entire class of devices from the device tree can be selected.
Access to the selected device can then be restricted by applying the policy to selected users or class
of users.
This level of configurability enables new client usage models, such as described in the scena rios
below:
•Scenario 1: In a call center environment, call takers have full access to sensitive product and
pricing information. The company however wants to protect this data and ensure that it is not
removed from the premises. This can be accomplished by creating a Device Access Manager policy
that prevents removable storage devices such as USB keys and writeable optical drives from being
used by una uthoriz ed users.
•Scenario 2: A company is making sensitive financial information available to a n a udi to r a nd w a nts
to protect this information from being copied or removed from the notebook. Device Access
Manager can allow a policy where this user is denied access to any removable storage devices.
Device Access Manager for HP ProtectTools is a single user client version. However, an enterprise
version of Device Access Manager (HP ProtectTools Device Manager) is also available a nd allows
the same policies to be configured and deployed remotely. For information on HP ProtectTools
Device Manager, please refer to
Drive Encryption for HP ProtectTools
www.hp.com/ hps/ security/ products/
Drive Encryption is a full volume encryption (FV E) solution tha t encodes a ll informa tion on the ha rd
drive volume so it becomes unreadable to an unauthorized person. FVE is currently the preferred
wa y to p ro te c t d a ta o n a ha r d d r i ve . W i th Drive Encryption, you ca n encrypt or decrypt individual
drives, create backup keys, a nd perform a recovery (Figure 7).

12
Fi g u r e 7. Drive Encryption for HP ProtectTools
Drive Encryption for ProtectTools is based on McAfee endpoint protection technology. McAfee i s a
leading provider of powerful encryption and strong access control software that seamlessly integrates
with existing sta ndards-based enter p ri se sy stems.
The hard drive on a new HP Business notebook is unencrypted. The encryption process can be
activated by launching HP ProtectTools Security Manager and selecting Drive Encryption for HP
ProtectTools. Drive encryption is supported on SATA disk drives in the internal drive bay or docking
station.
Before a hard drive can be encrypted, Drive Encryption for HP ProtectTools requires that the
encryption key be backed up. This is a quick and simple process, and only requires access to a USB
flash drive. The key backup ensures that if the password is ever forgotten, it can be reset using the
backed-up key on the USB flash drive.
The hard drive encryption process is transparent and w o rks in the background. The time it takes to
encrypt the entire drive will depend on the size of the partition and how the notebook is being
used. However, while the drive is being encrypted, the user can continue to work normally. If the
notebook is shutdown during encryption, encryption will continue upon system restart.
H P En h a n c e d Pr e -Boot Security
Pr e -Boot security is a feature that requires users to authenticate themselves upon turning on the
computer. This authentication takes place before the operating system is allowed to load. During
Pr e -Boot no software is allowed to run, and even booting from external devices such as optical drives

13
or USB storage is disallowed. This means that software designed to bypass the operating system
password protection cannot run if the computer is protected using Pre-Boot S ecurity. Enha nced
Pre-Boot Security makes it possible to setup multiple users as well as multifactor authentication policies
using a password, fingerprint or HP ProtectTools Java Card.
W hile Pre-Boot security has been available for a number of years, it was never designed for multiuser
environments. In addition, the following factors were commonly cited as the primary reasons for not
using Pre-Boot security:
•La ck of O pera ti ng S yste m i nte g ra ti o n. Thi s mea nt tha t use r s w a nti ng to use p r e -boot security would
have to authenticate themselves twice. O nce in pre-boot a nd then a ga in in the opera ting system
•N o secure recovery options. Let’s face it, people lose smartcards and forget passwords. Until now,
there were two ways to recover, and neither option was very appealing. Some computers would
allow password erase via access to the system board, which was not secure. O n other computers,
the system board had to be replaced, and this was usually not covered under warranty.
HP Enha nced Pre-Boot security addresses both these concerns with O ne-Step Logon and HP
SpareKey. Additionally, H P Enha nced Pre-Boot security is centrally manageable wi th
DigitalPersona Pro W orkgroup and DigitalPersona Pro Enterprise, allowing IT managers to
remotely recover users even if unconnected.
One-Step Logon
Enhanced Pre-Boot Security is designed to integrate seamlessly into W indows authentication in order
to provide users with a seamless logon into the operating system. The user authenticates only once.
The logon process uses the provided credentials to authenticate to the Pre-Boot environment, drive
encryption and then all the way into the operating system. From a user’s standpoint it’s the same
login process as before, just during Pre-Boot instead of the operating system login.
HP SpareKey
HP SpareKey is designed allow users to securely log into their operating system account if they forget
their password, lose their java card or for some reason cannot use their fingerprint to login. Users are
asked to enroll into HP SpareKey when they first log in to the notebook. The enrollment process is
easy and requires the user to answer any three questions out of a predetermined list of ten. These
questions are designed to collect information that is unique to the user and does not change over time
(i.e., mother’s maiden name, first school attended, etc.).
Answering the three questions completes the enrollment, and the user is now protected. In the case of
a lost credential or forgotten password, the user can enter HP SpareKey and answer the previously
selected questions. If the answers match, login continues. Upon completion of the login process, the
user is asked to change the login credential with an option to accept or decline.
Answers to HPSpareKey questions are encrypted and cannot be deciphered by an unauthorized
p er so n. The b a si c p r o cess fo r secur i ng the q uesti ons i s a s f ol l o w s:
•Step 1 - Answers to the three questions are concatenated into a single text string, eliminating all
spaces
•Step 2 - The single text string is then used to derive an encryption key using a SHA1 hash function.
This encryption key is mathematically unique to the three answers given by the user.
•Step 3 - The derived encryption key is used to encrypt the login password. The encrypted password
i s then sto r ed .
Rem ote recovery via central management
On centrally managed systems, HP Enhanced Pre-Bo o t secur i ty sup p o rts O ne Ti me Pa ssw o rd (O TP)
access, allowing IT support to recover remote users even if they are not connected.

14
N either the answers to the three questions nor the encryption key are stored in memory. The only
way to access the encrypted password is to answer the same three questions with exactly the same
responses used during initial enrollment.
Embedded Security for HP ProtectTools
Embedded Security for HP ProtectTools is an add-on module that allows users to configure the TPM
embedded security chip (Figure 8). This add-on module is intended for HP business notebooks,
desktops and workstations configured with a TPM embedded security chip designed to the TC G
standard. E mbedded Security for HP ProtectTools version 4.0 or later supports the latest TPM v1.2
as well as the previous TPM v1.1.
Fi g u r e 8. Embedded Security for HP ProtectTools
Embedded Security for H P ProtectTools uses the TPM embedded security chip to help protect against
unauthorized access to sensitive user data and credentials. Features accessed through Embedded
Security for H P ProtectTools include:
•Administra tive functions such a s ta king ownership a nd ma na ging the owner pa ss phra se
•User functions such a s user enrollment and management of user pass phrases
•Configura tion options including setting up enhanced M icrosoft Enc r y pte d File Sy ste m (E F S ) a nd
Personal Secure Drive for helping to p ro te c t us er d a ta a s well as functions such a s ba cking up a nd
r es tor i ng the key hierarchy as well as key migration.
Embedded Security for HP ProtectTools is supported on all HP business notebooks, desktops and
workstations configured with a qualified TPM embedded security chip. See Ta ble 6 of thi s w hi te
paper for more information on support by platform.

15
Table 4 shows Embedded Security for HP ProtectTools features and benefits.
Table 4. Embedded Security for HP ProtectTools features and benefits
Fe a t u r e Benefit
W orks with HP ProtectTools
Security Manager
User interface is fully integrated into the HP ProtectTools Security
Manager. Increases the functionality of the entire security solution by
allowing access to the embedded security chip. For example, if the
embedded security chip is present, Credential Manager for HP
ProtectTools uses it to further secure the encryption keys that encrypt
sensi ti ve user cred enti a ls such a s w eb si te p assw o rd s o r netw o rk l og on
credentials.
Designed to the Trusted
Computing Group (TCG)
standard
As a standards-based technology, embedded security chips are
designed to work with a growing number of third party software
solutions while providing a platform to support future hardware and
operating system architectures.
Supports Microsoft CAPI and
PKCS#11 cryptographic
software interfaces
Enables the embedded security chip to enhance a broad range of
existing applications and solutions that take advantage of these
interfaces (for example, Microsoft Outlook®, Netscape Navigator, RSA
SecurID and public key infrastructure solutions from leaders like
Microsoft, Verisign and Entrust)
Enhanced Microsoft EFS Helps protect sensitive user data stored locally on a PC, where access
to Microsoft EFS encrypted files are protected by the embedded
security chip, providing a higher degree of hardware-based protection
Enhanced Personal Secure Drive
( PSD )
Personal Secure Drive (PSD) is an encrypted mountable volume. In
Embedded Security for HP ProtectTools version 4.0 and later, PSD has
been enhanced with a significantly larger size limit. The PSD can now
occupy the entire hard d ri ve (mi nus 5 G B f or system f i les). PSD si z e
therefore is now only limited by the hard drive size. PSD can now also
be created on removable storage devices such as USB hard drives, and
USB fla sh dr i ves.
Support for TPM v.1.2 Embedded Security for HP Pr
otectTools versions 4.0 or later support the
la test TPM v1 . 2 a s w el l a s the p revi ous TPM v1 . 1 .
Pa ssw or d Reset A ll ow s a dmi ni stra to rs to reset a lo st user p a ssw ord
Automatic Backup Allows automatic backups of TPM Embedded Security Credentials,
Settings and Personal Secure Drive (PSD). Backups can be created on
local drives as well as network drives. This ensures that TPM protected
user data can be recovered in case of a service event.
For more information on trusted computing solutions from HP, including more information on the
embedded security chip solution for HP business desktop, notebook and workstation PCs, visit
www.hp.com/ go/ security.
Face Recognition for HP ProtectTools
Face Recognition for HP ProtectTools provides a new level of convenience for a high level of
protection. This feature is easy to set up and use, provides multifactor authentication into W indows,
and is integrated with Single Sign-on capability. Face Recognition is an innovative technology tha t
allows you to log in to your laptop and all your favorite websites using a single sign-on. You ca n
login simply by looking at the webcam on the PC , so there is no need to recall dozens of user names

16
and passwords. A t most si te s tha t r e qui re a pa ssword, a window pops up over your browser and
gives you the option to log in using Face Recognition.
HP recommends that a minimum of two factors be used to create a more secure environment. HP
ProtectTools has additional authentication options, such as fingerprint a uthentica tion, which ca n be
combined with Face Recognition to provide exceptional s ec ur i ty.
Face Recognition for HP ProtectTools was developed in conjunction w i th C ogent, a leading
biometric solutions provider.
Fi le S a ni ti z e r fo r H P Pr ote c tToo ls
Files dropped into the recycle bin can easily be recovered. The recovery process is as simple as
opening the recycle bin, and restoring the files. Even once the recycle bin is emptied, the files remain
on the ha rd drive a nd ca n be recovered using disk utilities available online.
W hen you delete a file, it is removed from the hard drive directory. The process is quick and requires
the same amount of time regardless of the size of the file. Removing the link to the file from the
directory makes the space occupied by the file available to new files. The deleted file however,
continues to reside on the hard drive and can be recovered until it is overwritten by another file.
N ormal file deletion process, while fast and convenient, also poses a security threat beca use deleted
information could be recovered by an unauthorized person.
File sanitization, also referred to as shredding, is a process where the data designated to be erased is
overwritten multiple times with meaningless bits in order to ensure that it cannot be recovered. File
sanitization is an intensive process and makes the erased data unrecoverable.
Bleaching is a process where previously used space on a hard drive is overwritten to ensure no
deleted data can be recovered.
File Sanitizer for HP ProtectTools starts by placing an icon on the desktop. You can then shred files by
simply dragging and dropping onto the File Sanitizer icon. You can also define files and folders that
you want shredded automatically, and define the schedules. This level of control is available in File
S a ni ti z e r s etti ng s (Figure 9), where security levels can be selected as well custom control over types of
information to erase (i.e. cookies, temporary files, etc.). File Sanitizer can then be set up to erase the
predefined files ba sed on events such a s W indows shutdown.

17
Fi g u r e 9. HP ProtectTools File Sanitizer setup menu
File sanitization is more intensive process than simple file deletion. The amount of time it takes to
delete a file or a group of files is in direct relation to their size. File Sanitizer is therefore not a
replacement for simple file deletion; it is instead meant to complement it. Free Space Bleaching can
also be set up to bleach the hard drive at a predetermined schedule.
Computrace® Lo Ja c k Pro for HP ProtectTools
Computrace LoJack Pro, powered by Absolute Software (purchased separately), addresses the
growing problem of computers that are lost or stolen. Activating this software enables the Computrace
agent, which remains active in your computer even if the hard drive is reformatted or replaced. Lo Ja c k
Pro permits remote monitoring, management, and tracking of your computer. Absolute’s recovery
team will assist in your computer’s recovery if it is lost or stolen, depending on geographic location.
Privacy Manager for HP ProtectTools
W hen it comes to information security, concerns typically revolve around lost or stolen notebooks, or
unauthorized access to the network. However, information can easy fall into the wrong hands through
normal everyday communications tools such as instant messaging and email.
Privacy Manager for HP ProtectTools allows you to secure the documents and emails you create within
Microsoft Office applications and enables strong privacy of your IM chats when communicating via
Microsoft Live Messenger. W ith Privacy Manager you can be sure that only those friends, clients or
colleagues you select will be able to open and read a given document, email or instant messa g e.
Additionally, your recipients can be certain that such files were created by you, and never modified
by anyone else, since Privacy Manager leverages the strong, multifactor user authentication provided
by HP ProtectTools. The result is that you can now take control of the information you create and
communi cate to ensure its privacy, security, and integrity, not just on your local computer, but
wherever it may ultimately be transmitted or stored. Identity assurance and access control of

18
electronic transactions and communications is increasingly required by regula tions in fina nce, la w
and healthcare applications.
Privacy Manager is an HP ProtectTools plug-in, and can be accessed directly from within Microsoft
O ffice 2007 and Microsoft Live Messenger. On first use, a wizard will guide you through the process
of obtaining a digital certificate. HP has partnered with Comodo, a leading issuer of digital
certificates, to provide HP Privacy Manager users w i th a c e r ti fi c a te , va lid for twelve months, a t no
cost. The certificate will be issued and sent to the email address you provide, certifying you have
access to that email account. After this period ends, a subscription is required to renew the certificate.
For additional information, please visit https:/ / secure.comodo.com/ buydpcert/ .
N ext, you will be prompted to invite your friends, colleagues or clients to be a truste d co nta c t. O nc e
the invitation is sent, they will get an email from you which will direct them to download the Privacy
Manager software for free from DigitalPersona, an HP ProtectTools partner. They will then also be
able to obtain a certificate at no charge. You are now set up to securely c ommunic a te w i th e a c h
other:
•You ca n digitally sign emails and documents using passwords, fingerprints or smartcards. The
digital signature is proof tha t the content was created by you and has not been modified since
being signed.
•You can encrypt Microsoft O ffice documents, worksheets and email messages ensuring they ca n
only be viewed by your truste d co nta c ts.
•You can incorporate signature lines into your Microsoft O ffice documents and worksheets to
indicate your request for a digital signature by your recipients. This provides a simple method for
authorization workflow.
•You ca n verify the identity of a person before starting a conversation using W indow s Li v e
Messenger, s o y o u c a n b e c e rta i n tha t the p e rs on y o u i nte nd to c ha t w i th i s the o ne s i tti ng a t the
other end.
•You can maintain privacy in your Live Messenger conversa tions. You can be certain that the only
person reading your messages is who you intend.
Privacy Manager at Work
Privacy Manager is designed to integrate seamlessly into Microsoft Office applications. Content
created in Microsoft Office can be digitally signed and encrypted, in order to ensure that only trusted
contacts can view the content, and to ensure that the document was not modified after being signed.
Privacy Manager has clear benefits for businesses of all sizes. In addition to basic certificates which
certify just an email address, Comodo can issue certificates which certify the real name and identity of
the user. W hen businesses purchase this service, Comodo will formally validate that the administrator
making the request has the authority to issue user certificates on behalf of the domain. This
administrator will be given access to a management console used to request certificates for any
employees. These certificates will now certify the user’s actual identity, such as their name, title and
email, so that their use can serve as a strong part of audit and compliance requirements.
Enterprises may also consider the deployment of a server to centrally manage policies and enable
users to easily use their certificates from any computer on the network. DigitalPersona, an HP
ProtectTools partner, offers a client/ server solution, DigitalPersona Pro, to better manage
authentication credentials and Privacy Manager on Active Directory-based networks.
Privacy Manager – Ch a t
Think about when using instant messaging to communicate. All messages are transferred in the clear
and go through remote servers. Files transferred using instant messaging also transfer in the clear
and go through remote servers. For this reason, many businesses disable instant messaging in their

19
environments. W hile that takes care of the security exposure, it also prevents the benefits of a very
useful communications tool.
Privacy Manager for HP ProtectTools adds extensions to MSN Live Messenger to allow for secure
communica tions. W ith Priva cy M a na ger – C ha t, a user ca n continue using M SN Live M essenger, but
with additional security. Privacy Manager – C hat uses the integrated fingerprint sensor to establish a
person’s identity. Even on systems without a fingerprint sensor, smartcards or passwords can be used
to confirm identities. In an open office environment where you don’t know if the person you are
communicating with is who you think it is, Privacy Manager – C ha t a ll ow s y ou to re q ue st i d e nti ty
confirma tion.
Privacy Manager – Chat also adds a secure communications mode where all messaging and files
are encrypted before they are transferred. O nly the authorized r eci p i ent o f these messa g es ha s
the ability to decrypt and view them. If these messages are intercepted, they will be unreadable
by the unauthorized person.
Smart Card Security for HP ProtectTools
Smart Card Security for HP ProtectTools allows the HP ProtectTools Java Card to be utilized for
user authentication in the pre-boot as well as the Microsoft W indows environment. Sma r t Card
Security ena b l es a c cess to Ja v a Card configuration and security features on systems equipped with
a smart card reader. Sma r t card readers can either be integrated into the system, or can be added
usi ng the PC c a rd sl ot on notebooks or a USB port on any computing device equipped with one.
For authentication, users are required to use the HP ProtectTools Java Card which can hold their
passwords and PIN, and a supported reader, such as an integrated smart card reader, the H P PC
Card Smart Card Reader, or the HP Smart Card Keyboard.
Sma r t Card Security for H P ProtectTools provides card management features such as:
•Separate administrator and user roles
•A b i li ty to i nitia liz e a nd configure a n H P ProtectTools Java C ard, which enables the HP ProtectTools
Java C ard to be used for user authentication
•Inte r fa c e w i th the BIO S to enable/ disa ble Ja va C ard pre-b o ot a uthe nti c a ti o n
•C apability to configure separate Java C ards for administrators and users
•Set a nd cha nge the Ja va C a rd PIN
•Backup and restore credentials stored on the Java C ard
Ta ble 5 shows Smart C ard Security for HP ProtectTools features and benefits.
Table 5. Sma rt Card Security for HP ProtectTools features and benefits
Fe a t u r e Benefit
Compatible with many 3rd party
applications
Uses the standard ActivIdentity profile with extensions for HP
ProtectTools. This makes the HP ProtectTools Java Card compatible with
many 3rd party enterprise security applications in addition to providing
pre-boot and Microsoft W indows authentication on HP notebooks and
desktops. Standard ActivIdentity profile also makes the HP ProtectTools
Java Card manageable using ActivIdentity’s suite of enterprise
sol uti ons.
Initialize and configure Smart
Ca r d securi ty fea tures such a s
pre-boot Java Card
authentication
Provides a complete Java Card security solution for pre-boot, Drive
Encryption, and W indows user authentication providing enhanced
protection against unauthorized of the PC

20
Fe a t u r e Benefit
Backup and restore credentials
stored on a user’s Java Card
Provides a mechanism to recover from a situation where a user or
administrator loses the Java Card
Platform Support
HP ProtectTools Security Manager is supported across a range of HP business notebooks, desktops
and workstations. Table 6 provides details of support for HP business notebooks and desktops.
Table 6. HP ProtectTools solution set support for business notebooks, desktops and workstations
Standard Series
(s)
Business Series
(b)
Professional and
W ork sta tion
Series (p, w)
Hardware Features
•TPM Embedded Security C hip 
• HP fingerprint sensor 
• Integrated Smart C ard reader (optional) 
•HP Priva cy Fi l ter S upp ort ( op ti ona l) 
HP ProtectTools
H P Pr ote c tTo ols S e c ur i ty 
H P Pr ote c tTo ols S e c ur i ty S e tup W i z a r d 
•C redential Manager for HP
ProtectTools 
• Drive Encryption for HP ProtectTools 
•Ja va C ard Security for HP
ProtectTools 
Privacy Manager (Chat and Sign) 
File Sanitizer for HP ProtectTools 
Embedded Security for HP ProtectTools 
Device Access Manager for HP ProtectTools 
Enha nced Pre-B o ot A uthe nti c a ti o n 
M ultiuser 
Multifactor (password, fingerprint, smart card) 
HP SpareKey 
O ne-S te p Lo g i n 
HP Disk Sanitizer 
C omputra ce Support 
Enha nced DriveLock 
Business Desktops
dc7600 dc5700 dc5750 dc7700
Hardware Support
TPM Embedded
Security Chip v.1.1 N N N N
TPM Embedded
Security Chip v.1.2 SF SF SF SF