4

All of our HP PCs come with this software pre-installed, I'm a bit inclined to outright remove it because:

  • Credential manager stores passwords by default (this has lead to user confusion, plus storing passwords drives me crazy from a security standpoint, especially when I don't know how these passwords are secured at the application later [automatically can use them when the user gets logged in, resetting their password doesn't seem to invalidate saved passwords, that worries me]).
  • All files should be stored on the server, hard drive encryption is useless to me. Furthermore it works with your Windows log in (they don't really go into how this works beyond that), which again, makes me nervous that it's fairly easy to circumvent if you know what you're doing. The idea is we can start storing more on laptops because we can encrypt the drive, I would rather we not from both a security and network structure standpoint.
  • BIOS ("pre boot security"), is just that, resetting the BIOS boot password, not really a huge deal, can be circumvented if the laptop is stolen, and doesn't require HP ProtectSmart to set it.
  • Sparekeys are just security holes.

These are all set by the end user on log in, and can be changed by them at a later date (so I can't make a policy to lock it down to hard drive encryption only, they can always override and create sparekeys and other terrible things), in addition it asks for the user to put in their password again upon primary configuration, so I'm pretty sure it's storing their credentials somewhere too (ugh).

To me, it seems like consumer software or software sold to business customers that don't know any better, my boss insists it's enterprise level software and wants to implement it, but I can't imagine a security conscious business running with this (BTW: we have to abide by PCI compliance). They give me a very rudimentary administrator panel, which I guess I can individually set these up by hand, but that is a lot of machines and any changes (say, key rotation? If I can even do this!) involves basically stupid amounts of work without the lack of a central management server.

Can anyone confirm/deny my suspicions about this?

Improve this question
1
  • I agree that the HP software is a false sense of security. I have some hospitals that I work with that use McAfee's endpoint encryption check out mcafee.com/us/products/data-protection/endpoint-encryption.aspx which might work for you. Let me ask you this, What is the infrastructure made up of and how does data need to flow? You mention PCI compliance, is this a retail application or say someething like a hotel?
    – Brad
    Apr 2, 2012 at 21:40

1 Answer 1

Reset to default
1

HP software is klutzy to say the least. Enterprise-level is just a catchphrase they used to sell it to your boss. They will try to upgrade you to their management console products if you contact them about managing your end users in any way. That might not be a bad thing if your boss is not too cheap to shell out more dough. You might want to apply strategic pressure and make yourself an administrative way out logically by attempting to obtain other HP management software (it is 2am the intel remote management chip on the motherboard name escapes me). You just have to cover your ass on this since for example the HP blade server as bad ass as it is even has security issues. Yes I am reasonably sure if HP ties into your windows authentication it is a crappy implementationbecause even SMS has tricks to screwing up a profile come to think of it so make sure you document via email every single issue you are remotely concerned about. The mcaffee software mentioned above is not going to solve your problem unless you get rid of a lot of the HP specific utilities shoved up in that OS as it stands today. If you are in a small to midsized company you are going to spend a lot just in reconfiguration time alone. ALL security vendors out there will say they are going to bring you into compliance, the reality is you do not need them unless you are in a time crunch because MS has spent a lot of time on this plus there are too many consulting companies dying on the vine right now. Let your company pay you to do what they are going to outsource instead -- show them two machines clean and with your configuration only and see whether they willmgo with it or not. Took two years of losing data and proprietary info to salesman and field engineer stupidity and a lawsuit over something we could not prove we never had in the first place before we took action. Long story if I can elaborate further to back you up on something let me know going to konk out now... Hope that helps, iceberg

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .