All of our HP PCs come with this software pre-installed, I'm a bit inclined to outright remove it because:
- Credential manager stores passwords by default (this has lead to user confusion, plus storing passwords drives me crazy from a security standpoint, especially when I don't know how these passwords are secured at the application later [automatically can use them when the user gets logged in, resetting their password doesn't seem to invalidate saved passwords, that worries me]).
- All files should be stored on the server, hard drive encryption is useless to me. Furthermore it works with your Windows log in (they don't really go into how this works beyond that), which again, makes me nervous that it's fairly easy to circumvent if you know what you're doing. The idea is we can start storing more on laptops because we can encrypt the drive, I would rather we not from both a security and network structure standpoint.
- BIOS ("pre boot security"), is just that, resetting the BIOS boot password, not really a huge deal, can be circumvented if the laptop is stolen, and doesn't require HP ProtectSmart to set it.
- Sparekeys are just security holes.
These are all set by the end user on log in, and can be changed by them at a later date (so I can't make a policy to lock it down to hard drive encryption only, they can always override and create sparekeys and other terrible things), in addition it asks for the user to put in their password again upon primary configuration, so I'm pretty sure it's storing their credentials somewhere too (ugh).
To me, it seems like consumer software or software sold to business customers that don't know any better, my boss insists it's enterprise level software and wants to implement it, but I can't imagine a security conscious business running with this (BTW: we have to abide by PCI compliance). They give me a very rudimentary administrator panel, which I guess I can individually set these up by hand, but that is a lot of machines and any changes (say, key rotation? If I can even do this!) involves basically stupid amounts of work without the lack of a central management server.
Can anyone confirm/deny my suspicions about this?