SecureDoc V8.5 SR2 New Features & Improvements

SecureDoc V8.5 SR2 New Features & Improvements

 

SD-31432: SES now supports SUSE Linux 15 and 15.1.

With this version, SUSE Linux has been added as a supported Linux distribution for encryption and management by SecureDoc. Versions of SUSE Linux supported are 15 and 15.1.

 

SD-34145: Windows Client Security Vulnerability Report.

Ongoing security improvements were made to the SecureDoc client, with the following two CVE's specifically referenced among the improvements: CVE-2020-11519, CVE-2020-11520

 

SD-34186: SecureDoc for Linux is now able to operate in FIPS mode.

With this version, where customers wish to enable FIPS mode using FIPS-mode-setup --enable, SecureDoc now handles FIPS mode and will successfully allow the encrypted system to boot correctly.

 

SD-34264: Support of Yubico Yubikey USB Tokens in PBA.

SecureDoc has added Pre-Boot Authentication support for endpoint users to utilize Yubico AB's Yubikey(TM) 5-series tokens.

Specific tokens supported are:
Yubikey 5 NFC
Yubikey 5 Nano
Yubikey 5c
Yubikey 5c Nano
These are all supported under SecureDoc's 64-bit Linux-based Pre-Boot for UEFI devices (PBLU).
 
NOTE: At present, only the Yubikey 5 NFC and Yubikey 5 Nano device types work under 32-bit PBLU or with SecureDoc's Native Pre-Boot for UEFI (PBU)

 

SD-34495: Issues could arise when installing both the SecureDoc Client and InfoCage (InfoCage is a Windows authentication and Removable media control application).

Issue: After installing InfoCage and SecureDoc8.5, InfoCage authentication would fail.

Solution: It was determined that a Windows setting shared by both applications was being pre-set in such a way that SecureDoc's installation would negatively impact InfoCage.

This has been corrected in this version, and both applications will co-exist successfully.

 

SD-34387: SecureDoc's Self-Learning and KnownConfigs.XML functionality are extended to store in the SES Database information about devices not represented in the KnownConfigs.XML file.

Issue: KnownConfigs.XML contains tested and validated information about endpoint device makes/models that have been investigated at WinMagic. However, due to the sheer number of make/model combinations available in the marketplace, it is unfeasible for WinMagic to evaluate all possible permutations.

Solution: As an element in improving how SecureDoc can be installed on as many make/model endpoint types as possible, where a device make/model is not found in the KnownConfigs.XML file, AND where the device does not prove its compatibility "out of the box", the SecureDoc installer will go into a "self-learning" mode where it will determine as much as possible what are the specific needs of this make/model, and report its findings to be stored in the SES database, in order to inform future installations as to how they are to be installed and what special handling may be required, thereby accelerating and improving installation success levels.

 

Resolved Issues

 

SD-30908, SD-33027, SD-33320: Users could receive an SESWeb Error 500 - WM0002 Unauthorized access when changing a Device Profile.

An issue was found with the Microsoft WIF Framework would return a null security token, thus causing the 500 error, because the user is no longer able to communicate as their token is no longer valid. This seems to be a defect in the WIF framework.

Solution: SES Web has been improved to work around the WIF framework defect and this issue has been resolved

 

SD-34194: Reduce red warning messages about USB encryption.

Where endpoint device profiles define that customer is blocked from writing to unencrypted USB devices (but may read), a red warning panel would appear during each attempt to access the USB device for both reading and attempts to write.

Solution: Once the user has defined that he will not be encrypting the drive; subsequent attempts to only read from the drive will not result in the appearance of the red warning panel.

 

SD-31817: Certain devices installing SecureDoc OSA on Ubuntu 18.04.02 could fail to boot to Linux; Message: "System BootOrder not found. Initializing defaults." would be displayed.

Issue: Although not necessarily limited to version OSA 8.3.000.370, one or more customers received an error (listed below) after installing SecureDoc OSA on Ubuntu Linux 18.04.02 devices, and the device would not boot into Ubuntu Linux.

Devices would boot with no issues until SecureDoc was installed.
After installing SecureDoc, the device would boot through the SecureDoc Pre-Boot and then fail to boot into Ubuntu after the reboot, with the following message displayed:
'System BootOrder not found. Initializing defaults."

Solution: This issue has been corrected in this version.

 

SD-33467: Installer improved to handle installation issue on certain device types; Log would show Error 1722 - Visual C++ Redistributable for Visual Studio 2017 (VCRedist) is not installed.

On certain devices customers might encounter SecureDoc setup failing to complete successfully. Inspection of the installation log on such devices would show Error 1722 - Visual C++ Redistributable for Visual Studio 2017 (VCRedist) is not installed. Under previous build V8.5.0.480 running setup a second time would normally fix this issue, but this solution was deemed unsatisfactory.

This issue is fixed in this version - setup works properly on devices that would have failed under V8.5.0.480, without need of a second installation attempt.

 

SD-33884: Certain HP devices fail to load Pre-Boot during the installation process, yielding Error 0x776e.

Issue: If a device fails to load Pre-Boot during the installation process, Error ID 0x776e is displayed. This is by design, in that if Pre-Boot fails to run, SecureDoc is blocking itself from continuing to encrypt the device.

Where this problem is compounded is when, after being able to correct Pre-Boot issue so that it successfully loaded on subsequent reboots, now the encryption would fail to start automatically, this time producing Error 0x66 "Unidentified error has occurred".

Solution: This has been corrected, and if the device is able to get to Pre-Boot during a subsequent re-boot, encryption will progress as normal.

 

SD-34210: When installing only SDConnex (and/or ADSync) services on a second-or-subsequent SES server, Error 2753 will appear.

Issue: Customers utilizing multiple SDConnex servers may wish to install SDConnex on additional Servers, or they may wish to have ADSync running in a server that is not their primary SES Console platform.
When doing this, they may wish to opt not to install the SES Console program elements (which in previous versions would be installed but simply not be used). However, de-selecting the SES Server element during installation could yield an Error 2573.

Solution: This version corrects this, permitting the installation of SDConnex and/or ADSync without having to select to install the SES Console as well.