Encrypting Mac FileVault Using Personal and Institutional Recovery Keys with ManageEngine Mobile Device Manager Plus

26-12-2024
0
215
Author : Haresh Hirani

FileVault is a built-in encryption feature on macOS that secures the data on a Mac by encrypting the entire disk. Using ManageEngine Mobile Device Manager Plus (MDM), organizations can manage FileVault encryption effectively, utilizing both Personal Recovery Keys (PRK) and Institutional Recovery Keys (IRK). This blog post outlines the detailed steps to set up and manage FileVault encryption using both recovery keys, including how to create and upload the certificate for IRK.

Understanding Recovery Keys

Personal Recovery Key (PRK): This key is unique to each user and allows them to unlock their encrypted disk if they forget their password.
Institutional Recovery Key (IRK): This key is used by organizations to help recover data from encrypted disks without needing individual user passwords. It is particularly useful in enterprise environments where IT administrators need access to encrypted devices.

Steps to Enable FileVault Encryption with MDM

Prerequisites:

Before you begin, ensure that:

You have administrative access to the ManageEngine Mobile Device Manager Plus.
The devices are enrolled in MDM.
You have the necessary permissions to manage FileVault settings.

Step 1: Creating and Uploading the Certificate for IRK

Create the IRK Certificate:
- On an administrator computer, open Terminal and execute the following command:
Bashsudo security create-filevaultmaster-keychain /Library/Keychains/FileVaultMaster.keychain

- Enter your login password when prompted.
- Create a password for the new keychain when prompted. This password will be used to access the keychain certificate created in the next steps.
Unlock the Keychain:
- To unlock the keychain for copying or editing, enter the following command in Terminal:
Bash
security unlock-keychain /Library/Keychains/FileVaultMaster.keychain
Export the Certificate:
- After unlocking, export the keychain as a .p12 file by using the following command in Terminal:
Bash sudo security export -k /Library/Keychains/FileVaultMaster.keychain -f pkcs12 -o /path/to/your/certificate.p12
- Replace /path/to/your/certificate.p12 with your desired file path.

Step 2: Configuring FileVault Settings in MDM

Upload the Certificate to MDM:
- Log in to your ManageEngine MDM console.
- Navigate to Mobile Device Mgmt -> Management -> Profiles.
- Select macOS from the drop-down that appears when clicking Create Profile.
- Click on FileVault Encryption.
- Select Institutional Recovery Key as the encryption method.
- Browse and upload the .p12 file certificate created earlier. Save and publish the profile.
Configure Recovery Key Settings:
- Choose whether you want to use a Personal Recovery Key, an Institutional Recovery Key, or both.
- For IRK, ensure that you have uploaded the recovery key certificate as described above.
- For PRK, select whether the recovery key is displayed to users or not.

Step 3: Deploying the Profile

Assign the Profile:

After configuring the settings, assign the profile to relevant Mac devices or user groups.
Deploy and Monitor:

Deploy the profile and monitor its status through the MDM dashboard. Ensure that all assigned devices successfully receive and apply the new settings.

Encrypting Using Both Personal and Institutional Recovery Keys

This is helpful when the data is to be decrypted, the user can choose which method to use to decrypt their data. To utilize both PRK and IRK effectively:

Set Up IRK for Institutional Control:
- Ensure that your organization has a secure process for storing and managing IRKs.
- Provide training for IT staff on how and when to use IRKs for recovery purposes.
User Education on PRK:
- Inform users about generating their PRKs during the encryption process.
- Encourage them to securely store their PRKs in a location separate from their devices.
Testing Recovery Procedures:
- Conduct tests using both recovery keys to ensure that your organization can recover data as needed without compromising security.

Conclusion

Implementing FileVault encryption using both Personal and Institutional Recovery Keys through ManageEngine Mobile Device Manager Plus enhances data security for Mac devices in an organizational setting. By following these steps, IT administrators can ensure that they maintain control over encrypted devices while empowering users with personal recovery options. Regular audits and training will further strengthen your organization's data protection strategy.

For more detailed information on managing FileVault encryption with ManageEngine, visit their official documentation on FileVault Encryption.