BeachheadSecure v6.11.1 is now available.
The headline is ScreenLock, a new quarantine response that works regardless of the encryption method on the device and restores access without a 48-character BitLocker recovery key. This release also expands MFA policy control, consolidates BitLocker management into a single action, and adds scheduled compliance reporting.
Below is the complete list of changes:
- ScreenLock response: New RiskResponders quarantine action for PCs and Macs.
- Administrator MFA reset: Reset MFA for another administrator.
- BitLocker management update: "Suspend BitLocker" is now "Manage BitLocker."
- BitLocker tab changes: Recovery Keys and Secure Decommission Keys split into separate tables.
- ComplianceEZ enhancements: BHS Addressable indicator, Last Modified column, and scheduled reports.
- EFS path updates: CAD and additional file types added to EFS targeting.
- Install alerts: Server-generated alerts when an install fails.
- MFA policy application: Scope MFA policy to all, domain, or local users.
- MFA setup code: Require a code before a user can enroll in MFA.
- OS version reporting: Outdated OS builds flagged in the Computer Listing.
- Report updates: Location added to reports; EFS check improved.
- Simplified UI: Attach and Detach replaced by Manage Account.
Feature Breakdown
Let's dig in to each of the core feature updates/releases.
ScreenLock Response
A new ScreenLock response is available in RiskResponders for PCs and Macs. It can be triggered manually as a quarantine action or automatically through a RiskResponders policy.
ScreenLock immediately prevents an unauthorized user from accessing the computer, even one with valid login credentials, and can be used regardless of the encryption method in place. It is a particularly simple alternative for computers using BitLocker-only encryption, because access can be restored without requiring the user to enter a 48-character BitLocker recovery key.
To restore access, select the computer from the Computer Listing and click Restore from Quarantine. ScreenLock is removed the next time the computer checks in. Alternatively, select the computer and choose More Actions > Recovery Code, then give the user the code to enter directly into the ScreenLock dialog.
Action required: The ScreenLock action is added in a disabled state to RiskResponders wherever a "Revoke access to EFS encrypted files" action already exists. An administrator needs to turn the action on for it to take effect.
A note on choosing a quarantine response: Quarantining a device is an effective way to protect data from exposure, but the response needs to match the encryption method in use. Revoke Access to EFS Encrypted Files, for example, will not provide effective protection on devices that are not using EFS encryption. Contact Beachhead Support with questions about selecting the right quarantine response for your environment.
Administrator MFA Reset
Administrators can now reset MFA for another administrator. Resetting MFA turns it off for the next login.
- If MFA is mandatory, the administrator will be required to set up MFA again after logging in.
- If MFA is optional or off, the administrator must manually turn MFA back on by clicking their name in the header or selecting their account from the administrator listing.
To reset MFA, go to the administrator listing page, select the checkbox next to the administrator whose MFA should be reset, and select Reset MFA.
BitLocker Management Update
The "Suspend BitLocker" menu item has been replaced with Manage BitLocker. After selecting a computer, click Manage BitLocker to open a pop-up with three actions:
- Decrypt and Encrypt BitLocker: Change BitLocker encryption settings and apply them to one or more computers. These options match the settings available on the BitLocker tab for a computer.
- Suspend BitLocker: Select "Temporarily suspend BitLocker protection," choose the time frame for re-enabling protection, and click OK. To resume protection, clear the checkbox and click OK. These settings are also available on the BitLocker tab.
- Decrypt BitLocker: Begins the process of decrypting a BitLocker-protected drive.
BitLocker Tab and BitLocker Recovery Changes
The BitLocker tab UI has been modified to make management simpler.
Recovery keys and Secure Decommission keys have been moved into separate tables. In the Volumes table, the primary key protector for the OS drive now shows only the protector type in the Type column.
The BitLocker Recovery listing has also been modified so that it lists only Recovery Keys and Secure Decommission Keys.
ComplianceEZ: BHS Addressable Indicator and Last Modified
An indicator has been added to the ComplianceEZ page showing whether a BHS-provided implementation satisfies or partially satisfies a control.
- Filled dot: A BHS-provided implementation satisfies the control.
- Hollow dot: No BHS-provided implementation is available for that control.
A Last Modified column has also been added to track when changes were made to each control.
ComplianceEZ Report Scheduling
Report scheduling has been added for ComplianceEZ. Go to the ComplianceEZ page, click Output Report, and select Schedule Report. A report creation pop-up opens where you can set the schedule, recipient emails, and report options. Click OK to schedule the report.
EFS Path Updates
New data locations have been added for EFS targeting, along with additional file types.
- CAD file types: .dwg, .iges, .igs, .sldasm, .sldprt, .step, .stp
- Other file types: .eml, .webp, .wmv
Install Alerts
The server now generates alerts when an install fails during the install web call. For example, an alert is generated if there are not enough licenses or if a computer with the same name already exists.
MFA Policy Application
The MFA policy can now be applied to all users, domain users, or local users. Apply the policy from the Authentication Policies section on the RiskResponders page. By default, the MFA policy applies to all users.
MFA Setup Code
Administrators can require a setup code before allowing users to set up MFA.
To configure one, go to the RiskResponders page and expand the Authentication Policies section. In the Multifactor Authentication (MFA) settings, change Multifactor Authentication to Mandatory, select Yes for MFA Setup Code, and enter a code.
Administrators are responsible for communicating the setup code to users, since it is required to set up MFA. If MFA is not set up, the computer cannot be used.
Note: This feature is currently PC-only. It will be added to the Mac agent in a future release.
OS Version Reporting
The server now retrieves the latest Mac and PC OS versions and indicates whether each computer is up to date. OS version numbers appear in the OS Build column on the computer listing page. If a computer is not running the latest OS version, the OS Build text is highlighted; clicking the highlighted text opens an information pop-up with update details.
Report Updates
Reports have been updated to include Location. The EFS Encryption Status check in the Compliancy report has also been updated to verify that EFS is actually being used on the computer.
Simplified UI: Attach and Detach Changes
Attaching to and detaching from accounts has changed. Instead of attaching to an account, an administrator now manages an account.
- On the account listing and in the header, administrators see Manage Account. Clicking it allows the administrator to work on the account.
- The confirmation message that appears by default when managing an account can be turned off.
- Administrators are placed in Default view, equivalent to the previous Customer view. Clicking Advanced in the header switches to Advanced view, equivalent to the previous MSP View or Support View. In Advanced view, the link changes to "Default" to switch back.
- To manage a different account, click Manage Account. To return to your own account, click Return to Admin Account in the header, which is equivalent to the previous Detach.
Questions
Contact Beachhead Support for help choosing the right quarantine response for your encryption method, or for guidance on rolling out MFA setup codes across your environment.
Learn more at: https://www.beachheadsolutions.com/device-security-encryption
