Release Note for CTE v7.8.0 for Windows

This release of CipherTrust Transparent Encryption for Windows adds new features, fixes known defects and addresses known vulnerabilities.

New Features and Enhancements

RWP Protection report on CipherTrust Manager when RWP detects suspicious behavior

A new report was added for Ransomware Protection.

• See Understanding Ransomware Protection Reports for more information.

Integrating Imperva FAM with CTE

File Activity Monitoring (FAM) catalogs, monitors, and secures unstructured data (files). Unstructured data refers to any data that is not stored in databases. You can find these files locally, on the network, or in the cloud. FAM provides insights into data location, ownership, access history, permissions, protection, sharing, and sensitivity, enabling informed decisions about data protection.

Documentation Improvement: SQL File Stream doc improved for clarity

SQL File Stream documentation was improved for clarity.

• See Using LDT with SQL FILESTREAM for more information.

Resolved Issues

• AGT-61679 [CS1581483]: The Apache service does not start when launched within a GuardPoint

  AFFECTED VERSIONS: 7.6.0.87 — 7.8.0.24

  This issue was interoperability between CTE and Windows Defender related to the Apache2.4 directory. This has been fixed.

• AGT-61846: Windows AccessOnly node: LDT over CIFS GuardPoints are inactive after upgraded to v7.7.0.79, or 7.8.0.65, key rotated, and agent rebooted

  AFFECTED VERSIONS: 7.7.0.87 — 7.8.0.24

  The issue occurred because the CipherTrust Manager was not using the supported version. Make sure that your CipherTrust Manager is v2.20.

• AGT-63199: Failed to guard FileTable VNN path in SQL AlwaysOn setup with LDT

  AFFECTED VERSIONS: 7.7.0.87 — 7.8.0.24

  LDT for SQL Server AlwaysOn with FileTables is currently not supported. LDT for SQL Server Always-on (without FileTables) is supported.

• AGT-63043 [CS1596700]: Binaries launched from UNC are not matching the process set

  AFFECTED VERSIONS: 7.7.0.87 — 7.8.0.24

  UNC paths added to a process set were not matching the actual path of the process. Therefore, a process in the process set could be erroneously denied access to a resource specified in the policy. This has been fixed.

Known Issues

• AGT-36370: The vorvmd.log reports an error message, Not guarding path when guarding LDT over CIFS GuardPoint

  AFFECTED VERSIONS: N/A

  This error message displays when the CTE agent is in the process of authenticating the user. This error can be safely ignored.

• AGT-39189 | AGT-55063: CTE failed to unguard after changing to incorrect CIFS credentials

  AFFECTED VERSIONS: All

  If a user has a CIFS guarded path, and tries to access it with invalid credentials, the unguard request fails. After this, if the user switches to valid credentials, the unguard request still fails because CTE agent is unable to access the CIFS share to update the credentials.

  Work-around

  To successfully guard/unguard a CIFS path, use valid credentials.

• AGT-39190: File modified time does not change after rekey for excluded files

  AFFECTED VERSIONS: 7.7.0 — 7.8.0.xx

  This is a limitation with the current CTE agent. This is due to the Windows Redirected Drive Buffering Subsystem (rdbss) limitation.

• AGT-48196: Microsoft DPM recovery creation failed when creating an incremental backup recovery point

  AFFECTED VERSIONS: 7.5.0 — 7.8.0.xx

  Work-around

  Perform a complete backup. Do not perform an incremental backup.

• AGT-48580: The gzip files in a directory can be mistakenly identified as ransomware by Ransomware Protection

  AFFECTED VERSIONS: 7.5.0 — 7.8.0.xx

  Some compression algorithms haves high entropy value and intermittently, zip or unzip activity that occurs on files that already themselves have high entropy, within a Ransomware Protection GuardPoint, is mistakenly identified as ransomware.

  Work-around

  Add the zip/gzip/winzip programs to the Ransomware Protection process exemption list in the CipherTrust Manager.

• AGT-48862: Unguard process fails if CTE secfsd service is down

  AFFECTED VERSIONS: 7.5.0 — 7.8.0.xx

  The secfsd service is a critical CTE service. If this service is down, certain CTE features may not work as intended.

  Work-around

  Manually restart the secfsd service in the service manager.

• AGT-58577: Issues and limitations for Multifactor Authentication and Ransomware Protection co-existence

  AFFECTED VERSIONS: 7.7.0 — 7.8.0.xx

  Multifactor Authentication is not yet supported for a GuardPoint with Ransomware Protection with a CTE Agent.

• AGT-61138: When applying a GuardPoint on the UNC (Universal Naming Convention) name instead of a Local drive, files display as cipher-text format when accessing using local drive

  AFFECTED VERSIONS: 7.7.0 — 7.8.0.xx

  User must apply GuardPoint on the local drive. If the user decides to apply the GuardPoint on the UNC path, user must use the UNC path to access the data. Do not view through the local Windows explorer path.

• AGT-64352: No Audit logs generated for same resource set on Standard Policy vs FAM policy

  AFFECTED VERSIONS: 7.7.0 — 7.8.0.xx

  In FAM, no audit logs are generated with a FAM policy having a resource set matching the designated pattern.

• AGT-64711: Data transformation is failing in case of existing data in OneDrive using dataxform

  AFFECTED VERSIONS: 7.7.0 — 7.8.0.xx

  For OneDrive v23.066 and subsequent versions, Microsoft made a change to their software. Users can no longer disable the Files On-Demand feature. Disabling this feature is required for the CTE driver. As a result, the CTE driver can only support using a standard policy and Data Transformation with previous versions of OneDrive v23.066. For OneDrive v23.066 and subsequent versions, the CTE driver supports using a standard policy. It does not support using Data Transformation.

• AGT-64971: Unable to delete GuardPoint inside a Ransomware protected volume, when simulating a ransomware attack when a process is marked as malicious by RWP

  AFFECTED VERSIONS: 7.8.0

  GuardPoint is not being removed from the directory. On CipherTrust Manager it displays that it's in the processing state.

  Work-around

  Reboot the agent.

• AGT-65794: CTE/FAM duplicate audit logs generated for single action

  AFFECTED VERSIONS: 7.8.0

  For CTE protected paths, there can be multiple FAM audit logs generated for a single I/O operation.

• AGT-66352: System Crashed while restoring shadow-copy backup

  AFFECTED VERSIONS: 7.8.0.73 — 7.8.0.xx

  Forcefully dismounting a shadow drive using the vssadmin.exe revert shadow /ForceDismount command, and then attempting to generate an LDT report using the Voradmin LDT report command, in sequence, may result in a system crash. Thales suggests that you do not perform these two commands in sequence.

• AGT-66386: Not able to access CIFS file from a Windows AccessOnly node after key rotation

  AFFECTED VERSIONS: 7.8.0.77 — 7.8.0.xx

  If a file on a CIFS share is accessed from a Windows AccessOnly node immediately following the initial LDT transformation operation, and then a subsequent rekey is performed, the file is no longer be accessible on the Windows AccessOnly Node.

  Workaround

  Reboot the Windows AccessOnly node.

• AGT-67113 [CS2186722]: MSSQL update (KB5046862) failed to install when staging drive is guarded with CTE RWP

  AFFECTED VERSIONS: 7.7.0.77 — 7.8.0.xx

  Enhanced Ransomware Protection is blocking SQL upgrade KB5046862.

  Work-around

  To allow the upgrade to install, disable the enhanced Ransomware Protection before attempting the upgrade:

  1. In CipherTrust Manager, go to Transparent Encryption > Settings > Profile > Ransomware Protection Configuration and switch from block mode to monitor mode.

  2. Disable enhanced Ransomware Protection, type:

     voradmin cft mode disable
     

  3. Upgrade SQL.

  4. Re-enable enable enhanced Ransomware Protection after the installation, type:

     voradmin cft mode standard
     

  5. Switch back to block mode in the client profile.

End of Life

Due to the end of life status of DSM, CTE no longer ships with VMSSC.