ElcomSoft Solutionsin the corporate information security environment

Copyright (c) 2007 ElcomSoft Co.Ltd.

Contents

Introduction

3

It is not hard to lose data

4

What can be the consequence of data loss?

5

Threat to business activity
Lost opportunities for security services and law enforcement agencies

What security measures are available in this case?

6

Is specialized software worth it?
Why get a software program and not use a specialized service?
Several scenarios and corresponding solutions

When would I need ElcomSoft solutions?

9

A brief description of ElcomSoft Password Recovery Products
A brief description of ElcomSoft products for restoring access

About ElcomSoft

ElcomSoft solutions for corporate environment
whitepaper

132Introduction
With the rapid development of information and computer systems over the recent years, data
accessibility and the ease with which it can be handled have become unprecedented level ofadvancement. The information infrastructure of any modern company is a complex mechanismthat requires constant oversight.
The availability of data, along with its clear usefulness, has also brought undesirable consequences with it. Data streams have become much harder to control. Data and its owner havebecome increasingly vulnerable and exposed to a great variety of risk factors.
The information age is demanding that we take a fundamentally different attitude toward dataand give it more substantial protection. At issue are not only internal leaks, theft, and corruptionof data, but also its loss, pure and simple.

ElcomSoft solutions for corporate environment
whitepaper3

It is not hard to lose data
It was not long ago that data was stored and distributed primarily using paper media and was
threatened primarily natural disasters and time. In the age of computer technologies, data ismuch easier to lose. It can be easily lost due to the following reasons:
1.  Computer hardware malfunction (loss caused by hardware problems).
2.  Computer software failure (loss caused by software problems).
3.  Theft or intentional corruption of data by intruders or dishonest company employees.
4.  Unskilled actions by company personnel.
5.  And, finally, the loss of control over or access permissions to the data.
Each of these items can give rise to a separate document and deserve separate consideration,
but we will examine only the last item for the time being - the loss of control over the data or theloss of access permissions to it.
Experts and IT professionals have given this set of risks less attention than it rightfully deserves,
even though the loss of control over data is no less dangerous that its corruption or theft.
We always limit access to the most important data by ensuring that it is encrypted or by setting
up password protection for documents and computers.
This way, control over data can be quickly lost in the following ways:
1.  Password loss for protected documents (Microsoft Office, electronic mail databases, Adobe
Acrobat files, archives, etc.).
2.  Loss of access permissions to certain applications (for example, loss of permission to accessthe Microsoft Windows operating system).
3.  Loss of permission to access encrypted data (for example, encrypted using the Encrypting
File System).
Obviously, the risks of losing access to the data are always present, and they can never be fully
eliminated. Any internal corporate department offering support to users regularly encounters the
problem of password loss which requires significant resources to resolve.
At the same times, few professionals think about the fact that these risks can be easily managed, by describing and streamlining the set of actions that must be taken in the event that lossof control over data takes place at the company.

ElcomSoft solutions for corporate environment
whitepaper

4What can be the consequence of data loss?
Let’s sort out what risks are associated with the loss of access to/control over valuable data,
which is ultimately what we are protecting with passwords and through encryption.

Threat to business activity
According to the “Computer Crime and Security Survey 2007” by the Computer Security Institute, theaverage annual losses incurred by businesses as a result of various threats over one year have grownfrom USD 168,000 to USD 350,000, and the trend is expected to continue.
A business faced with loss of access to data risks:•  completely losing valuable data, which was password protected and encrypted;•  losing access to important information (this is of particular relevance to internal corporate

security departments);  having
to gather the data and recreate the documents from scratch;•  losing
internal
IT resources of the company to the time-consuming process of finding an ad•
hoc solution to the problem;•  missing opportunities, associated with the inactivity of individual employees or the duplicationof effort.
It becomes evident that the potential consequences can result in many additional costs, internal
problems, and even bring the work of the business to a standstill, which can lead to significant
material and operational costs.
Password protected data will need to be recreated from scratch, which will require a significant
time investment on the part of the employees. In a number of cases this might even be impossible, if the lost data included a disk containing encrypted document archives. All this can entail
lost business opportunities for the company.

Lost opportunities for security services and law enforcement agencies
The case of security services and law enforcement agencies deserves special consideration. It is
not unusual when these entities need to obtain evidence as part of an investigation and need toaccess data that was intentionally password protected or encrypted for safekeeping or transfer
to third parties.
For security services gaining access to the data can be of great assistance to uncovering thetraces of criminal activity, insider or subversive activity. Meanwhile, for law enforcement agencies (forensics) the data can be an additional body of evidence.

ElcomSoft solutions for corporate environment
whitepaper

5What security measures are available in this case?
In most cases, it is possible to restore passwords and access to data, whether to passwordprotected files, the operating system, or to encrypted data. There is a multitude of methods andspecialized software tools created for this purpose.
Businesses that take a serious approach to information security always must keep these types ofsoftware tools on hand and know how to use them properly.

Is specialized software worth it?
Why buy specialized software if the problem is a rare occurrence? Could it be that these programs are only worth buying once the incident already occurred? These questions are usuallyasked by IT professionals who are not entirely informed regarding the risks and the potential
consequences of losing access to data.
This is a common oversight! Programs for restoring passwords and access to data should bealways within arm’s reach, especially at the IT departments at larger companies. In the worst
case scenario, precious time will be wasted on searching for, selecting, purchasing, and learning to use the programs, all of which have their specific traits. In addition, when pressed for time
it becomes difficult to make a well thought-out choice of a truly effective solution that would help
resolve the problem at hand.
A program purchased in a hurry can disappoint when it does not meet expectations with regard
to effectiveness and speed, or even appears to be useless in solving the problems. Waiting until
the most critical time to try out key software is almost a crime against your own company.
For example, every day special services around the world encounter problems with restoring
access to data of strategic importance. By keeping a selection of specialized software tools on
hand (for restoring and resetting passwords, restoring system access or access to encrypted
files), they succeed in effectively accomplishing their missions.
Any security service within a large company stands to encounter similar problems as applicable
to investigating internal incidents. The effective use of special software by IT departments for resetting/restoring lost passwords and access to data can essentially cancel out the consequences of loss of access to the data and reduce the costs associated with resolving such situations(cf. section “It is not hard to lose data“).

ElcomSoft solutions for corporate environment
whitepaper

6

Why get a software program and not use a specialized service?
Currently there is an enormous number of online services for resetting passwords, which requirethat the customer turn to them for assistance. These services offer a simple service: the customer sends in a file, the company decrypts it or tells the customer the password. These files
are highly likely to contain confidential information and so the owner of the service signed a NonDisclosure Agreement.
At first glance, this is very simple and convenient. There is no need to buy software or train thestaff. Besides this, there is the advantage in speed, since the service owner may have morerobust resources and can therefore find the password faster than can be done internally at thecompany.
However, despite the obvious advantages, these services have the following considerable shortcomings:•  There is no guarantee of confidentiality. Despite the signed non-disclosure agreement,

there is still no 100% guarantee that the confidential data, obtained once the password was
broken, will not end up in the hands of the competition.
•  High cost. If passwords are forgotten or lost relatively regularly (this is what happens in alarge company), the cost for each service request become uneconomical, while having an
inexpensive piece of software in-house can enable your technicians to resolve the problem
without outside assistance.
•  Slow turn-around. The work cycle with the service (even if it is available 24/7) can take avery significant amount of time. First, permission needs to be obtained to send the “problem”
files from the security department and from management. Then the non-disclosure agreement
must be signed and the file needs to be sent over the web (assuming that internal regulations
permit this). If the problem at hand is very time-sensitive, then the inability to access the document of the system can ultimately make every idle minute cost a pretty penny.
•  Narrow scope. Online services can be used to only retrieve the password to files, including
Microsoft Office documents, Adobe Acrobat files and archives, but these services will be to
no avail when you need to restore access to an operating system or to encrypted data stored
on a hard drive.
This is why, by most criteria, software solutions are more suitable for corporate use.

ElcomSoft solutions for corporate environment
whitepaper

7

Several scenarios and corresponding solutions
Scenario №1
The password for logging into Microsoft Windows XP on the CEO’s laptop is lost or forgotten.
There are no alternate user accounts on the laptop out of security considerations. Access to thecomputer and to the important documents, the only existing copies of which are stored on it,
needs to be restored in all urgency.
The most convenient tool for resolving the situation is the Elcomsoft System Recovery tool, which
can be used to quickly restore access to Windows with the necessary permissions or to reset thelost password in order to log into the system, using exclusively internal company resources.

Scenario №2
The password to an important Microsoft Office 2003 document has been lost (Microsoft Word or
Microsoft Excel). It contains documentation for a tender. It is impossible to reproduce the data
within a reasonable timeframe, and its absence threatens a profitable deal and the reputation of
the company on the market.
The best way out of such a situation is to use the Advanced Office Password Recovery software
suite from ElcomSoft, which can be used to restore passwords protecting Microsoft Office document for all versions currently in use.

Scenario №3
The company security department has lost access to important data. The needed files are encoded using Encrypting File System in the Microsoft Windows 2000 operating system. In addition, it is also critical to gain access to the password protected Outlook mail program.
To solve this problem, the most convenient solution is to use a set of two specialized programs.
The first of these is Advanced EFS Data Recovery software suite from ElcomSoft specifically designed for restoring (decrypting) files, located in NTFS partitions and encoded using Encrypting
File System (EFS) in Windows 2000 and Windows XP, Windows 2003 Server and Windows Vista
environments.
The second tool, Advanced Outlook Password Recovery from ElcomSoft restores forgotten
passwords protecting files with personal information in Microsoft Outlook (PST extension). The
program also restores passwords to e-mail accounts created in Microsoft Outlook and saved
locally. All passwords are instantly recovered with direct decryption.

ElcomSoft solutions for corporate environment
whitepaper

8When would I need ElcomSoft solutions?
ElcomSoft offers a full range of software products for restoring passwords and data in different
applications.
ElcomSoft products are recognized by experts around the world and are truly effective and reliable solutions in their class.
The complete ElcomSoft product line can be used in combination to restore, with very high success rates, even those passwords that are considered to be very strong, such as PGP.
This problem cannot be solved using the usual search method, but there is a high probability thatthe desired password was also used for a different program, such as ICQ or WordPerfect. There,
the password can be restored very quickly.
This combined approach is particularly relevant in the case of a complete loss of control overdata, for example in the case of intentional withholding of information, which is frequently encountered by security agencies.
The ElcomSoft product line can be broken down into two parts: products for restoring passwords
to file contents and for restoring access to a system or data.

A brief description of ElcomSoft Password Recovery Products
1.  Elcomsoft ElcomSoft Distributed Password Recovery is the flagship product of the company. This program is intended for distributed retrieval of forgotten passwords to a variety
of different document types. The software supports Microsoft Office formats (Word, Excel,
PowerPoint), Microsoft Money, Microsoft OneNote, PGP (*.skr, *.pgd, *.pgp, PGP whole disk
encryption), PKCS #12 certificates (*.pfx), Adobe Acrobat PDF, Windows 2000/XP/2003/Vista
user passwords, Intuit Quicken, Lotus Notes ID files, MD5 hashes. Learn more about the
product here.
2.  Elcomsoft Advanced Office Password Recovery is a program for restoring forgotten passwords protecting Microsoft Office documents of all versions current available (Office 95, Office 97, Office 2000, Office XP, Office 2003 Beta, Office 2003 and Office 2007). The program
can also be used to restore passwords to MS Money, MS Visio, MS Backup and the IE
Content Advisor password. The program is available in three versions: Home, Standard andProfessional. Most passwords are instantly retrieved through direct decryption. You can learn
more about this product here.
3.  Elcomsoft Advanced Office Password Breaker is a program designed for decrypting Word
97/2000 and Excel 97/2000 documents using password protection for opening the document.
The program guarantees that the document in question will be opened, regardless of the difficulty or length of its password. You can learn more about this product here.

ElcomSoft solutions for corporate environment
whitepaper

94.  Elcomsoft Advanced Archive Password Recovery is a program for restoring forgotten
passwords protecting ZIP archives (PKZIP, WinZIP), ARJ/WinARJ, RAR/WinRAR and ACE/
WinACE. The program combines all of the features of Advanced ZIP Password Recovery,
Advanced ARJ Password Recovery, Advanced ACE Password Recovery and Advanced RAR
Password Recovery. Besides these capabilities, ARCHPR can be used for guaranteed recovery of the contents of WinZIP archives, if they contain more than five files. You can learn more
about this product here.
5.  Elcomsoft Advanced PDF Password Recovery is a program, which can be used to decrypt
PDF files, protected by a password, or files that have restrictions, provided for by the PDF fileformat. PDF format restrictions can be instantly removed, regardless of the difficulty of theowner-password being used. To find the user-password the software can use a direct search, adictionary attack, or an encryption key search. You can learn more about this product here.
6.  Elcomsoft Advanced Intuit Password Recovery is a program for restoring passwords todocuments created by Intuit applications - Quicken (*.QDT, *.QDB, *.QDF) versions 4 to 2008
inclusive, Quicken Lawyer (Portfolios, *.PFL) and QuickBooks (*.QBW, *.QBA) versions 3 to2007 inclusive. You can learn more about this product here.

ElcomSoft solutions for corporate environment
whitepaper

10In addition, ElcomSoft’s range of products also includes other tools for password recovery andresetting for documents such as ACT!, WordPerfect and Lotus SmartSuite, Internet-messengers(different versions of ICQ, AOL Instant Messenger, Yahoo! Messenger, MSN Messenger, Google
Talk, Trillian, Miranda, Mail.Ru Agent and many others), as well as e-mail clients (Eudora, TheBat!, Netscape Mail, Opera Mail and many others) and Microsoft Internet Explorer and Outlook
Express.

ElcomSoft solutions for corporate environment
whitepaper

11

A brief description of ElcomSoft products for restoring access
1.  Elcomsoft System Recovery is a solution that enables the user to gain very rapid accessto Windows with the necessary permission settings. It is a boot disk based on Windows PE(CD or USB flash drive), which is compatible with any computer running Windows NT 4.0,
Windows 2000, Windows XP, Windows Server 2003 or Windows Vista. You can learn more
about this product here.

2.  Elcomsoft Advanced EFS Data Recovery is a program for decrypting files located on NTFS
partitions and encrypted using Encrypted File System technology (EFS) on machines running
Windows 2000 or Windows XP, Windows 2003 Server or Windows Vista. This software tool
can be used to decrypt files even when the system does not load or when some of the encryption key records are corrupted. Even if the system user database is SYSKEY protected,
the program can still be used to decrypt files. In Windows 2000 it is possible to decrypt all
files, even if the administrator and user passwords are not known! You can learn more about
this product here.
3.  Elcomsoft Proactive System Password Recovery is a program that enables the user
to restore forgotten passwords, configured in Microsoft Windows, such as: system accesspassword [Windows 95/98/Me/NT4/2000]; .NET Passport passwords; SYSKEY password,
WiFi WEP and WPA-PSK passwords (saved in WZC); password saved in Windows XP (multiple credentials); passwords for accessing ISP accounts (RAS and Dial-Up); VPN connection passwords; LSA Secrets; PWL file passwords, etc. You can learn more about thisproduct here.

ElcomSoft solutions for corporate environment
whitepaper

12About ElcomSoft
Founded in 1990 in Moscow, Russia, ElcomSoft is a leader in the password/system recovery andforensics market. Thanks to one-of-a-kind technologies, ElcomSoft’s products have garneredwide recognition both in Russia and abroad.
ElcomSoft’s clients include many well known international companies from the following sectors:
High Tech: Microsoft, Adobe, IBM, Cisco
Governmental: FBI, CIA, US Army, US Navy, Department of Defence
Consulting: Andersen Consulting, Deloitte & Touche, Ernst and Young, KPMG, PricewaterhouseCoopers
Finance: Bank of America, Citibank, Equifax, HSBC, Wells Fargo, J.P.Morgan, Credit Suisse
Telecommunications: France Telecom, BT, AT&T
Insurance: Allianz, Mitsui Sumitomo
Retail: Wal-Mart, Best Buy, Woolworth
Media&Entertainment: Sony Entertainment
Manufacturing: Volkswagen, Siemens, Boeing
Energy: Lukoil, Statoil
Pharmaceuticals: Johnson&Johnson, Pfizer, GlaxoSmithKline, Novartis
ElcomSoft is a Microsoft Gold Certified Partner, Intel Software Partner, as well as a member ofthe Russian Cryptology Association, the Computer Security Institute (CSI), and the Associationof Shareware Professionals (ASP).
ElcomSoft is an acknowledged expert in the password/system recovery and forensics market.
The company’s technological achievements and opinion leadership is quoted in many authoritative publications. For example: “Microsoft Encyclopedia of Security”, “The art of deception”(Kevin Mitnick), “IT Auditing: Using Controls to Protect Information Assets” (Chris Davis), “Hacking exposed” (Stuart McClure).
Visit our website to find out more.

Address:

ElcomsoftZvezdny bulvar 21, office 541
129085 Moscow, Russian Federation

Fax:

US (toll-free): +1 (866) 448-2703
United Kingdom: +44 (870) 831-2983
Germany: +49 18054820050734

Websites:

http://www.elcomsoft.ru
http://www.elcomsoft.com
http://www.elcomsoft.de
http://www.elcomsoft.jp
http://www.elcomsoft.fr

ElcomSoft solutions for corporate environment
whitepaper

13

Copyright (c) 2007 ElcomSoft Co.Ltd.
All right reserved.
This document is provided for information purposes only
and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor
subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties
and conditions of merchantability or fitness for a particularpurpose. We specifically disclaim any liability with respect
to this document and no contractual obligations are formed
either directly or indirectly by this document. This document
may not be reproduced or transmitted in any form or by anymeans, electronic or mechanical, for any purpose, without
our prior written permission.
Microsoft and Windows are registered trademarks of Microsoft Corporation. Intel and Intel logo are registered trademarksof Intel Corporation. Elcomsoft and Elcomsoft logo are trademarks or registered trademarks of ElcomSoft Co.Ltd. Other
names may be trademarks of their respective owners.