User Guide
IronKey Enterprise
Models: S200, S100, D200
PAGE 1IRONKEY ENTERPRISE USER GUIDE
Thank you for your interest in IronKey.
IronKey is committed to creating and developing
the best security technologies and making them
simple-to-use, affordable, and available to everyone. Years of research and millions of dollars of
development have gone into bringing this technology to you in the IronKey.
For a quick product overview, you can also view
our online demos at https://www.ironkey.com/demo.
We are very open to user feedback and would
greatly appreciate hearing about your comments,
suggestions, and experiences with the IronKey.
Standard Feedback:
feedback@ironkey.com
Anonymous Feedback:
https://www.ironkey.com/feedback
User Forum:
https://forum.ironkey.com
PAGE 1IRONKEY ENTERPRISE USER GUIDE
CONTENTS
What is it? ................................................3
Meet the IronKey .......................................................3
Core Features..........................................................3
Device Diagrams .......................................................5
Technical and Security Notes ..............................................6
IronKey Device Security .................................................6
How does it work? .........................................8
Product Walkthrough ....................................................8
Activation and Initialization (Windows and Mac)..............................8
Using the IronKey Unlocker on Windows ...................................11
Using the IronKey Unlocker on a Mac .....................................11
Using the IronKey Unlocker on Linux .....................................12
Using the IronKey Control Panel (Windows and Mac) .........................14
Using the IronKey Virtual Keyboard (Windows Only) ..........................17
Using the Onboard Firefox and Secure Sessions Service (Windows Only) ..........18
Using the IronKey Identity Manager (Windows Only)..........................19
Using the Secure Backup Software (Windows Only) ..........................21
Using RSA SecurID on Your IronKey (Windows Only) ..........................22
Importing a Digital Certicate into the IronKey (Windows Only) .................23
Using my.ironkey.com (Windows and Mac) .................................25
Using Your IronKey in Read-Only Mode (Windows, Mac, Linux) ..................27
Using the IronKey Malware Scanner (Windows Only) .........................28
Product Specications...................................................30
What’s next? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Where can I go for more info?............................................31
Who is the IronKey Team? ...............................................31
Contact Information ....................................................32
PAGE 2IRONKEY ENTERPRISE USER GUIDE
What is it?
Meet the IronKey
The IronKey Enterprise Secure Flash Drive, designed to be the world’s
most secure USB ash drive, protects your data, passwords, and Internet
privacy with some of today’s most advanced security technologies. Your
IronKey includes a suite of security software and online services, many
of which are described in this User’s Guide. Depending on how your
System Administrator has congured your IronKey, some of these features
might not be included on your IronKey.
Core Features
Hardware-Encrypted Flash Drive
Your IronKey can safely store 1, 2, 4, 8, 16, or 32 gigabytes of documents,
applications, les and other data. The IronKey Cryptochip inside
the IronKey protects your data to the same level as highly classied
government information and cannot be disabled or accidently turned off.
Self-Destruct Sequence
If the IronKey Cryptochip detects any physical tampering by a hacker, it
will self-destruct. Similarly, after too many consecutive invalid password
attempts
Anti-Malware Protection
Your IronKey helps protect you from many of the latest malware
threats targeting USB ash drives. It will prevent autorun execution of
unapproved programs, can be unlocked in a Read-Only Mode, and can
scan and clean malware from your IronKey with the IronKey Malware
Scanner.
your IronKey will self-destruct using ash-trash technology.
PAGE 3IRONKEY ENTERPRISE USER GUIDE
Simple Device Management
Your IronKey includes the IronKey Control Panel, a central launchpad for
launching your applications, editing your preferences, and safely locking
your IronKey.
Portable and Cross-Platform Data Access
The IronKey Unlocker allows you to access your encrypted les on
Windows 2000, XP, Vista, or 7, Mac OS X and numerous distributions of
Linux.
Secure Local Backup and Data Recovery
Securely back up the data on your IronKey using IronKey’s Secure Backup
software. It allows you to recover your data to a new IronKey in case your
IronKey is ever lost or stolen, or synchronize data between IronKeys.
Stealth Browsing Technology
Surf the Web safely and privately through almost any network, even across
unsecured wireless hotspots, with IronKey’s Secure Sessions Service. It
can be easily toggled through the onboard Mozilla Firefox web browser.
Self-Learning Password Management
Securely store and backup all your passwords as you go with the IronKey
Identity Manager. It allows you to automatically log into your applications
and online accounts to avoid keylogging spyware and phishing attacks.
Online Security Vault
If your IronKey is ever lost or stolen, you can easily restore your online
passwords from an encrypted online backup.
Waterproof and Tamper-Resistant
The IronKey was designed to survive the extremes. The IronKey’s rugged
encasing is injected with an epoxy compound that makes it not only
tamper-resistant, but waterproof to military specications (MIL-STD-810F).
Section 508 compliance
The IronKey Control Panel is Section 508 compliant. Users with
disabilities have keyboard navigation and screen reader support.
PAGE 4IRONKEY ENTERPRISE USER GUIDE
Rugged case
lled solid with epoxy
Multi-color LED
Device Diagrams
The IronKey has been designed from the ground up with security in mind.
A combination of advanced security technologies are used to ensure
maximum protection of your data. Additionally, the IronKey has been
designed to be physically secure, to prevent hardware-level attacks and
tampering, as well as to make the device rugged and long-lasting. You can
rest assured that your data is secured when you carry an IronKey.
Cap
Area to engrave
your name/code
Laser-engraved
unique serial number
(plus barcode on newer
devices)
USB 2.0
Connector
This IronKey Cryptochip is hardened against physical attacks such as
power attacks and bus snifng. It is physically impossible to tamper with
its protected data or reset the password counter. If the Cryptochip
detects a physical attack from a hacker, it will destroy the encryption keys,
making the stored encrypted les inaccessible.
PAGE 5IRONKEY ENTERPRISE USER GUIDE
Technical and Security Notes
We are endeavoring to be very open about the security architecture and
technology that we use in designing and building the IronKey devices and
online services. There is no hocus-pocus or handwaving here. We use
established cryptographic algorithms, we develop threat models, and we
perform security analyses (internal and third party) of our systems all the
way through design, development and deployment.
IRONKEY DEVICE SECURITY
Data Encryption Keys
» AES keys generated by onboard Random Number Generator
» AES keys generated by user at initialization time and encrypted
» AES keys never leave the hardware and are not stored in NAND ash
Self-Destruct Data Protection
» Secure volume does not mount until password is veried in hardware
» Password try-counter implemented in tamper-resistant hardware
» Once password try-count is exceeded, all data is erased by hardware
Additional Security Features
» USB command channel encryption to protect device communications
» Firmware and software securely updateable over the Internet
» Updates veried by digital signatures in hardware
Physically Secure
» Solid, rugged case
» Encryption keys stored in the tamper-resistant IronKey Cryptochip
» All chips are protected by epoxy-based potting compound
» Exceeds military waterproof standards (MIL-STD-810F)
Device Password Protection
The device password is hashed using salted SHA-256 before being
transmitted to the IronKey Secure Flash Drive over a secure and unique
USB channel. It is stored in an extremely inaccessible location in the
protected hardware. The hashed password is validated in hardware (there
is no “getPassword” function that can retrieve the hashed password), and
only after the password is validated is the AES encryption key unlocked.
The password try-counter is also implemented in hardware to prevent
memory rewind attacks. Typing your password incorrectly too many times
initiates a patent-pending “ash-trash” self-destruct sequence, which is run
in hardware rather than using software, ensuring the ultimate protection
for your data.
PAGE 6IRONKEY ENTERPRISE USER GUIDE
Identity Manager Protection
The IronKey Identity Manager and my.ironkey.com work together, giving
you the ability to back up your online passwords to your Online Security
Vault. First, you must unlock your IronKey device with your device
password. Your Identity Manager passwords are securely stored in a
hidden hardware-encrypted area inside the device (not in the le system),
being rst locally encrypted with 256-bit AES, using randomly generated
keys encrypted with a SHA-256 hash of your device password. All of
this data is then doubly encrypted with 128-bit or 256-bit AES hardware
encryption. This is the strongest password protection we have ever seen
in the industry.
When you back up your passwords online, IronKey performs a
complicated public key cryptography handshake with IronKey’s services
using RSA 2048-bit keys. After successful authentication, your encrypted
block of password data is securely transmitted over SSL to your
encrypted Online Security Vault.
Find more information at
https://support.ironkey.com
PAGE 7IRONKEY ENTERPRISE USER GUIDE
How does it work?
Product Walkthrough
Your IronKey Enterprise Secure Flash Drive consists of the following components:
» IronKey Unlocker (Windows, Mac and Linux)
» IronKey Control Panel (Windows and Mac)
» IronKey Virtual Keyboard (Windows only)
» Mozilla Firefox and IronKey’s Secure Sessions Service (Windows only)
» IronKey Identity Manager (Windows only)
» IronKey Secure Backup (Windows only)
» RSA SecurID (Windows only)
» my.ironkey.com (Windows and Mac)
NOTE: Your System Admin might not make all components available on your IronKey.
Standard Usage Requires:
» Windows 2000 (SP4), XP (SP2+), Vista, or 7, Mac 10.4+ or Linux (2.6+) computer
» A USB 2.0 port for high-speed data transfer
» An Internet connection for the online services
» An email from your System Admin with an Activation Code
ACTIVATION AND INITIALIZATION (WINDOWS AND MAC)
When you open the package, you will nd one IronKey Secure Flash Drive and a Quick Start
Guide. Below is a brief description of the standard way of setting up an IronKey:
NOTE: The Windows version of the IronKey Control Panel is shown.
# Step Description
1 Plug the IronKey into your
computer’s USB port.
Your IronKey can be activated and initialized on a
Windows (2000, XP, or Vista, or 7) or Mac (10.4+,
Intel) computer.
To use the full speed of the IronKey, plug it into a USB
2.0 port.
PAGE 8IRONKEY ENTERPRISE USER GUIDE
# Step Description
2 The “Activate Your IronKey”
screen appears.
The IronKey autoruns as a virtual CD-ROM.
Windows: This screen might not appear if your
computer does not allow devices to autorun. You
can start it manually by double-clicking the IronKey
Unlocker drive in “My Computer” and double-clicking
the “IronKey.exe” le.
Mac: Double-click the IronKey drive on your desktop,
and double-click the “IronKey” le.
NOTE: You can install the IronKey Auto-Launch
Assistant, which automatically opens the IronKey
Unlocker when you plug in an IronKey. See
“Preferences” in IronKey Control Panel Settings. (Mac
only)
3 Retrieve the email with your
Activation Code. Copy and paste
it into the IronKey window.
Your System Admin has setup your IronKey ahead of
time to abide by your organization’s security standards.
You will receive an email with an Activation Code that
is needed to use your IronKey.
Enter your email address and your Activation Code
into the elds provided on the IronKey window. Click
“Continue” when you are ready.
If your IronKey cannot connect to the Internet, click
“Edit Proxy Settings” to adjust its network settings.
4 Create a device password and a
nickname for your IronKey.
Since you can have multiple IronKeys associated
with one IronKey account, the nickname helps you
distinguish between different IronKey devices.
The threat of brute-force password attacks is removed
by the IronKey’s self-destruct feature. Your password
is case-sensitive and must match your organization’s
password policy.
5 Back up your password to your
online IronKey account
If enabled, you have the option to back up your
password online to your my.ironkey.com account. That
way, if you ever forget your password, your System
Admin can email you a reminder.
6 The IronKey initializes. During this process, it generates the AES encryption
keys, creates the le system for the secure volume,
and copies secure applications and les to the secure
volume.
PAGE 9IRONKEY ENTERPRISE USER GUIDE
# Step Description
7 Set up your personalized login
information for your
my.ironkey.com account by clicking
the “Login to my.ironkey.com”
button.
8 Follow the onscreen directions to
setup your my.ironkey.com account.
If enabled, you continue the setup process online.
my.ironkey.com is a secure site where you can manage
your IronKey account and devices. Accessing
my.ironkey.com requires two-factor authentication (your
IronKey and your password).
Depending on your organization’s settings, you
will create a unique username, password, conrm
your email address for out-of-band authentication,
and answer Secret Questions for supplemental
authentication.
You will also select a Secret Image that you will see
whenever you log in, as well as a Secret Phrase that is
used as an anti-phishing measure when communicating
with you via email.
9 You might need to respond to a
conrmation email by entering
the conrmation code online.
IronKey must verify your email address because it is
used with important services related to your online
account.
At this point, your IronKey is ready to protect your data, identity, and online privacy.
PAGE 10IRONKEY ENTERPRISE USER GUIDE
USING THE IRONKEY UNLOCKER ON WINDOWS
The IronKey Unlocker allows you to securely access your les on multiple operating systems. It
prompts you for your password, securely validates it, and then mounts your secure volume where
all of your les are stored on the IronKey.
Here is how to unlock your IronKey on Windows 2000 (SP4), XP (SP2+), Vista, or 7:
# Step Description
1 Plug in your IronKey and unlock
it with your password.
When you plug your IronKey in, the “Unlock Your
IronKey” window appears.
If this screen does not appear, you can start it manually
by double-clicking the IronKey Unlocker drive in “My
Computer” and double-clicking the “IronKey.exe” le.
Entering your password correctly will mount your
secure volume with all your secure applications and
les.
Entering the wrong password too many times will
permanently erase all of your data. After every three
attempts, you must unplug and reinsert the IronKey.
NOTE: Some operations require that your IronKey
connect to the Internet before unlocking. If it cannot
connect, click “Edit Proxy Settings” to congure how
your IronKey connects to the Internet.
2 Choose which action to take
when you unlock it.
By selecting the corresponding checkboxes before
unlocking your IronKey, you can view your secure les,
launch the IronKey Control Panel, unlock the IronKey
in a Read-Only Mode where les cannot be edited, and
securely log into your my.ironkey.com account.
USING THE IRONKEY UNLOCKER ON A MAC
You can use the IronKey Unlocker for Mac to access your les and change your device password
on a Mac. You can use the other IronKey applications on a Windows computer.
# Step Description
1 Plug the IronKey into your
computer’s USB port.
2 Double-click the IronKey drive
on your desktop, and double-click
the “IronKey” le. The “Unlock
Your IronKey” screen appears.
NOTE: You can install the IronKey Auto-Launch
Assistant, which automatically opens the IronKey
Unlocker when you plug in an IronKey. See “Preferences”
in IronKey Control Panel Settings. (Mac only)
PAGE 11IRONKEY ENTERPRISE USER GUIDE
# Step Description
3 Unlock it with your password. Entering your password correctly (which is veried in
hardware) will mount your secure volume with all your
secure les.
Entering the wrong password too many times will
permanently erase all of your data. After every three
attempts, you must unplug and reinsert the IronKey.
NOTE: Some operations require that your IronKey
connect to the Internet before unlocking. If it cannot
connect, click “Edit Proxy Settings” to congure how
your IronKey connects to the Internet.
4 Choose which action to take
when you unlock it.
By selecting the corresponding checkbox before
unlocking your IronKey, you can view your secure les
launch the IronKey Control Panel, unlock the IronKey
in Read-Only Mode where les cannot be edited, and
securely log in to your my.ironkey.com account.
USING THE IRONKEY UNLOCKER ON LINUX
IronKey has extended its core platform compatibility to include Linux systems. If enabled, you
can manage your secure les on Linux (2.6+), allowing you to securely transfer les from and
between Windows, Mac, and Linux computers.
Depending on your Linux distribution, you might need root privileges to use the program
“ironkey” found in the Linux folder of the mounted virtual CD-ROM. If you have only one
IronKey attached to the system, simply run the program from a command shell with no
arguments (e.g. ironkey). If you have multiple IronKeys, you will have to specify the device
name of the one you want to unlock.
NOTE: ironkey only unlocks the secure volume; it must then be mounted. Many modern
Linux distributions will do this automatically; if not, run the mount program from the command
line, using the device name printed by ironkey.
To lock the IronKey named “devicename,” enter:
ironkey --lock [devicename]
To unlock the IronKey in Read-Only Mode, enter:
ironkey --read-only
To unlock the IronKey with the password “devicepassword,” enter:
ironkey --password [devicepassword]
Simply unmounting the device does not automatically lock the secure volume. To lock the
device, you must either unmount and physically remove (unplug) it, or else run:
ironkey --lock
PAGE 12IRONKEY ENTERPRISE USER GUIDE
Please note the following important details for using your IronKey on Linux:
1. Kernel Version must be 2.6 or higher
If you compile your own kernel, you must include the following in it:
» DeviceDrivers->SCSIDeviceSupport-><*>SCSICDROMSupport
» DeviceDrivers-><*> Support for Host-side USB
» DeviceDrivers-><*> USB device lesystem
» DeviceDrivers-><*> EHCI HCD (USB 2.0) support
» DeviceDrivers-><*> UHCI HCD (most Intel and VIA) support
» DeviceDrivers-><*> USB Mass Storage Support
The kernels that are included by default in most major distributions already have these features,
so if you are using the default kernel that comes with a supported distribution you do not need
to take any other action.
Also, on 64-bit linux systems the 32-bit libraries must be installed to run the ironkey program.
2. Mounting problems
Ensure you have permissions to mount external SCSI and USB devices
» Some distributions do not mount automatically; you must run the following command:
mount /dev/<name of the device> /media/<name of the mounted device>
» The name of the mounted device varies depending on the distribution. The names of
the IronKey devices can be discovered by running:
ironkey --show
3. Permissions
You must have permissions to mount external/usb/ash devices
» You must have permissions to run executables off the IronKey CD-ROM in order to
launch the IronKey Unlocker
» You might need root user permissions
4. Supported distributions
Not all distributions of Linux are supported. Please visit https://support.ironkey.com/linux for the
latest list of supported distributions.
5. The IronKey Unlocker for Linux only supports x86 systems at this time.
NOTE: In IronKey Enterprise, you might not be allowed to change the device password or
unlock your IronKey on a Mac, depending on your System Administrator’s conguration.
See https://support.ironkey.com/linux for more information.
PAGE 13IRONKEY ENTERPRISE USER GUIDE
USING THE IRONKEY CONTROL PANEL (WINDOWS AND MAC)
The IronKey Control Panel is a central
location for:
» Launching secure applications
» Securely logging into my.ironkey.com
» Conguring your IronKey settings
» Updating your device
» Changing your IronKey password
» Safely locking your device
» Getting online help
Most of the Control Panel’s options
are located in the “Settings” menu.
NOTE: The Windows version of the
IronKey Control Panel is shown.
# Step Description
1 Creating, editing, deleting secure
les
2 Updating device rmware/software The IronKey can securely update its software and
When you click “Secure Files” in the IronKey Control
Panel, the default browser on your computer opens
directly to your secure volume.
All les on your IronKey are strongly encrypted with
military-grade AES encryption. Encrypting les is as
simple as moving them into the secure volume. Dragging
les onto your desktop decrypts them on-the-y in
hardware. The IronKey gives you the convenience of
working as you normally would with a regular ash drive,
while providing strong and “always-on” security.
rmware through signed updates that are veried in
hardware. This allows users to keep their devices up-todate and protect themselves from future malware and
online threats.
To check for available updates, click the “Check for
Updates” button (Windows) or “Check Now” button
(Mac).
Windows: If an update is available, you can download and
install it by clicking the “Download Update” button.
Mac: You can check for and download policy updates.
However, you must download software updates on a
Windows computer.
PAGE 14IRONKEY ENTERPRISE USER GUIDE
# Step Description
3 Conguring your preferences Click “Settings” to congure your preferences.
»
You can enable the Identity Manager.
»
You can enable Secure Sessions.
»
Select the default web browser for your IronKey.
4 Congure your IronKey’s network
and proxy settings
» You can set
your IronKey after a specied period of inactivity.
» You can install the IronKey Auto-Launch Assistant,
which automatically opens the IronKey Unlocker
when you plug in an IronKey. (Mac only)
Important drive maintenance features:
»
You can reformat your secure volume.
»
You can restore your IronKey applications if they are
ever erased or corrupted. (Windows only)
Click “Network Settings” (Windows) or “Network”
(Mac) to congure how your IronKey connects to the
Internet:
»
Direct Connection: Does not use a proxy.
»
Use System Settings (default): Uses the proxy settings
of your computer from the following locations.
Windows: Control Panel > Internet Options
Mac: System Preferences > Network > Proxy
IMPORTANT: Firefox proxy settings must be the same
as System Preferences and IronKey Control Panel. Firefox
does not use System Preference data.
a device time-out to automatically lock
»
Conguration Script: Enter the URL or path to where
your Web Proxy Auto-Detect le is located.
»
Manual Proxy: Enter the URL and port number for
your proxy server.
If proxy authentication is required, you can enter your
username and password in the appropriate elds.
5 Creating a Lost and Found Message You can show your contact information on the IronKey
Unlocker window. If you lose your IronKey, someone can
return it to you.
6 Changing your device password You can change your device password, and, if enabled,
optionally back it up online to your Online Security Vault
at my.ironkey.com. Changing your password on a regular
basis is a good security practice. However, be especially
careful to remember your IronKey password.
PAGE 15IRONKEY ENTERPRISE USER GUIDE
# Step Description
7 Viewing device details You can view details about your device, including model
number, serial number, software and rmware version,
secure les drive, and OS. You can also click the copy
button (CTRL+C) to copy device details to the clipboard
for your forum posting or support request; visit the
website (CTRL+W); or view legal notices (CTRL+N) and
certications (CTRL+?).
8 Adding, renaming, and removing
applications to the Applications List
To manage the items in the Applications List of the
IronKey Control Panel, simply right-click anywhere
in Applications List and click to add, rename, delete
applications in the list. You can also change between icon
and list view.
NOTE:
• Mac:
Applications installed on the secure volume
are automatically added to the list (default: empty).
• Items in the list are shortcuts to actual les. Managing
the items in the list will not alter the actual le.
• Items are automatically sorted alphabetically
• Any le can be added to the list, including documents,
images, and batch les
• For items that are not applications, Windows will open
the item with the default program associated with that
letype
9 Locking and unplugging the IronKey Clicking “Lock Drive” (Windows, CTRL+L) or “Lock &
Quit” (Mac) exits open IronKey applications and locks
the device. It is then safe to unplug it from your computer.
Ensure that you close all open applications and les
before locking your IronKey to prevent data corruption.
PAGE 16IRONKEY ENTERPRISE USER GUIDE
USING THE IRONKEY VIRTUAL KEYBOARD (WINDOWS ONLY)
If you are using your IronKey on an unfamiliar computer and are concerned about keylogging
and screenlogging spyware, use the IronKey Virtual Keyboard, which helps protects your
passwords by letting you click out letters and numbers. The underlying techniques in the
IronKey Virtual Keyboard will bypass many trojans, keyloggers, and screenloggers.
The IronKey Virtual Keyboard can be launched in a couple of ways:
»
In places where you enter a password into the IronKey (e.g. the IronKey Unlocker, changing
your device password, initializing your device), click the Virtual Keyboard icon
»
Use the keyboard shortcut CTRL+ALT+ V
The IronKey Virtual Keyboard can be used in a number of other applications when you need
extra security typing out information (e.g. email, documents).
# Step Description
1 Click the IronKey Virtual Key-
board icon.
The IronKey Virtual Keyboard will
appear. Alternatively, you can press
CTRL+ALT+V.
2 Click the keys to type your pass-
word. Click “Enter” when you
are nished.
3 You can optionally click the
“Randomize” button to randomize where the keys are. This helps
protect against screenloggers.
You can use the IronKey Virtual Keyboard in conjunction with the actual keyboard, so that you type some
characters and click some characters.
When you click a key in the Virtual Keyboard, all of
the keys go blank. This feature prevents screenloggers
from capturing what you clicked.
If you do not want to use this feature, you can disable
it in the options menu next to the close button.
In the options menu, you can also congure the Virtual
Keyboard to automatically launch when it encounters
password elds.
PAGE 17IRONKEY ENTERPRISE USER GUIDE
USING THE ONBOARD FIREFOX AND SECURE SESSIONS SERVICE
(WINDOWS ONLY)
If enabled, a Firefox web browser is already onboard your IronKey, so none of your cookies,
history les, bookmarks, add-ons or online passwords is stored on the local computer. Now
you can carry your personalized web experience with you to other computers without worry.
# Step Description
1 Launch the onboard Firefox web
browser for portable surng
2 Toggle Secure Sessions for secure
and private surng
If enabled, clicking on the Mozilla Firefox icon in the
Applications list of the IronKey Control Panel will
launch the onboard Firefox. You cannot have a local
version of Firefox running at the same time; if you do,
you will be prompted to close it.
If enabled, clicking the IronKey button on the bottom
right of the onboard Firefox will silently turn IronKey’s
Secure Sessions Service on/off. This will create an
encrypted tunnel directly from your IronKey, out
to a secured IronKey web server, where it is then
decrypted and sent out to the destination site.
This security gives you anti-phishing and anti-pharming
protection (for example, we do our own DNS
checking), as well as enhanced privacy protection (for
example your IP address will not be available to other
websites and ISPs). You can check this out by going to
a site such as whatismyip.com or ipchicken.com.
3 Using the Secure Sessions Tools:
Network Map, Bandwidth Meter,
and Changing Identities
At any time while using Secure Sessions, you can
launch additional tools from the IronKey System Tray
Menu that show you more information regarding your
web trafc and current session.
The Network Map will show all of your available
“circuits” and where in the world your trafc will be
coming from.
The Bandwidth Meter will show you your current
bandwidth metrics.
You can easily change your apparent online “identity”,
which creates a new random circuit and changes the
path of your encrypted web trafc. As you will be
coming from a different IP address, it will likely appear
to websites that you are a different person.
PAGE 18IRONKEY ENTERPRISE USER GUIDE
USING THE IRONKEY IDENTITY MANAGER (WINDOWS ONLY)
The IronKey Identity Manager, if enabled,
securely stores and uses many of your most
important identity credentials, including
login information and one-time passwords
to applications and online accounts. With a
click of a button, it automatically launches a
specied application, lls in your username
and password, and then logs you in. It can
even generate strong passwords for you,
so that you can really lock down your
important accounts.
The IronKey Identity Manager also allows you to back up your encrypted Identity Manager data
to your Online Security Vault, to synchronize password data between IronKeys, and to securely
restore all your passwords to a new IronKey if your IronKey is ever lost or stolen. Only you can
access and decrypt your passwords.
The IronKey Identity Manager does not store your passwords in a le on the le system of
the ash drive, so malware cannot simply copy your password database. Also, not typing your
passwords provides added protection from keyloggers and other crimeware.
The Identity Manager works with VeriSign’s VIP service to lock
down many important online accounts, including eBay, PayPal,
AOL, and Geico accounts. This new technology generates a
one-time password for each login, locking down your online
account so that it can only be used from your IronKey.
See the Help le for detailed information about the benets of using Identity Manager. To view
it, click the Help icon in the top right of the main Identity Manager window.
# Step Description
1 Adding accounts and passwords You can add accounts to Identity Manager in several
ways:
• Restore them from your Online Security Vault.
• Import them from Firefox, KeePass, RoboForms or
Internet Explorer.
• Add them manually using the “Add” button in the
main Identity Manager window.
• When on a particular website, select “Add Account”
from the Titlebar Menu.
• Use the Identity Manager’s built-in self-learning
approach to capture your logins by simply logging
into a site as usual. The Identity Manager prompts
you to store this password securely on your IronKey.
PAGE 19IRONKEY ENTERPRISE USER GUIDE
# Step Description
2 Automatically logging into an
account
The next time you return to a website or application
for which you have stored a password, your login
automatically lls in for you. If you have the auto-login
option enabled for that account, the Identity Manager
also submits the login.
You can also automatically log in by:
• Using the IronKey Launcher (Ctrl + Alt + R).
• Using the Titlebar Menu in the top right of the
application window.
• Using the IronKey System Tray Menu.
• Clicking the “AUTO” button in the main Identity
Manager window.
3 Editing/deleting logins and
accounts
You can manage your IronKey Identity Manager
accounts from within the main Identity Manager
window. Double-click the account, or select it and
click the “Edit” button.
Your data is automatically saved when you are nished
making your edits.
4 Backing Up and Restoring Iden-
tity Manager Data
You can securely back up your encrypted Identity
Manager data to your Online Security Vault. Simply
click the “Backup” button from within the IronKey
Identity Manager to back up all of your Identity
Manager data.
5 Locking down accounts with
VeriSign’s VIP Service
6 Generating strong and random
passwords
7 Modifying the Identity Manager
Settings
Synchronizing IronKeys (or setting up Master-Slave
relationships) is easy since you can restore backups to
your other IronKeys.
You can lock down some important online accounts
with VeriSign’s VIP service so that they can only be
accessed by using your IronKey. Log into eBay or
PayPal, and the Identity Manager guides you through
the rest.
You can also manually use the VeriSign VIP service for
an account by editing the account and selecting VeriSign
VIP from the “Additional Authentication” list.
You can create long random passwords with the
Identity Manager when setting up or editing an account.
Then, you can have the IronKey Identity Manager
remember them for you.
You can modify your Identity Manager settings by
clicking the “Settings” button in the main Identity
Manager window. See the Help le for more
information.
PAGE 20IRONKEY ENTERPRISE USER GUIDE
USING THE SECURE BACKUP SOFTWARE (WINDOWS ONLY)
If your IronKey is lost or stolen, you
have peace of mind knowing that your
condential information cannot be seen
by anyone but you. And getting your
data back is simple with IronKey’s Secure
Backup software, which, if enabled,
securely restores your data to a new
IronKey.
Back up your data on a regular basis.
# Step Description
1 Backing up your IronKey You can create an encrypted backup of a
single le or your entire IronKey to your local
computer. Click the “Secure Backup” button in
the IronKey Control Panel, select a destination
folder, and select which les to back up. It’s that
simple.
2 Restoring encrypted backups If you ever lose your IronKey, you can restore
your data from an encrypted backup. Open the
Secure Backup client, select the location on your
local computer where the backup is located, and
select which les/folders to restore. If the data is
coming from a different IronKey, you will have to
supply the device password for that IronKey.
PAGE 21IRONKEY ENTERPRISE USER GUIDE
USING RSA SECURID ON YOUR IRONKEY (WINDOWS ONLY)
If enabled, your IronKey can provide additional strong
authentication capabilities by generating RSA SecurID
one-time passwords. Your System Administrator will
provide you either a token le or a URL to import
your tokens, or he may import them for you.
# Step Description
1 Open the RSA SecurID application. Click the icon in the IronKey Control Panel’s
application list.
2 On rst use, you will be prompted to
import a token le.
1.Click the “Import from le” link to browse on
your computer to the .stdid le. A password
might be required to unlock the le.
2.Alternatively, if your System Administrator
provided you a URL for RSA activation, you
can import the token from the web by clicking
“Import from Web” and pasting that URL in the
appropriate eld.
3 If you prefer, rename your tokens.
4 To use the application, enter the PIN (if
required) and click on the right arrow
button.
NOTE:
• A valid PIN is between 4 and 8 digits.
Click the “Change Name” button to create a
name for the selected token.
If your le contains more than one Token, you
will receive a duplicate message for each token
imported. Click “OK”.
When all tokens have been imported, the RSA
application will be available for use.
PAGE 22IRONKEY ENTERPRISE USER GUIDE
5 The “Options” button allows you to
manage your tokens.
The drop-down list to the left of the
“Options” button allows you to select
the various tokens installed on the
device.
Periodically, a new one-time password
is generated. To copy your password to
the clipboard, click the “Copy” button.
IMPORTING A DIGITAL CERTIFICATE INTO THE IRONKEY (WINDOWS ONLY)
The IronKey Cryptochip includes a limited amount of extremely secure hardware storage space,
which can be used for storing the private key associated with a digital certicate. This provides
you with additional strong authentication capabilities. For example, you could store a self-signed
certicate used for internal systems that will allow you to automatically log in when using the
IronKey’s onboard Firefox web browser.
The import process uses IronKey’s PKCS#11 interface and requires Mozilla Firefox. Note that
there is only space for one additional private key in the IronKey Cryptochip, though that key
will receive the security benets of the Cryptochip’s tamperproof hardware and self-destruct
mechanisms.
# Step Description
1 Open the onboard Firefox. Click the icon in the IronKey Control Panel’s application
list on your user’s device.
2 Open Firefox’s Options menu
to the Encryption tab.
3.Click “Tools” in the menu bar.
4.Click “Options.”
5.Click the “Advanced” icon.
6.Click the “Encryption” tab.
PAGE 23IRONKEY ENTERPRISE USER GUIDE
# Step Description
3 Click the “View Certicates”
button.
This opens the Firefox
Certicate Manager.
4 Note that IronKey’s certicate
is available here. Now you can
add your own.
Click the “Import” button.
5 Browse to the PKCS#12-
format certicate le and
open it.
6 A window appears asking you
to conrm where to store the
certicate.
You will be prompted for the location of the PKCS#12-
format certicate le (le extension will be .p12 in UNIX/
Linux, .pfx in Windows).
Choose “IronKey PKCS#11”
PAGE 24IRONKEY ENTERPRISE USER GUIDE
# Step Description
7 Enter the password that
was used to protect the
certicate.
If no password was used,
simply leave the text eld
blank.
8 Your certicate is now stored
securely in the IronKey
Cryptochip and is available
for use in the onboard Mozilla
Firefox.
USING MY.IRONKEY.COM (WINDOWS AND MAC)
NOTE: Depending on how your System Administrator has congured your IronKey, you might not have
an online IronKey account, and this section might not apply to you.
Your IronKey supports advanced cryptographic authentication using strong PKI key pairs
generated in the IronKey Cryptochip. When you log into my.ironkey.com from your device, it
uses these unique keys as your digital identity credentials. This locks down your account so that
you must have both your IronKey and your password in order to gain access. In other words,
only you can access your online IronKey account, even if someone stole your IronKey or your
password.
# Step Description
1 Securely logging into your account
If enabled, you can securely log into your
my.ironkey.com by clicking the “my.ironkey.com”
button in the IronKey Control Panel. This will
initiate a complex PKI handshake, thus logging you
in with strong, multi-factor authentication.
If you ever lose your IronKey, you can log into
Safe Mode by going to https://my.ironkey.com,
logging in the account credentials you created
when you activated your account. This will allow
you to mark an IronKey as lost or recover a
forgotten device password. This depends on how
your System Administrator has congured your
IronKey. Ask your System Administrator for
information.
PAGE 25IRONKEY ENTERPRISE USER GUIDE
# Step Description
2 Marking IronKeys as lost
If you ever lose your IronKey, you can rest
assured that no one will ever get your data. As an
additional precaution, you can mark an IronKey as
lost from within my.ironkey.com, which will prevent
that device from ever accessing your account. If
you nd your IronKey later, you can also mark it
as found again.
3 Recovering device passwords
People sometimes forget passwords. IronKey
gives you the option to back up your device
password to your Online Security Vault at
my.ironkey.com. That way, you can log into Safe
Mode or with another IronKey and recover the
password, or have your System Administrator
email you help.
4 Deleting your Identity Manager backup
data
If you want to delete your encrypted Identity
Manager data that you backed up to your Online
Security Vault, simply click the “Delete Identity
Manager Data” button.
5 Monitoring account activities
The Account Dashboard shows you the recent
activities on your account, such as logins, failed
password attempts, and when your device
password has been recovered.
6 Enabling Account Alerts for real-time
account monitoring
You can enable a number of Account Alerts for
additional insight into what activities are occurring
on your my.ironkey.com account. An email will be
sent to you with details on the security event,
such as the time and IP address of the event.
7 Changing account credentials
All emails regarding your account will have part
of your Secret Phrase in the subject line for
additional anti-phishing protection.
You can change your password, Secret Questions,
Secret Image and Phrase, as well as your email
addresses from within my.ironkey.com as often as
you want to ensure that no one else can access
your account. You can also specify time zone and
select time and date formats to congure time
zone settings.
Creating a secondary email address gives you a
fail-safe in case your primary email address is no
longer available.
PAGE 26IRONKEY ENTERPRISE USER GUIDE
In the event that you ever lose your IronKey or forget your IronKey device password, you can
still access the site in Safe Mode, a restricted mode with limited functionality. This is useful for
marking your IronKey as lost, or recovering a forgotten password.
# Step Description
1 Go to https://my.ironkey.com Here you can log into Safe Mode without your
IronKey.
2 Enter your email address (or
username) and your online account
Your Secret Image appears so that you know you
are at the correct site.
password. Click “Submit”.
Do not enter your device password in this
screen. If you have forgotten your online account
password, click the “Reset Password” link.
3 An email is sent to you with a Login
Code.
Copy and paste that login code into the page that
asks for it.
Depending on the conguration of your account,
you might need to answer your Secret Questions.
4 You are now logged into Safe Mode. If you had forgotten your device password and
have backed it up to your Online Security Vault,
you can recover it now.
USING YOUR IRONKEY IN READ-ONLY MODE (WINDOWS, MAC, LINUX)
You can unlock your IronKey in a read-only state such that les on your IronKey cannot be
edited. An example of when this is useful is when you want to access a le on your IronKey
while using an untrusted or unknown computer. If you unlock your IronKey in Read-Only
Mode, you need not fear that malware on that machine can infect your IronKey or modify your
les.
When you unlock your IronKey in Read-Only Mode, you will remain in Read-Only Mode until
you lock your IronKey.
Note that some features are not available in Read-Only Mode because they require modifying
les on your IronKey. Examples of unavailable features include the onboard Firefox,
reformatting, updating and restoring applications and les to your IronKey, and using the
Applications List.
PAGE 27IRONKEY ENTERPRISE USER GUIDE
On Windows and Mac OS X Computers:
# Step Description
1 When unlocking your IronKey, select
the “Unlock IronKey in Read-Only
Mode” checkbox.
2 You will see a message in the IronKey
Control Panel that conrms you are in
Read-Only Mode.
On Linux Computers:
# Step Description
1 To unlock your IronKey in Read-Only
Mode on Linux, use:
2 To return to a normal state where you
can edit les again, lock your IronKey
USING THE IRONKEY MALWARE SCANNER (WINDOWS
ONLY)
Normal ash drives can inadvertently spread malware from one
computer to another. Your IronKey, however, includes built-in antimalware features, including:
ironkey --read-only
ironkey --lock
» A read-only virtual CD from which the most important IronKey les
run
» Autorun protection from worms and viruses that spread just by plugging in a USB drive
» A Read-Only Mode for the IronKey Secure Drive
» Cryptographic operations in IronKey hardware completely protected from malware
» And, if enabled by your System Administrator, the IronKey Malware Scanner.
PAGE 28IRONKEY ENTERPRISE USER GUIDE
The IronKey Malware Scanner is a self-cleaning technology that helps keep your IronKey
secure by detecting and removing malware that gets on your IronKey from an infected le or
machine. It is powered by the McAfee® Anti-Virus and Anti-Malware signature database, which
is constantly updated to combat the latest malware threats. It works by rst checking for the
latest updates, scanning your IronKey, and reporting and cleaning any malware that is found.
Keeping your IronKey Malware Scanner Up to Date
It is important to keep your IronKey Malware Scanner up to date to protect against the latest
malware threats. As long as you have an Internet connection, the IronKey Malware Scanner will
update itself before each scan. The date it was last updated is displayed onscreen.
Your rst update might take a long time to download, depending on your Internet connection. If
your IronKey Malware Scanner becomes too far out of date, it will need to download a large le
to bring it back up to date.
# Step Description
1 If enabled, the IronKey Malware
Scanner runs automatically when you
The IronKey Malware Scanner is a feature that is
congured by your System Administrator.
unlock your IronKey.
You can bring the IronKey Malware
Scanner to the foreground at any time
by clicking on the IronKey Malware
Scanner system tray icon.
2 The IronKey Malware Scanner will
automatically check for updates.
This is an important step in ensuring
your are protect from the latest
malware threats.
3 The IronKey Malware Scanner will
automatically scan your IronKey,
including onboard les (compressed
and uncompressed les) and any
running system processes.
4 The IronKey Malware Scanner will
report and clean any malware that is
found.
Checking for updates requires an Internet
connection. Make sure there is at least 135 MB of
free space on your IronKey for downloading and
storing the latest malware signature les.
Your rst update might take a long time
to download, depending on your Internet
connection.
A window opens in the background that shows
you the scanning progress.
NOTE: The IronKey Malware Scanner does not
scan your IronKey when in Read-Only Mode.
If an infection is found, the le will automatically
be clean. A window will also appear with a report
of the event.
PAGE 29IRONKEY ENTERPRISE USER GUIDE
Product Specications
For details about your device, see “About IronKey” in IronKey Control Panel Settings.
CAPACITY*
Up to 32GB, depending on the model
DIMENSIONS
75mm X 19mm X 9mm
WEIGHT
0.8 oz
WATERPROOF
MIL-STD-810F
OPERATING TEMPERATURE
0C, 70C
OPERATING SHOCK
16G rms
ENCRYPTION
Hardware: 256-bit AES (Models S200, D200), 128-bit AES (Model S100)
Hashing: 256-bit SHA
PKI: 2048-bit RSA
FIPS CERTIFICATIONS
See www.ironkey.com for details.
HARDWARE
USB 2.0 (High-Speed) port recommended, USB 1.1
OS COMPATIBILITY
Windows 2000 (SP4), XP (SP2+), Vista, or 7
IronKey Unlocker for Linux (2.6+, x86)
IronKey Unlocker for Mac (10.4+, Intel)
Designed and Assembled in the U.S.A.
IronKey devices do not require any
software or drivers to be installed.
* Advertised capacity is approximate and not all of it will be available for storage. Some space is required for onboard software.
PAGE 30IRONKEY ENTERPRISE USER GUIDE
What’s next?
In many ways, that’s up to you. We are focused on building not only the
world’s most secure ash drive, but also enabling technologies that are
simple and enjoyable to use. Your feedback really matters to us, and we
carefully review all feature requests and customer feedback for prioritization of our next great features and products.
Have a cool idea or suggestion? Please let us know. You can open a
thread on the IronKey Forum (forum.ironkey.com) or submit feedback to
feedback@ironkey.com. Let us know if you would like to be a beta tester
of new functionality.
Where can I go for more info?
We are endeavoring to be very open about the security architecture and
technology that we use in designing and building the IronKey devices and
online services. A great deal of information can be found online on our
websites:
forum.ironkey.com User forum with thousands of “IronKeyologists”
www.ironkey.com General information
support.ironkey.com Customer support information and video tutorials
Who is the IronKey Team?
The IronKey Team consists of security, fraud, cryptography, user experience and design experts dedicated to building real security products that
are secure, simple, and enjoyable to use. IronKey CEO Dave Jevans is also
the chairman of the Anti-Phishing Working Group (www.antiphishing.org).
We have spent years and millions of dollars of research and development
to create the IronKey. Simple, accessible, and of great value, now you can
carry the world’s most secure ash drive to protect your digital life online
and on-the-go.
PAGE 31IRONKEY ENTERPRISE USER GUIDE
Contact Information
Product Feedback Feature Requests
feedback@ironkey.com featurerequest@ironkey.com
IronKey Online Support
https://my.ironkey.com For support, please contact your
https://support.ironkey.com Helpdesk or System Admin
https://forum.ironkey.com
Note: IronKey is not liable for technical or editorial errors and/or omissions contained herein; nor for incidental or consequential damages resulting from the furnishing or use of this material. The information provided
herein is subject to change without notice.
The information contained in this document represents the current view of IronKey on the issue discussed as of the date of publication. IronKey cannot guarantee the accuracy of any information presented after the date of publication. This document is for information purposes only. IronKey makes
no warranties, expressed or implied, in this document. IronKey and the IronKey logo are trademarks of IronKey, Inc. in the United States and other
countries. All other trademarks are the properties of their respective owners. © 2010 IronKey, Inc. All rights reserved. IK0900195
PAGE 32IRONKEY ENTERPRISE USER GUIDE
Loading...