Installation and Configuration Manual

Introduction

Secude's HaloSHARE streamlines and secures your internal and external business operations by simplifying bulk file management with classification, labeling, encryption, and digital watermarking. HaloSHARE extends Microsoft Purview Information Protection (MPIP) to CAD, MS Office files, and non-office formats, such as text and PDF files stored in shared folders, encrypting sensitive data with customizable sensitivity labels that can be tracked, revoked, and set to expire.

What distinguishes HaloSHARE?

Digitization has improved supply chain efficiency but has also contributed to increased vulnerabilities. Sharing unprotected files with supply chain partners puts you at risk for various problems, including operational disruption and financial loss. In a multiuser scenario, when numerous users share access to a system or network, there are several potential file access and security risks. To secure your business operations from harmful attacks along the supply chain while not disturbing workflows, protect all shared project files by default.
HaloSHARE, a labeling solution, can effortlessly overcome the difficulty by automatically encrypting hundreds of sensitive files with a single drag-and-drop into a specified local folder (e.g., OneDrive or SharePoint) on a HaloSHARE-installed machine. Any file moved within the HaloSHARE radius (specified folder) is encrypted and protected against accidental file sharing and illegal access. As a result, this labeling solution protects your data within and outside your organization. Furthermore, HaloSHARE can watermark files while protecting them, allowing you to share and track project files without slowing down workflows.

Implementing this solution in your environment reduces the risk of a data breach and guarantees data protection regulations are always followed without the need for security personnel to perform any additional manual procedures.

About this Manual

This guide will walk you through the installation, configuration, and workflow of HaloSHARE.

Features

1. Supports the protection of bulk files in folders.

2. Supports label protection that is based on MPIP and custom permissions that are defined by the user.

3. Allows you to customize the protection for specific file types.

4. Support for removing protection easily and re-labeling protected files with an already existing label.

5. Provides bulk watermarking of sensitive information with visible and unique indications of who has been shared with the files and when (date stamped), offering enhanced security and ownership recognition customized for your needs.

6. Supports adding custom properties to improve file security and contextual awareness.

7. Signing the document in the background smoothly while maintaining the custom properties and watermark.

Feature Setup and Licensing Details

Feature set up

General FAQs

This section provides answers to the most frequently asked questions (FAQ). If you have any further inquiries, please get in touch with our sales representative or our support team.

1. What does HaloSHARE provide for an organization?
   This labeling solution protects your files and enforces security throughout their full life cycle.

2. Does it protect all native Computer-Aided Design (CAD) file types?
   Yes, HaloSHARE supports all CAD native file types.

3. What happens if an unauthorized person attempts to open a HaloSHARE-labeled file?
   At first, user authentication takes place. It is a process of verifying the identity of the user. If the user fails during the authentication, he/she will be prompted with an error message and access will be denied.

4. Who decides what labels should be used for various supplier folders and how it is managed in the background?
   In an organization, a MPIP administrator is responsible for creating and managing labels (user rights) in the Microsoft Purview portal. The choice of label can be made by engineers or designers who create drawings for a specific supplier.

5. What if I don't want a certain file type to be protected?
   HaloSHARE encrypts any file based on the extension specified in the configuration. As a result, you can whitelist file types to be encrypted and blacklist file types by not defining them in configuration.

6. Is it possible to apply custom permissions to protect a file?
   Yes, HaloSHARE allows users to apply custom permissions without using Azure labels.

7. How to open a protected CAD file?

   You can view a Protected CAD file using a HaloCAD Add-on for CAD applications.

8. How to open a protected PDF file?
   You can view a Protected PDF file using the Acrobat Reader DC / Acrobat DC application. Additionally, it can be viewed with the Microsoft Purview Information Protection unified labeling client.

9. Is there another way to protect a PDF file without MPIP labels?
   Yes, HaloSHARE adds a watermark on a PDF and signs it. Signing a PDF with a certificate makes it read-only for others, resulting in a protected PDF file.

10. How do I view the watermark on a CAD file?
    When a HaloSHARE-watermarked CAD file is shared with external partners, they can view it by installing the HaloCAD add-on for CAD applications.

Quick Start Installation Summary

The following image shows the high-level idea of setting up HaloSHARE.

Quick start implementation steps

Architecture

HaloSHARE is a service that runs on a Windows Server and communicates with the Microsoft Rights Management Service (RMS) to encrypt files in a specific folder using predefined MPIP labels or user-defined custom permissions. Through the HaloSHARE configuration screen, HaloSHARE users can map their suppliers and their associated folders.

HaloSHARE Protection

When unprotected sensitive files are added to the shared folder that HaloSHARE is constantly monitoring, they are screened, and the HaloSHARE Service communicates with the Microsoft Rights Management Service (RMS) to automatically encrypt the files using predefined MPIP labels or user-defined custom permissions.

HaloSHARE Watermark

When files are placed in the shared folder that HaloSHARE is constantly monitoring, they are automatically screened, watermarked (e.g., confidential), and signed with a digital certificate. As a result, the files are secure and cannot be edited by any user. These secured files will include metadata that has been set up by the administrator in the HaloSHARE service.

Architecture

At a high level, the HaloSHARE workflow consists of these steps:

Assume that in a corporate landscape, different teams produce and share files with designated folder names, such as "Supplier 1-Prestin Engineering" and "Supplier 2-United Engineering", in a locally shared folder on a HaloSHARE-installed machine. Additionally, HaloSHARE is configured to move files to a destination folder, as illustrated below.

Source and destination Folders

Based on the feature selection, the following process takes place:

HaloSHARE for protection: HaloSHARE scans the folder and subfolders for new files, determines whether to encrypt them and then applies the appropriate MPIP label or custom permission. The labeled files are transferred to the destination folders, usually a shared folder specific to your supplier. The destination folder can be a OneDrive\SharePoint directory. As a result, every supplier gets their destination folder for sharing business information.

HaloSHARE for watermark: HaloSHARE scans the folder and subfolders for new files. When a new file arrives, it is watermarked and signed with a digital certificate. The watermarked files are transferred to the destination folders, usually a shared folder specific to your supplier. The destination folder can be a OneDrive\SharePoint directory. As a result, every supplier gets their destination folder for sharing business information.

Third parties, including suppliers, vendors, and external consultants, can only access HaloSHARE-protected and watermarked files through the HaloCAD Add-on. Please refer to HaloCAD manuals for more information.

System Requirements

The following system requirements table specifies the minimum and recommended technical specifications, such as software and network resources, necessary to run the product.

Requirements

Recommended URLs, Addresses, and Ports for MPIP

MIP SDK doesn't support the use of authenticated proxies. So, make sure you set the Microsoft 365 service endpoints to bypass the proxy. View a list of endpoints at Microsoft Online Documentation. However, Microsoft recommends the following:

Recommended endpoints

Secude License Manager

To communicate with Secude License Manager, the following URL and port must be whitelisted in the customer's proxy:

Recommended license manager endpoint