The Bagala Editor (formerly PolicyAgent) gives the system administrator control over most user-configurable settings within SecretAgent^® and SpyProof!, ensuring that program usage conforms to a specific organizational security policy. Default settings for nearly all user interface elements and all functional aspects of the two programs may be specified and (optionally) locked against modification by the end-user. Bagala also provides control over SecretAgent’s optional key recovery capability.

The Bagala Editor is now integrated into the ISC Security Console framework that ships with all Administrator Editions of SecretAgent 6.x and SpyProof! 6.x.

Bagala presents a series of configuration panels that let you specify your security policy settings. (You may also load an existing policy and reconfigure it.) The program then generates a digitally signed security policy file. Once installed on a system, the policy file acts by controlling the behavior of the SecretAgent, Certificate Explorer, and SpyProof! applications running on that system.

SecretAgent 5.x for Windows can be configured by Bagala to periodically poll a designated corporate server for (digitally signed) software updates and (digitally signed) security policy updates. This mechanism allows an enterprise to “push out” to their end-users software patches as well as updated policies (with, say, new trusted root certificates or new CRL distribution points) whenever the situation calls for it. Individual end-user machines need not be reconfigured individually and the update process is completely user-transparent.

†NOTE: Similar functionality is provided for the SecretAgent 5.x command line utilities on all supported platforms using an OS-protected configuration file. Contact ISC for further details or sample configuration files.

What You Can Control

Bagala provides administrative controls over:

• which tokens and precisely which combinations of algorithms can be used for encryption and key generation
• whether users can generate their own self-signed certificates and use the self-signed certificates of others as recipients
• CA-specified key type/size requirements and target e-mail address for PKCS#10 certificate request generation and transmission
• default RDN values, validity periods, and usage extensions for the generation of (self-signed) certificates and PKCS#10 certificate requests
• the list of trusted root certificates and whether CRL checking of all recipient and signer certificates is mandatory
• the output format and algorithm options available to the user in the Encrypt dialog
• whether users can cache the passwords for their private key files (with or without a timeout period)
• the configuration of organizational LDAP queries
• the cryptographic actions to be audited (controls the creation of entries in the event log)
• the URL to be opened when a user selects the “Support on the Web” help menu item
• the local key recovery policy (determines whether key recovery is mandatory and, if so, specifies the certificates of individual and “shared-secret” groups of Key Recovery Agents)