Poor performance with Office files on SMB shares caused by Safeguard File Encryption

If you have File encryption going through a vpn to a remote location - there will be a performance hit.  

The way FE works is that its a filter. It will check every file access attempt. If the file is encrypted (it has the FE headers) the filter will then either decrypt for a read action or encrypt for a write action. The filter is always there, since it has to check every access even to unencrypted files because it doesn't know, before hand, which files are encrypted or not. 

Now that you have a VPN (which means other networking in between the client and the target file) you will have a multiplicative effect on the action times. 

Now, how can it be optimized? 

I would need more information about the network structure and the VPN solution used to give any sort of advice. 

However, the performance is never going to be exceptional - since FE is a per file bulk encryption action it does increase the size of the files involved. 

Hi,

the performance impact is only for MS Office files. All other files and programms open in a acceptable and reasonable time.

Do you have some technical details on the issues you are talking about?

What I can see is that in a tcp dump while openig a MS office file, it looks like the client computer is requesting the same SMB information again and again.

Btw: This is regardless of the server - it is completely caused by the client. We've tested this on different file servers, different Server OS and with or without Fileencryption installed.

And about our VPN setup - that's a normal XG SSL VPN I would say. The Fileserver's network is included in the VPN config but that network is not routed by the XG - this is internally routed by a core switch.

To see what we are talking about here:

The docx and xlsx formats are actually bundles of files all contained inside the docx. It looks like it is requesting the individual sub-elements for the encryption. 

Let me look into this and I will get back to you.

I have been talking with development about this and they confirmed that the FE filter doesn't treat docx formats differently than any other file type. 

also, they suggested that you implement Mitigation #3 in this article: https://support.sophos.com/support/s/article/KB-000038386?language=en_US

This should help.

They also suggested Mitigation #1 just in general.

I hope that helps.

Thanks! Wasn't aware of that KB. Nice to see that it got recent updates. Will check it out and keep this thread updated.

I think, the reason for our issue is:

first tests show moderate performance boost by applying #3 only:

Mitigation#3: If Microsoft Office files like docx, evtx, pptx, are opening slowly when located on a network share,  add Explorer.exe to the SpecialNetworkShareWriteApps registry key.

a high performance boost has been seen by applying #1 only:

Mitigation#1: Bypass Network locations that don´t have an encryption rule (requires SafeGuard version 8.20 or at least File Encryption Engine build 24). BypassFilesWithoutPolicyVolumes.reg.txt

will post some results here later.

I think, the reason for our issue is:

first tests show moderate performance boost by applying #3 only:

Mitigation#3: If Microsoft Office files like docx, evtx, pptx, are opening slowly when located on a network share,  add Explorer.exe to the SpecialNetworkShareWriteApps registry key.

a high performance boost has been seen by applying #1 only:

Mitigation#1: Bypass Network locations that don´t have an encryption rule (requires SafeGuard version 8.20 or at least File Encryption Engine build 24). BypassFilesWithoutPolicyVolumes.reg.txt

will post some results here later.

Here some results

so now with those settings enabled from my reading the disadvantage is, that there may be issues with file handling - I guess open file detection is not working properly this way so there is a risk of onening the same file by multiple people simultaneously. Correct me if I'm wrong.

Basically there isn't a lock & wait for the encryption filter. So, yes, there can be handling issues for writes. As far as I am aware, reads should be okay...