Google encryption fills holes in Lion Server encryption

Last week Google said Apple's Lion Server disk encryption isn't good enough for enterprise and provided its own open source add-on. Google released Cauliflower Vest, an open source tool specifically for automating the enabling of FileVault 2 encryption in enterprise settings for Lion Server and its clients. At its open source blog, Google described why Lion Server's disk encryption inadequate for enterprise:

While the new FileVault 2 offering is very well suited to consumers, some enterprises may equire additional features that are not provided out of the box. For example, FileVault 2 encryption is initiated voluntarily by users, lacks enforcement, and, by default, escrows recovery keys to Apple's central server. It also relies on individual Apple IDs, which cannot be managed as a group.

Cauliflower Vest addresses these issues by providing three functions to Lion Server administrators:

• Forcefully enable FileVault 2 encryption
• Automatically escrow recovery keys to a secure Google App Engine server
• Delegate secure access to recovery keys so that volumes may be unlocked or reverted

This first release of Cauliflower Vest includes an escrow service, a GUI client, and a web-based management portal. Google said that it's own employees are currently using Cauliflower Vest.