Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations?

Our situation: we have some technical staff well versed in crypto, PKI, key use, and key management. And nontechnical staff who aren't.

We have mandates / requests to exchange encrypted data with end users. On the receipt side, we offer a public PGP key and can decrypt data locally in a secure environment. We encourage (but don't require) users to encrypt data sent to us.

This question arises on the sending side. Clients and regulatory environments vary (finance, energy, healthcare, services, government), as do end-user platforms (mostly PC, some Mac, some other).

I'm leaning toward two suggestions:

  1. Client creates, as needed, a PGP keypair, and shares the public key with us. We encrypt data against that, send it by appropriate means, and they decrypt the data.
  2. We use an appropriate, acceptable symmetric-key encryption tool (e.g.: WinZIP files) and share the password out-of-band.

Not having to generate all the relevant text would be a bonus.

What I've found are references which aren't particularly relevant because:

  • They're very dated (1990s / early 2000s), technical PGP/GPG references.
  • They're newer, but generally Linux/Ubuntu-specific references (use 'em, like 'em, but most of our users are elsewhere).
  • They don't address the business-needs case, or importance of key management for PKI in language an end-user is likely to understand.
share|improve this question
    
This isn't getting much love here; I have an answer that I would give you, but it's probably not one suitable for what you want, so I'm going to shuffle this over to security.se to see if they can help you more. –  Mark Henderson Jul 25 '12 at 3:21
    
Thanks, Mark. Let's see if it does any better here. –  Dr. Edward Morbius Jul 25 '12 at 6:16
add comment

migrated from serverfault.com Jul 25 '12 at 3:21

This question came from our site for professional system and network administrators.

3 Answers

Edit: Misread your question. My original solution was how they can provide to you encrypted, you want how you can send them an encrypted file...

I would still say SFTP is an option; once its on their end, it should be their responsibility to secure it. If you server is secured, the ounous is on them once they get the file or they should be specifying what works for them. At the same time, if you made something really convenient that they could use you might be able to get one solution on your side.

You might try the PGP desktop suite which can create secure files and zips. If you really care about security, you won't use basic winzip passwords - you would still need to use key-pairs or exchange a symetics key. I would also recommend trying out truecrypt. You can do that with a password or with keypair. Since TrueCrypt can be run in "traveler" mode with out installation, you can preload it with the private keys they would need to open your files and send them your pre-loaded version (open source so its all good). They would just then need to mount the true crypt archive you sent them and they work with it just like its a disk. You could probably also setup a script on their end so they just drag a truecrypt container onto the batch file and it mounts it for them automatically with the keypair.

There might also be some self extracting encryption/packers out there where they just run the executable. Ultimately though, you can't control policy on a external entities systems and they will probably copy the files off elsewhere and it should be their responsibility to keep it secured once received (unless you have different contractual requirements).


Leaving original response for other who may pass by one day:

One thing you might try is SFTP. I am not sure if you need encryption at rest, but you can handle that using a script as files come in or have the server store files in a encrypted disk. You provide the end users with WinSCP (I assume anyone working on Linux is technical enough to do what you want), distribute the key, give them a username and password. You could probably write a one page document as well. This is the solution I usually recommend and have recommend to a client in the past who had to obtain lots of data files from their clients.

I find many organization use regular FTP, so SFTP seems similar; winscp or any even Filezilla are similar to a file system and have drag and drop. Each user can have a drop folder, etc; you can force key changes and password changes on an interval. The software on the user end is free.

You could also try to get them to buy or foot the bill for something like PGP desktop tools and have them make containers and email them to you...but they will probably still have the file unencrypted on their end so its not any real protection on the client end. You can manage security how you want once you receive the file.

share|improve this answer
    
I appreciate the answer. We can't count on the end-user setting up an FTP server. PGP Desktop (or equivalent tools) is what I'd consider feasible. I guess I'm mostly just really disappointed in the state of encryption, its acceptance, use, and understanding. :( –  Dr. Edward Morbius Jul 25 '12 at 6:15
    
The customer does not set up with FTP server. You host the SFTP and manage it. Your question indicates you have the ability to dictate the mechanism; if not, then you are necessarily forced to do what they want. You would setup the SFTP and provide them with home folders and the keys. Again, you can give them winscp client or filezilla preloaded with a profile if you want. –  Eric G Jul 25 '12 at 19:26
    
Right. And we actually do host an FTP service. There's still the matter of working out how to manage the encryption side. The two options mentioned (PGP/GPG, or symmetric encryption and out-of-band password disclosure) are pretty much what we're landing on. –  Dr. Edward Morbius Jul 25 '12 at 20:03
    
Most Secure? Mail then a disk with the client (client program) preconfigured. They just need a public key and a username/pass. I don't think you specifically need P/G-PG, the keypair generator for your ssh should make fine pairs that will just work with the the SFTP client. If your email is secured for both client and yourself, you might feel comfortable sending the key file and password that way, and force change on first login. Again, if your customers are not technie- send them the program with the profile already ready, they hit the login button. –  Eric G Jul 25 '12 at 20:39
add comment

Honestly the best solution I have found is this. We set up one mail program to function normally. The other was completely configured to do encryption of email for the individual. They didn't have to know anything. Crypto is abstract. It's coated in tech (magic) and most people don't want to try to understand it if they don't have to. Instead of trying to force feed them blended chateau brion (sp?), find a way to do this function for them. Think automation. Provide a preconfigured live distro of linux that is nothing more than clicking icons. Scripting is your friend.

share|improve this answer
add comment

I do it the way, that on two physically secure locations, I setup cloud servers with a HTTPS website which allows for file upload and download, and on the backend there is OpenSSL with public key store. Such service is not facing internet except for encrypted file-copy. There are also several other security layers on the machine, and security restrictions on users enforced with either SQL Security or LDAP.

The appliances are exchanging data only for the encrypted store, while the key is copied only once.

The server, or the account can be simply isolated for them, created on your, cloud or their server, and this helps you avoid most of the technical difficulties.

Basically the isolated storage is required, for which there is physical localtion, separate cloud server, isolated UNIX / Windows Account, isolated SQL Data, isolated filesystem via user, restricted network / firewall policy, user / group management.

At minimum you will require at least two servers, one which holds your private key you are using for encryption and the other which holds key for encryption done by customer.

By coping data one from another you exchange only encrypted data.

C# Desktop App

Alternatively, it is not difficult to build C# / Java multiplatform desktop app to deal with the key management and file upload / download (encrypted store synchronization).

Flash is multiplatform too, works directly with the web server and handles file uploads / downloads well - like iPlayer Desktop, the videos are also encrypted. It's AIR, and you can attach external tools like OpenSSL.

Now if you want it really fancy, and have thumbnails and so on, you need document browser, thumbnail generator and so on, so there is bigger number of files, but this is doable in 2-3 weeks including all Adobe and Office formats in use, the videos can be handled with ffmpeg and this metadata must be encrypted too.

Still you can find a similar app which does the same. The file synchronization could be simple as folder over SSH. If you require large file transfers, this can be even more useful, and if you use a serious cloud storage, you can fill terrabytes (even with this flash app, at 30-100MBps).

Multiplatform App

share|improve this answer
    
This could also be accomplished with SFTP and scheduling in cron, task scheduler, etc. If we are only talking about flow in one direction, you can easily share the public key as long as the private key is kept private. –  Eric G Jul 25 '12 at 19:29
    
Elegant. But ... too elegant. I'm looking for a KISS principle solution. –  Dr. Edward Morbius Jul 26 '12 at 17:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.