Please recommend best-practices documents for sharing encrypted data with non-technical end-users

Question

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations?

Our situation: we have some technical staff well versed in crypto, PKI, key use, and key management. And nontechnical staff who aren't.

We have mandates / requests to exchange encrypted data with end users. On the receipt side, we offer a public PGP key and can decrypt data locally in a secure environment. We encourage (but don't require) users to encrypt data sent to us.

This question arises on the sending side. Clients and regulatory environments vary (finance, energy, healthcare, services, government), as do end-user platforms (mostly PC, some Mac, some other).

I'm leaning toward two suggestions:

1. Client creates, as needed, a PGP keypair, and shares the public key with us. We encrypt data against that, send it by appropriate means, and they decrypt the data.
2. We use an appropriate, acceptable symmetric-key encryption tool (e.g.: WinZIP files) and share the password out-of-band.

Not having to generate all the relevant text would be a bonus.

What I've found are references which aren't particularly relevant because:

• They're very dated (1990s / early 2000s), technical PGP/GPG references.
• They're newer, but generally Linux/Ubuntu-specific references (use 'em, like 'em, but most of our users are elsewhere).
• They don't address the business-needs case, or importance of key management for PKI in language an end-user is likely to understand.

Answer 1

Edit: Misread your question. My original solution was how they can provide to you encrypted, you want how you can send them an encrypted file...

I would still say SFTP is an option; once its on their end, it should be their responsibility to secure it. If you server is secured, the ounous is on them once they get the file or they should be specifying what works for them. At the same time, if you made something really convenient that they could use you might be able to get one solution on your side.

You might try the PGP desktop suite which can create secure files and zips. If you really care about security, you won't use basic winzip passwords - you would still need to use key-pairs or exchange a symetics key. I would also recommend trying out truecrypt. You can do that with a password or with keypair. Since TrueCrypt can be run in "traveler" mode with out installation, you can preload it with the private keys they would need to open your files and send them your pre-loaded version (open source so its all good). They would just then need to mount the true crypt archive you sent them and they work with it just like its a disk. You could probably also setup a script on their end so they just drag a truecrypt container onto the batch file and it mounts it for them automatically with the keypair.

There might also be some self extracting encryption/packers out there where they just run the executable. Ultimately though, you can't control policy on a external entities systems and they will probably copy the files off elsewhere and it should be their responsibility to keep it secured once received (unless you have different contractual requirements).

---

Leaving original response for other who may pass by one day:

One thing you might try is SFTP. I am not sure if you need encryption at rest, but you can handle that using a script as files come in or have the server store files in a encrypted disk. You provide the end users with WinSCP (I assume anyone working on Linux is technical enough to do what you want), distribute the key, give them a username and password. You could probably write a one page document as well. This is the solution I usually recommend and have recommend to a client in the past who had to obtain lots of data files from their clients.

I find many organization use regular FTP, so SFTP seems similar; winscp or any even Filezilla are similar to a file system and have drag and drop. Each user can have a drop folder, etc; you can force key changes and password changes on an interval. The software on the user end is free.

You could also try to get them to buy or foot the bill for something like PGP desktop tools and have them make containers and email them to you...but they will probably still have the file unencrypted on their end so its not any real protection on the client end. You can manage security how you want once you receive the file.

Answer 2

I do it the way, that on two physically secure locations, I setup cloud servers with a HTTPS website which allows for file upload and download, and on the backend there is OpenSSL with public key store. Such service is not facing internet except for encrypted file-copy. There are also several other security layers on the machine, and security restrictions on users enforced with either SQL Security or LDAP.

The appliances are exchanging data only for the encrypted store, while the key is copied only once.

The server, or the account can be simply isolated for them, created on your, cloud or their server, and this helps you avoid most of the technical difficulties.

Basically the isolated storage is required, for which there is physical localtion, separate cloud server, isolated UNIX / Windows Account, isolated SQL Data, isolated filesystem via user, restricted network / firewall policy, user / group management.

At minimum you will require at least two servers, one which holds your private key you are using for encryption and the other which holds key for encryption done by customer.

By coping data one from another you exchange only encrypted data.

Alternatively, it is not difficult to build C# / Java multiplatform desktop app to deal with the key management and file upload / download (encrypted store synchronization).

Flash is multiplatform too, works directly with the web server and handles file uploads / downloads well - like iPlayer Desktop, the videos are also encrypted. It's AIR, and you can attach external tools like OpenSSL.

Now if you want it really fancy, and have thumbnails and so on, you need document browser, thumbnail generator and so on, so there is bigger number of files, but this is doable in 2-3 weeks including all Adobe and Office formats in use, the videos can be handled with ffmpeg and this metadata must be encrypted too.

Still you can find a similar app which does the same. The file synchronization could be simple as folder over SSH. If you require large file transfers, this can be even more useful, and if you use a serious cloud storage, you can fill terrabytes (even with this flash app, at 30-100MBps).

Answer 3

Honestly the best solution I have found is this. We set up one mail program to function normally. The other was completely configured to do encryption of email for the individual. They didn't have to know anything. Crypto is abstract. It's coated in tech (magic) and most people don't want to try to understand it if they don't have to. Instead of trying to force feed them blended chateau brion (sp?), find a way to do this function for them. Think automation. Provide a preconfigured live distro of linux that is nothing more than clicking icons. Scripting is your friend.