Encrypted share that only two members of staff can access? (and admin can't)

[Cazale]

One of our schools has been told they need move sensitive safeguarding data over to an encrypted share, that nobody apart from safeguarding staff can access (i.e. no administrator or IT access, just two named non-technical staff).

 

I have to be honest, it's making me a bit nervous. I'm worried about being asked to make changes that I can't reverse (from the point of view that I'm responsible for data integrity for something I have no control over). Not to mention the headache of ensuring backups are present and correct (and how to even achieve that).

 

Has anyone else done this, or been asked to do this? How have/would you achieve it? Does anyone else think making this short of change is a bad idea from a technical viewpoint?

 

Not sure how relevant this is, but this is an external school (i.e. I'm not a direct employee of the school, we contract to them). None of our other schools have requested this.

Edited November 20, 2017 by Cazale

[3s-gtech]

Secure and with appropriate permissions, but not sure that encrypted is what they actually want (though someone has probably thrown the term around). Would be worth throwing that back at them - NTFS is pretty good at this, and an encrypted share would only be necessary if there's a risk of physical access being gained to the server or storage. Otherwise, it may be worth looking at ensuring that all of your storage is encrypted, which makes these requests much easier (and is much more feasible with modern CPUs and storage).

[GrumbleDook]

Encryption solves everything though!!!

 

I’ll get my coat

[enjay]

Backup process is the thing which sticks for me with this - if you can't view the folder, you can't back it up. Volume Shadow Copy might be an acceptable middle ground for that, as the users could self-restore their files, as long as they spotted quick enough. They would need a DR strategy though - if your backups don't include it, how would they restore the data in the event of a fatal disk failure?

 

How about they password-protect the files? That way, they can access them, you can't, but you can still back them up.

 

Alternatively, buy them a couple of encrypted/passcode-protected memory sticks, and suggest they use those.

 

Do they really want it encrypted even on the server? Encryption is only relevant if physical access to the disk were a risk, and that won't be the case.

 

It smacks a bit of trust, though - as IT admins, we have access to lots of sensitive data but we don't look at it unless specifically directed by the user. I can view everything in the HT's docs and email, but there is the expectation and trust that I won't. Plus there is policy telling me not to, so there is the threat/likelihood the school would be able to take disciplinary action against me if I did.

[jmak]

It smacks a bit of trust, though - as IT admins, we have access to lots of sensitive data but we don't look at it unless specifically directed by the user. I can view everything in the HT's docs and email, but there is the expectation and trust that I won't. Plus there is policy telling me not to, so there is the threat/likelihood the school would be able to take disciplinary action against me if I did.

 

This is the bit that the people sending the edict need to understand. It's trivially easy for the domain admin to access any data. They have to be trusted not to.

[synaesthesia]

As above, domain admin by nature would have access to the vast majority of these areas. A few possibilities to add to standard NTFS permissions:

Document passwords within Excel, Word etc

Onedrive/Google Drive

[AlanD]

I am very nervous when users start asking me about encryption...as when they mess up .... and sooner or later they will...I will be expected to magically unencrypt them. I always prefer to use "user" permissions - and remove administrator access (which can be added back of course...

 

Our deputy head managed to encrypt a whole portable drive...with her life's work on it....(despite our policies of no removable storage). It said to see their "system administrator" when it couldn't be accessed...and I had to point out that it was the system administrator of her home computer that was required - not the school system administrator.

[Katy]

Depending on the backup software you *should* be able to back up files you don't have permission to access if you are a member of the Backup Operators group (there's a switch when using robocopy which retries access denied files in backup mode to bypass permissions).

 

However it doesn't matter what you set the NTFS permissions to, there is no way to prevent an administrator from taking ownership of any file/folder (even when they don't have permissions) and then resetting permissions to gain access.

 

We have a SLT share which is similar (but not encrypted), I don't have permission to access it using my everyday use logon but I can get at it as a domain admin as there's always times you need to get into it ("Can you add this person to the permissions but read only", "I tried to copy this folder and it deleted itself" etc)

[3s-gtech]

If the school doesn't trust the system administrator with this stuff, they've got much bigger problems. It's got to be external encrypted drive, or you having the ability to get into it. Madness otherwise.

[elsiegee40]

I had a similar request for our Bursar and Head to have such an area.

 

Encryption turned out to be unnecessary. What they wanted was an area that was shared by them but not accessible to others.

 

I only used my Domain Admin login if I had to (there was as only me and I didn’t want to make mistakes) and day to day used a standard staff privilege login remoting in with Domain Admin if necessary.

 

So in our Office-Shared drive which was accessible only by the Admin staff, I set up a Bursar-Head-Private folder and set the permissions so only they could read and write to it.

 

I showed them that I couldn’t get into it logged in as me. And got the secretary to demonstrate that neither could she.

 

I explained that backups required access and they used the highest level of privilege.

 

They understood that in theory everywhere was accessible to me, but as with delving through home drives, it was only ever something I was going to do with written permission from them and, frankly, I didn’t have time to idly browse any of it out of nosiness.

 

And so that’s how it was done. Encryption is a buzzword at the moment. A careful working through with them of what they need can avoid unnecessary and risky complication.

[free780]

I'd almost say share point site where IT don't have permission. There'll be an audit trial if someone does access it.

[elsiegee40]

Very true, my example was set up before cloud storage became a thing.

 

If you use Office 365 or Google Apps, show the interested parties how to share a folder with named individuals in the school.

 

It’s off the network... no encryption or backup worries

[dapaulio]

If the school doesn't trust the system administrator with this stuff, they've got much bigger problems. It's got to be external encrypted drive, or you having the ability to get into it. Madness otherwise.

 

I agree. The point being if they want to choose to remove all access to everyone but safeguarding staff then They would have to store the data offsite away from your network to guarantee them that no one else but themselves have access. An admin has potential access to all data everywhere on the network.

If I were to even entertain the idea I would probably suggest that they buy a standalone o365 account (or other cloud based solution) each and share the data between the members. Obviously they are not allowed to have a shared account. They are essentially wanting to be domain admins of there own mini network. I would also stress that this choice means that they are responsible for that data and ensuring all policies by the school are enforced.

They would have to ensure amongst other things that data is backed up, strong passwords are implemented. Also Who is responsible for password recovery. Also who is responsible if there is a change in staffing.

I bet if they knew how much work and the responsibility required to facilitate excluding everyone including ict from their little club this I’m sure they would come to the conclusion that they haven’t got the shoulders to play god and that it is easier and less work for themselves to just trust you.

[DGardiner]

One of our schools has been told they need move sensitive safeguarding data over to an encrypted share, that nobody apart from safeguarding staff can access (i.e. no administrator or IT access, just two named non-technical staff).

 

I have to be honest, it's making me a bit nervous. I'm worried about being asked to make changes that I can't reverse (from the point of view that I'm responsible for data integrity for something I have no control over). Not to mention the headache of ensuring backups are present and correct (and how to even achieve that).

 

Has anyone else done this, or been asked to do this? How have/would you achieve it? Does anyone else think making this short of change is a bad idea from a technical viewpoint?

 

Not sure how relevant this is, but this is an external school (i.e. I'm not a direct employee of the school, we contract to them). None of our other schools have requested this.

 

if they want it out of your hands completely, make them buy cpoms or some similar service. but otherwise, an NTFS share with the right permissions is enough imo.

[chazzy2501]

NTFS to limit access to the folders and then they can password protect office documents that will encrypt them. This should check enough boxes.

[dapaulio]

NTFS to limit access to the folders and then they can password protect office documents that will encrypt them. This should check enough boxes.

 

I agree with what been mentioned however I would stress if they are to set a password on the document and they lock themselves out of the file they are likely to lose the data for good.

 

Well there is a way but I have had mixed outcome when attempting to so don’t advertise it to avoid false hope

[GrumbleDook]

To be honest, it is not really about whether people can access ... it is about whether there is a log of who did access it, and if anyone can edit those logs to hide things.

 

It is Risk Management ... and you have to take into account the likelihood (probability) of such action occurring, put in a mitigation plan and try to reduce the risk ... but at times you just have to accept it but put in place audits to spot check that people are following procedures.

 

This is not new ... it applies to Food Hygeine, H&S, etc.

[mavhc]

https://technet.microsoft.com/en-us/library/bb457007.aspx

 

Add the 2 users to their encrypted folder, export the recovery key to a usb stick, lock usb stick in safe inside tamperproof envelope.