Encryption of school data

[Sylv3r]

I got another sales flier through the post for a product called deviceshield which appears to encrypts data transferred to a memory pen etc.

 

It has a quote from Becta

 

"... if your school does not have encryption now, you should stop all copying, removing or accessing protected data until you have software to encrypt files and protect the communication links accessing this data."

 

The question is how many schools are encrypting data leaving school on teachers memory pens etc as we certainly are not. We have the SIMS webparts and have the necessary SSL certificate installed etc, but nothing locally is on our network to prevent this.

 

Is this a realistic demand from Becta - when is the deadline to have this in place - now?

[pooley]

We use truecrypt to encrypt all usb pens that are used within school. We are about to start encrypting laptops that will be used off site.

[DrPerceptron]

Last I read on it, BECTA's stuff were just good practice guidelines...

 

I'd raise the question, if they have all the sims web parts... why do they need to take confidential info on a memory stick? (I've never seen the SLG let alone used it!)

[GrumbleDook]

Last I read on it, BECTA's stuff were just good practice guidelines...

 

Yes, to help you fit into the way the ICO wants you to use and control data based on the latest interpretation of the law. It's like this ... if you do it then you aren't likely to get into trouble ... if you don't do it and something goes wrong you haven't covered yourself or the school. If you get told not to do it by someone further up due to time / staffing / costs then get it in writing and cover yourself.

 

Technology is not the only part of the solution on this ... educating staff is just as important.

[MatthewL]

We are just in the process of rolling out Safeboot to all our laptops then it will be desktops. Seems to be a decent package and does the job for what we need.

[Butuz]

Joy - we have to jump though hoops and spend £throusands to encrypt a few word documents containing little or no personal data that teachers may take off site - and all because the govmt' seem to have been intent on sending CD's full of our personal, private data through the postal service????

 

Anvil to crack a nut anyone?

 

Butuz

[russdev]

You don't need to spend loads of money on this technology is only part of the answer main thing is time..

 

Also lot of LAs will mandate that you follow the guidance. In Leicestershire the financial audit team who have far reaching powers will be checking you are following the guidance.

 

Russ

[CyberNerd]

You don't need to spend £10000 on this technology is only part of the answer..

I'm sure Capita are rushing to produce a security module to comply with becta's data handling requirements, and one way or another they will be passing the costs onto us.

 

but for now Becta recommend truecrypt which will encrypt entire USB drives, or laptop hard drives. It's really easy to set up and becta even provide documentation:

Truecrypt is opensource

 

TrueCrypt - Free Open-Source On-The-Fly Disk Encryption Software for Windows Vista/XP, Mac OS X and Linux

Becta Schools - Leadership and Management - Security - Data handling security guidance for schools

[Nozza]

Truecrypt is an excellent, stable product. I use a portable version on my USB to encrypt the data on it so I can access it from any PC. It's perfect for laptops too. Set up right it's as simple as typing in a password after you've booted up and an encrypted drive is mounted. You can save to it, back up to/from it, even defrag it.

 

I think it's worth encrypting USB sticks since it's very hard to erase data from them. Even most commercial "evidence eraser" packages don't wipe data from USB sticks properly due to the level-wearing system they tend to use. So sensitive data can stay on them for ages.

[Butuz]

Ok we learn something new every day that is what I like about this job!

 

One question? As standard .exe files can not be run from USB memory sticks as standard - does this mean the encrypted memory sticks will not work?

 

Cheers

 

Butuz

[Nozza]

You can set it up in different ways. I only have the portable TC executables on the stick itself because non many of the PCs I work on have it so I want to be able to access my data where I like. My admin rights allow me to run exe's from sticks OK.

 

The standard way of using TC is to install it on your machine and then store either a "file container" or partition (or an entire device) on the device you wish the data to be held - be that the HD of the PC or a removable memory device. You then point TC at the file/partition/device and tell it to mount it.

 

Does that actually answer your Q?

[WithoutMotive]

Someone asked me what good is it when whoever steals a USB drive can just delete the container file... I proceeded to tell them that the encryption process was to prevent access to the information, not to prevent it being deleted. Some people get a bit confused.

[plexer]

One question? As standard .exe files can not be run from USB memory sticks as standard - does this mean the encrypted memory sticks will not work?

 

As standard on what? I presume you are running a CC3 network?

 

Ben

[mortstar]

I got another sales flier through the post for a product called deviceshield which appears to encrypts data transferred to a memory pen etc.

 

It has a quote from Becta

 

"... if your school does not have encryption now, you should stop all copying, removing or accessing protected data until you have software to encrypt files and protect the communication links accessing this data."

 

The question is how many schools are encrypting data leaving school on teachers memory pens etc as we certainly are not. We have the SIMS webparts and have the necessary SSL certificate installed etc, but nothing locally is on our network to prevent this.

 

Is this a realistic demand from Becta - when is the deadline to have this in place - now?

 

A letter sent, form what apparently looks like the SSAT to all SSAT schools which is basically just pure marketing drivel. I think this is deplorable to be honest. They point the Heads at a Becta paper but not at the suggested Open Source solution, instead offering what I expect to be an overpriced piece of standard (read 'buggy as hell') educational piece of software.

 

"you should stop all copying, removing or accessing protected data until you have software to encrypt files"...I'll just get my magic wand out and sort that out before the end of term, yeah?

[pete]

We've been receiving fear-mongering software offers for a while now. Notice to any advertisers listening in: I will not buy from you if you engage in this behaviour - FUD is not welcome.

[Jobos]

We use truecrypt to encrypt all usb pens that are used within school. We are about to start encrypting laptops that will be used off site.

 

How are schools choosing passwords when encrypting laptop hd’s? Is it all laptops use the same password or do you let the laptop owner choose their own password?

[Nozza]

One problem I've found with TrueCrypt in within our particular setup appears to be related to roaming profiles.

 

One feature of TC is the ability to set Favorites. This allows you to have TC try to mount favorite file containers. This means the user doesn't have to find the container/partition manually. This works fine except on our laptops when not connected to the domain. It appears that TC stores it's favorite information in Documents & Settings and cannot find the info it needs when offline. Since the main reason for using TC is to encrypt data being transported away from the network, this is pretty annoying.

 

Has anyone else come across this and solved it?

[Nozza]

As I understand it, the password relates to the volume header and you can make header backups. This means you can have more than one password, as long as you have the corresponding header.

 

This is what they say "After you create a volume, back up its header to a file (select Tools -> Backup Volume Header) before you allow a non-admin user to use the volume. Note that the volume header (which is encrypted with a header key derived from a password/keyfile) contains the master key with which the volume is encrypted. Then ask the user to choose a password, and set it for him/her (Volumes -> Change Volume Password); or generate a user keyfile for him/her. Then you can allow the user to use the volume and to change the password/keyfiles without your assistance/permission. In case he/she forgets his/her password or loses his/her keyfile, you can "reset" the volume password/keyfiles to your original admin password/keyfiles by restoring the volume header from the backup file (Tools -> Restore Volume Header)."

[Jobos]

After testing TC I find that there can only be one password in use at a time. When the hard drive is encrypted a backup of the header is made which will allow the original password to be reinstated if a user has subsequently change it.

 

So in a nutshell, regardless of what the current password is the HD can be ‘unlocked’ as long as you have the original password and the backup CD that was made at the time the HD was encrypted.

 

After a practice run on a spare laptop TC seems straight forward to use and we plan to encrypt all staff laptops before the report session starts this year.

[Gerry]

We use CompuSec for laptop encryption. It's free and does what it says on the tin. Make sure you disable it's "Single Sign-On" feature though, as this can remember your domain account log-in which can cause user confusion with password expiry policies. You can set a master password, and the password screen users see immediately after switching on can be customised.

 

As for USB sticks, I think we're going for Kingston's Enterprise DataTraveller sticks, supposedly for ease-of-use, but I haven't played with one yet so don't know if it's any good.

[bandgeekmafia78]

Our school has also been advised to use TrueCrypt. Does anyone have guidelines on how to use this product?

[Jobos]

Our school has also been advised to use TrueCrypt. Does anyone have guidelines on how to use this product?

 

See here http://schools.becta.org.uk/upload-dir/downloads/data_encryption.pdf

[dalsoth]

With regards to TrueCrypt and full laptop hard disk encryption, could we encrypt each hard disk using the same password and use a single rescue cd or is the rescue cd going to need creating for every laptop?

 

We have nearly 100 laptops and i don't really want to have to store all of the cd's for them.

 

Any tips would be appreciated as we are looking at implementing this if we can make it work for us.

 

One other thing to ask on the topic. Do you guys have a policy that staff do not use any memory sticks other than those supplied by the school? How do you enforce this? I don't like to mess about with staff owned equipment as i will not take responsibility for any damage.

 

Do any of you use any products that prevent usb from being used or restricted to those allowed? Is that even doable?

 

Thanks for the info in this thread so far, has been useful

[Jobos]

With regards to TrueCrypt and full laptop hard disk encryption, could we encrypt each hard disk using the same password and use a single rescue cd or is the rescue cd going to need creating for every laptop?

 

Each laptop will need its own cd even if the laptop is encrypted with the same password.

[CSTL]

With regards to TrueCrypt and full laptop hard disk encryption, could we encrypt each hard disk using the same password and use a single rescue cd or is the rescue cd going to need creating for every laptop?

 

We have nearly 100 laptops and i don't really want to have to store all of the cd's for them.

 

Any tips would be appreciated as we are looking at implementing this if we can make it work for us.

 

One other thing to ask on the topic. Do you guys have a policy that staff do not use any memory sticks other than those supplied by the school? How do you enforce this? I don't like to mess about with staff owned equipment as i will not take responsibility for any damage.

 

Do any of you use any products that prevent usb from being used or restricted to those allowed? Is that even doable?

 

Thanks for the info in this thread so far, has been useful

 

I must admit that I am not familiar with TrueCrypt but my company deals with a number of Encryption vendors and most of them are able to distinguish between particular device models. ie, you can restrict use to one particular model of USB stick.

 

The big players in the encryption market are (in no particular order);

Sophos (formerly utimaco)

Symantec

Mcaffe (formerly safeboot)

PGP

Becrypt

Checkpoint

Lumension