How Would You Prefer To Send Sensitive Data? 542
sprkltgr writes "Our HR department is implementing new software. The HR Director has tasked me with sending our data out of our network to the consultant that's loading it in to the new package. Obviously this data includes items such as SSN, name, birth date, etc. Upon being told that I would not email this data to her, the consultant asked what my security requirements were for sending the data. What would be on your wishlist for the best way to send sensitive data to someone outside your firewall?"
PGP (Score:5, Insightful)
Re:PGP (Score:5, Informative)
Re:PGP (Score:5, Informative)
Re:PGP (Score:4, Informative)
Re:PGP (Score:4, Funny)
Re:PGP -- step three revealed! (Score:3, Funny)
Re:PGP (Score:5, Informative)
It's amazing how many people make this mistake. NEVER implement an unauthenticated protocol, unless you can completely guard access to it -- and by that, I mean use it over pipelines, UNIX sockets, or in wrappers that include authentication.
Oh, and FTP sucks. I can't think of a good reason to use it at all, ever. Use Samba if it's convenient, otherwise things like scp/sftp, rsync, or actual database replication.
Re: (Score:3, Informative)
Re:PGP (Score:5, Interesting)
It only takes one compromised laptop in most networks to engage in quite a bit of useful packet sniffing of exactly this kind of traffic. Unless that VPN is between your desktopo and the VPN server itself, it's hazardous.
Re:PGP (Score:4, Informative)
That and email just is not a good way to send lots of data, it just isn't designed for it.
I'm more in favor of setting up a VPN....and using scp across it.
That will work better for what I guess has to be a good bit of bulk of data...and should be quite secure enough.
Re:PGP (Score:5, Informative)
hold it (Score:3, Informative)
You can use chroot as an additional security blanket, to protect against possible bugs in scp. But if you don't use chroot, that doesn't mean "your clients can go poking around the rest of your SCP server". Furthermore, there are many alternatives to chroot, including vserver and AppArmor.
chroot cages are built in
There are plenty of webdav i
Re:hold it (Score:4, Informative)
Re:PGP (Score:5, Interesting)
Really, what's wrong with just using IPSEC and ftp? ftp is canned crap by itself because of the stupid networking requirements (if you're already using TCP, there's no reason WHATSOEVER to open two connections, much less to do it how ftp does) and generally impossible to secure through rational means but is fine through VPN.
Of course, you have to make sure that your switch isn't vulnerable to a poisoning attack that will let a local attacker sniff that password, unless you do direct host to host ipsec, which is my recommendation anyway. Then the whole thing is pretty secure. ipsec is relatively easy to set up on windows with preshared keys (I never did get certs to work between HPUX and Windows which is where I tried it, but if I'd had a Windows 2003 domain server it supposedly would have been easy) and plenty easy to set up on most Unices.
Alternatively, just put a simple password on the thing, USPS the password to the guy via some kind of registered mail, and then courier the data, and do it physically. This is much more secure, provided your carrier is competent. (Read: NOT UPS, who not long ago delivered eight pounds of court documents to me at 9850 on one street, while it was addressed to 9580 on another street.
Re:PGP (Score:5, Insightful)
Not in the least. What guarantee do you have that there isn't an attacker already in your network, or the recipients network? Split into small chunks first. Encrypt with separate keys, then SCP over VPN.
NO! not PGP not SFTP. (Score:3, Insightful)
Make it very clear that this data can not be exposed. See some good posts:
http://ask.slashdot.org/comments.pl?sid=560624&cid=23500514 [slashdot.org]
http://ask.slashdot.org/comments.pl?sid=560624&cid=23500510 [slashdot.org]
http://ask.slashdot.org/com [slashdot.org]
Re:PGP (Score:5, Informative)
You do not want to use FTP at all. FTP is a very insecure protocol. If the data is very confidential, then you need to secure it against
Remember no encryption is so good that it can't be cracked, given sufficient compute power and sufficient time, and that the profits from identity fraud are now sufficient to make it worth criminal gangs while to put significant resource into cracking encryption.
So to send this data, in my opinion, you need to split it into chunks which are in themselves of low value (i.e. first file, names and employee numbers; in the second file, social security numbers and employee numbers; in the third file, addresses and employee numbers; in the fourth file, ages and social security numbers; and so on); encrypt these chunks using different encryption keys, so that decrypting one will not provide the key to encrypting the next; and send them over a secure channel.
The UK Government has had a series of scandals recently where couriered media (CD-ROM disks) with valuable personal information has gone missing, so couriering this is not a good plan. Criminal gangs are apparently now willing to pay about US$50 per person for identity details like these, so in terms of value for unit mass, a CD with these details is worth much more than diamonds.
Re:PGP (Score:4, Informative)
No practical encryption, that is. One-time pads are uncrackable. However, your statement is misleading -- for many types of encryption, "sufficient time" is longer than multiple human lifespans, even with access to a large amount of computing power. It's generally the non-encryption parts of a security system that fail.
Re:PGP (Score:5, Insightful)
Via encrypted signed email there's a paper trail. "The data you have is verifiably the data that I intended for you to receive, and the sensitive data haven't been mangled or modified (the hashes match), it is verifiably from me (that's my signature), and I have demonstrably met your request by sending you the information on this day at this time (email headers, server logs, whatever).
If it's important and it's for work purposes, COVER ASS AT ALL TIMES.
Re:PGP (Score:5, Interesting)
You've also got to remember that you only have control over the security of the data during transit. It's all you're legally responsible for and it's all you have any sort of effective control over. So you're really looking for the best solution based on the transmission type you choose. For anyone who wants to put all sorts of extra security on it remember the thing problem with copy protection you can't secure something and give people the access to view it at the same time, so if the recipient doesn't secure it properly in their system, no amount of PGP is going to help anyone.
If the data set is fairly small, then encrypted e-mail might be a valid solution. If it's small to middling in size or you need to do frequent transfers SFTP or FTPS would be viable(presuming you're not using keys generated in the last two years on a debian box).
The simplest solution would be to encrypt the data, put it on a CD/DVD/Portable HD, and send it by courier or deliver it yourself(ideally in a sealed envelope). You get a signature to verify you sent it, you get a signature to verify who picked it up, you've got proof it wasn't tampered with and if someone steals it along the way it's not worth anything.
If it were me I'd also ensure that your contract with the recipient includes liability for any security breaches within their system including appropriate financial penalties. Any of those solutions will ensure it gets to the recipient without someone else stealing it and that's all you can do.
DVD/hand carried (Score:3, Insightful)
Even if the CD is stolen, it's still encrypted--and armored trucks (especially ones carrying data) are rarely held up--a
Re:PGP (Score:5, Interesting)
Re: (Score:3, Insightful)
You are being awfully naive here. Personal details are worth about US$50 each to identity fraud gangs. 10,000 personal details times US$50 is half a million bucks, and that buys a lot of supercomputer time. Any encryption can be brute forced given enough brute force.
Re:PGP (Score:5, Interesting)
You keep saying that. Maybe you want to run the numbers sometime? Something like all the computing power in the world in constant use for X thousand years? Barring a fundamental flaw in the algorithm, or a botchy implementation (say generating your keys on Debian) there is no way this is brute forcable in anyones lifetime. It's just math. It's your random claim the russian maffia can break any encryption, versus math. I know whose side I am on.
Half a million bucks buys you a 56 bit DES message in under 24 hours. Note that an extra bit does not double the effort, it squares it. Do the math.
Re:PGP (Score:4, Insightful)
What?
An extra bit does double the keyspace.
Re: (Score:3, Informative)
What I meant is that every extra bit doubles the effort, i.e. going from 128 to 256 bits is not doubling the effort, it is squaring it.
Re: (Score:3, Insightful)
However, it is practical to have a large enough keyspace that "enough brute force" cannot be realistically achieved, even assuming machines millions of times faster than the fastest currently available.
Re:PGP (Score:5, Informative)
Affected keys include SSH keys, OpenVPN keys, DNSSEC keys, and key material for use in X.509 certificates and session keys used in SSL/TLS connections. Keys generated with GnuPG or GNUTLS are not affected, though.
Re:PGP (Score:5, Insightful)
Re: (Score:3, Insightful)
Burn to physical media.
Send via bonded courier.
Send password via encrypted email, or via registered mail.
If you need frequent access from both ends, set up extranet with encrypted vpn with reasonable security on both ends. The data at rest should be encrypted with strong encryption and the password should change frequently ( 90 days). Access to the password and to the storage folder should be restricted.
Yeah, all you alarmists worried about 'one compromised computer' are right, but t
Re: (Score:3, Insightful)
Would you perhaps have some real information to support those claims?
If they are cracking military grade encryption, which I very seriously doubt
Re:PGP (Score:5, Informative)
Yes, these people can and routinely do crack military grade encryption, if the data is valuable enough. This data is valuable enough.
Highly unlikely.
What they (the attackers) are probably doing is either:
1) Man in the Middle (MITM) attack where the source/destination players (Alice & BoB) don't properly authenticate their encryption keys. Which lets them read all of the traffic by pretending to be the other end of the stream to each player.
2) Attacking the weak point of any encryption system - key management. Either by keylogging to obtain the passphrase, or other rootkit / cracking work to steal the private keys. Which then allows them to decrypt the messages. Getting key management correct is HARD (the devil is in the details).
3) Suborning either Alice or Bob (i.e. bribery or social engineering). Or simply via the lead lined rubber hose attack.
There's an awful lot of very very smart people out there who are looking at the current algorithms in use (AES, RSA, etc). If there were known weaknesses in the algorithms, we would have heard about them. Something that is encrypted with today's 256bit symmetric encryption algorithms is extremely secure for the foreseeable future (40+ years?). At least, as long as the encryption key is not leaked through some other fashion.
Re:PGP (Score:5, Insightful)
Yes, these people can and routinely do crack military grade encryption, if the data is valuable enough. This data is valuable enough.
"military grade" is a pretty useless term here - the military uses all kind of encryption, from weak to very secure. But when talking about encryption suitable for "secret" stuff (i.e. classified secret), then you can be pretty sure the NSA is not going to allow any form of encryption which is known (to the NSA) to be breakable. Not breakable by any other (foreign) government agency with a multi-billion-dollar budget, and certainly not by the Russian mafia. And as a reminder, AES is a valid algorithm be used to protect secret communications and available to pretty much everyone.
To get your data, they would try to get the encryption keys by hacking the computer or by physically breaking into your house and office. They might even sneak backdoors in the software you are using and weaken the encryption artificially. But they will not bother with the encryption itself, unless you've been using weak encryption from the start.
Re: (Score:3, Insightful)
The math is simple, the amount of computing power to brute force PGP just doesn't exist on this planet yet. Maybe in a decade or two but then all we'd have to do is increase the bit length that PGP uses.
Re: (Score:3, Informative)
Then only the person who is allowed to see it can.
GPG? The Open Source Version of PGP (Score:5, Insightful)
If you are going to let it off-site, is there a contractual agreement regarding how the data will be protected? Are their security policies audited by a third party? Worst case, does your company's insurance cover financial losses due to a third party mishandling your data?
I'd provide them with dummy data in the proper format to simulate your company's data and do like Orange Crush suggests and put data and application together only on your own premises.
But if you can't/won't do that, I'd say encrypt the hell out of it and burn it to CD, and send it by registered courier where someone has to sign for it to acknowledge chain of custody. Send the key by an alternate method.
Do you know this company's security policies? Are there any kind of investigations/background checks performed on its employees? If it is a small shop, what kind of firewall protection do they use? Is some programmer's kid using his laptop to play games on the Internet and download "free" screen savers or ring tones?
I assume that your data is in there too. How would you want it handled and what would you consider doing legally to your company if the data was in any way mishandled and your information to find its way into some identity thief's possession or posted on the web? What if your identity were to be stolen and your accounts raided or your credit ruined?
I know this probably sounds fairly paranoid and I'm sure a lot of people might suggest easier and less secure approaches, but the reality is that this kind of data is a target and far too many people do not properly protect their business computer systems because they just don't realize how pervasive intrusions and spyware are.
How would you want your data handled?
Re:GPG? The Open Source Version of PGP (Score:5, Insightful)
These days a big issue is CYA when it comes to people's personal data. As others have noted, be sure to investigate any laws that might define how the data must be treated if it has to go off site. Be sure that your management signs off on the procedure and be sure you can document it.
The days of just letting people download data are long gone. And don't use FTP if you do. Use the secure version (sftp) and encrypt the data before it transfers. That way it's an encrypted tunnel carrying encrypted data. But I wouldn't recommend this method. I'd get a signed chain of custody with media physically delivered and assurances that all copies of the data is completely and securely destroyed and the original media returned when the job is finished.
Best way is not to let the data out in the first place.
Re:GPG? The Open Source Version of PGP (Score:5, Informative)
Giving anyone other than my parents personal information about myself (credit card number/ SSN) over the phone pains me. It feels like I'm running a red light every time and I'd rather not do it.
I agree - start by finding a new consultant! (Score:5, Insightful)
But then they HAVE the data, and if you care about your data, that's a problem.
In a perfect world, I would start by finding a new consultant - one who wouldn't even consider RECEIVING such data through email. I suppose in a PERFECT world, there wouldn't BE such consultants.
But failing that you need to lay out every security policy you think is important to secure your data, including INSIDE a network... firewalls, care with files, background checks on IT staff, background checks on the consultants. You need this laid out in excruciating detail. And you need it in the contract with them.
Ideally YOUR company needs to do the background checks on their staff... At a minimum you need to do a really sound credit check of them and have your attorney draw up a contract where they indemnify you for any loss due to a breach and any attorney fees to defend against and to recover from it. Etc.
Basically the same kind of due diligence you'd have for someone you were letting come in and install new servers and new firewalls on your site with access to everything you've already got. Or if they refuse to get up to a reasonable standard, you can tell them they need to do their work on your site.
Red flag. (Score:5, Insightful)
Frankly, I would be a little suspicious of any person who wanted to take custody of this information at all if test data can be used instead. I would never take on that kind of liability if I didn't absolutely have to.
In an environment where neither HR nor their contractor seem to have a clue, I would enumerate my concerns (in writing) and insist that they make the call (in writing). Too many weak links in this chain.
Re: (Score:3, Insightful)
Re:Red flag. (Score:5, Funny)
Re:PGP (Score:5, Insightful)
There are a number of issues to be resolved before worrying about how to get the data transferred. Has the consultant and/or their firm verified their security and controls to your firm's satisfaction with something like a SAS 70? Are there legal agreements in place concerning the proper controls of this data, the explanations or responsibilities in case of a disclosure, etc.? Has the idea been proposed to create bogus data for testing so that live data isn't used? Can the application be loaded on-site, so that a machine outside of your firm's control will not contain highly-sensitive employee data?
I'd ask a lot of questions like these and get answers to my satisfaction before I sent out any data. I would greatly prefer to have to explain to my management why I'm "holding up the train" than have to explain to my coworkers why I was involved in the disclosure of their personal information and mine.
Re:PGP (Score:5, Insightful)
Re:PGP (Score:5, Funny)
Re:PGP (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Password protected PDF! (Score:5, Funny)
Make sure you send the password with the file.
Re:Password protected PDF! (Score:5, Funny)
Re:Password protected PDF! (Score:5, Funny)
Couple idea's (Score:4, Informative)
Or if the area is not to far, why not burn it to a CD or some other kind of media and physically take it to her.
Re: (Score:3, Interesting)
By Hand (Score:5, Funny)
Re:By Hand (Score:5, Funny)
If she's cute.... (Score:5, Interesting)
Re:By Hand (Score:5, Interesting)
Seriously --- why not? Stick the data into a truecrypt volumne on a USB thumb drive (or USB hard drive, for big data). If the contractor is nearby, walk over and type the password in yourself. If not, courier it and use encrypted email to transmit the password (or just tell the guy over the phone).
Re: (Score:3, Interesting)
Minimum security in this case would be to require the receiver of the data to work with the data on a computer which is not connected to a network, because once malware infects their network no amount of encryption will keep the data safe.
Put the data on physical media and have it delivered by a se
Re: (Score:3, Informative)
Re: (Score:3)
How would I prefer to send sensitive data? (Score:5, Insightful)
Re:How would I prefer to send sensitive data? (Score:5, Insightful)
The policy in my current company is that NO DATA is shared unless we have a "Non Disclosure Agreement" (NDA) Signed with the company/consultant that needs to work with our data. Have your legal department prepare such an agreement with items such as penalties for improper use of the information..
This kind of agreement sometimes scare consultants or companies, and it's cause for some struggle, but in the end if they can't handle the responsibility over your data then you should find someone who can.
pgp on a dvd or flash drive (Score:4, Insightful)
Locally (Score:4, Insightful)
Sending sensitive data isn't that hard. (Score:3, Informative)
Of course, this doesn't address the issues revolving around exposing all this data to your consultant to begin with.
E-Mail (Score:5, Informative)
PGP maybe. Say we PGP encrypt an e-mail. We now rely on the secrecy of the recipient's private key. This means we rely on the recipient's security infrastructure to properly protect a piece of data until the data we transmit has become non-useful (this includes destroying all copies of the key -- when actually done, we guarantee the key remains secret forever). Can we trust this? Not really.
Well with SSL, the certificate gets verified against a CA signature. The client automatically establishes encryption in a secret way (randomly generated public key, sent to server, which sends a signed and encrypted session key) so we know no third party can eaves drop, without any infrastructure on the client end. Now, this is where I pull up Ettercap in the next hotel room over, and the client clicks "Accept certificate temporarily for this session" when it warns him my MitM cert is self-signed. Again, can't trust this.
Well, let's hand it off on a USB flash drive. Does he lose it? Leave it in his car? Hell, it's now on a storage system at another company with odd security practices. Again, out of your control.
All solutions suck. Transport isn't an issue, it's ensuring data confidentiality at the destination (including any encryption keys used to secure the transport, as well as the decrypted data itself once stored at the other end).
Public key is to complicated for a simple one-shot (Score:4, Insightful)
Simply use symmetric encryption (AES-256, for example) with a strong random key, then provide the key on a separate hand-delivered or voice-delivered medium.
Public key doesn't really buy you anything in this case -- if somebody grabs their copy of the symmetric key, you're screwed. If somebody grabs their copy of the private key, you're screwed. Protecting the private key with an additional symmetric key doesn't make it more secure.
But explaining to a clueless consultant how to keep a single key secure is a lot easier than trying to explain public key/private key operation.
Re: (Score:3, Insightful)
Uh, only if you have public key infrastructure (i.e. pre-trusted authorities). I can generate shared secrets all day long with Diffie Hellman, but it really only helps me if I know that the recipient is not a man in the middle.
Simple... (Score:4, Interesting)
Pinkerton (Score:5, Insightful)
Re: (Score:3, Insightful)
OTP (Score:5, Funny)
Spy Style (Score:5, Funny)
Don't forget to wear mirrored sunglasses.
What about once it gets there? (Score:4, Insightful)
Re: (Score:3, Insightful)
Speaking as if I was the poster of the original question, I don't care what happens to the security after I get the data there. It's not my problem.
Don't over think this (Score:5, Insightful)
We use an SFTP server for transmission of financial data, and I don't lose a bit of sleep over it. You are at much higher risk for either your HR department or the consultant doing something stupid with the source or result files on their network. Your need is just to make sure that it doesn't happen on your watch.
I would be more concerned about making sure that the HR folks and the consultant cleaned up their work files afterword.
Secure in layers (Score:5, Insightful)
Data in transit:
Encrypting the data prior to transfer is highly recommended, so that when it arrives it is in a secured package, and it also reduces risk should an email be misaddressed or forwarded to an unintended recipient. For this part PGP is an excellent tool. You can encrypt using exchanged keys, or you can encrypt using a strong passphrase and then communicate that passphrase out of band (phone call is preferable, separate email is workable but less preferable). For the method of transfer, securing the channel of communications is another added layer of security on top of encrypting the data ahead of time. If you are using an interactive transfer like (S)FTP, it will protect the authentication credentials from prying eyes. Although someone intercepting the PGP encrypted file now may not be able to decrypt it, tomorrow's technology may make the task trivial, so protecting it is recommended. TLS-encrypted email from organization to organization is also a good choice, but may be beyond the scope of your project. However, if this will be an ongoing need, or if your HR rep is also passing confidential content in email, it's definitely worth looking into.
Data Protection after Transit:
Once the person has received the file, your data will continue to be at risk. Each copy they make of the encrypted file is another file that could potentially be moved outside of a controlled environment. Once they decrypt the data, the risk to your organization climbs as they strip away another layer of protection. At this point the processes the consultant has in place are critical to protecting your data, and lack of processes or sloppy adherence puts your organization at risk. I often use users' Outlook Sent Items to show how easily copies of data files propagate. Anywhere they store the data, encrypted or not, may be released outside of their environment when they dispose of hard disks or tapes, or if they have them replaced because they are faulty. We empower users with tools, and those tools can increase risk in unexpected ways.
Remember the most important security rule - always protect in layers. Remind everyone to treat all data like it's their own banking information or cash money. Require your partners/vendors/consultants to meet or exceed all of your controls. Allow as few copies of data (encrypted or non-) as absolutely required for operational and preservation purposes. Continually remind everyone of the potential risk of data loss. Make sure users understand that there is no single security solution - encryption provides one layer of protection, but the best security is constant vigilance and treating your data like it's cash money.
I would recommend you have a serious discussion with your HR rep, starting out by saying "I just want to be sure you're aware of the risk here, and we are doing everything we can to protect our company and our employees." Then spell out the risks without exaggerating, and remind him/her that it's situations like this where bad decisions end up in the newspaper. The first decision is "do we have to move this data outside of our organization?" and it should only be done if it's absolutely required. If it is, then layering security and requiring that your vendor/contractor treat it with the right level of sensitivity are all that you can do.
PGP Universal Server or Tumbleweed (Score:5, Interesting)
- That local users would create decent passwords
- That remote users would be able to understand how to decrypt/open the documents
- That users wouldn't send the password in the same email as the encrypted file
The found marginal success with Office document encryption, but ultimately, things were nearly impossible to audit when people were doing their own encryption.We put a PGP Universal server with web messenger between our internal mailserver and our SMTP gateway, and set policies on what does and doesn't get secured. Aside from the occasional external user who is baffled by the concept of creating a passphrase, the server has been trouble-free. If you have to deal with arbitrary external mail recipients with unknown levels of clue, I highly recommend picking either PGP Universal or Tumbleweed.
my pick (Score:4, Interesting)
use truecrypt and create an encrypted file on a thumb drive. then if it gets lost, no one can retrieve it.
Registered Mail (Score:4, Insightful)
Yes, Registered Mail costs more. It is worth it. Registered Mail *EXISTS* for the sole purpose of shipping high-value items that MUST NOT GET LOST OR STOLEN. That is precisely what you have here.
And for those of you in the peanut gallery: Yes, I have done Registered Mail. Several times. It is a pain in the ass. The Postal Service thinks it is a pain in the ass, and will try really hard to talk you out of it. I usually have to say "Registered Mail" two or three times before they figure out that I really do know what I want. I have had Postal Service clerks ask if I knew the difference between Registered and Certified. They were always very disappointed when they discovered that I *DID* know the difference, could explain it to them, and wasn't about to back down.
If you are really paranoid, you send two packages, both by Registered Mail. One contains encrypted CDs. The other contains the decryption key. Or you split the data into two packages, that must be combined in a nonobvious way to reconstitute the data.
But the KEY to the transfer is Registered Mail.
It doesn't matter, you've already lost (Score:5, Insightful)
Do you really think that this is the only flaw in their handling of sensitive data? That, otherwise, they are security conscious and careful, except for this odd flaw where they don't understand how insecure email is?
If you care, it's time to change consultants.
If you don't care, just email it already.
(I'm actually not quite as rigid as this may sound out-of-context. I don't agree that security is all-or-nothing, so please don't strawman me that way. My second paragraph is important; anyone who expects those things emailed to them is so far away from the necessary knowledge and skills that debating whether they are close enough or whether they will be able to take reasonable care is a waste of time, arguing about whether the receiver made a touchdown when they got tackled on the 10 yard line on the wrong side of the field.)
Emailed? (Score:3, Insightful)
What to do (Score:3, Insightful)
Old Grouch Here (Or maybe Old Farte) (Score:3, Informative)
Don't send it to a consultant who would ask .... (Score:5, Insightful)
This consultant wanted you to send it to them? I've been a consultant and developer for nearly 20 years. I would NEVER EVER ask for data like that to be sent to me. I wouldn't want to be anywhere near owning that kind of responsibility for someone else's critical data. You couldn't make me take it if you tried.
Your biggest problem, as pointed out by others, isn't the in-transit data but rather what it does once the consultant gets it. If he's so unaware of modern security best practices as to ask you to send it to him, it's fairly a sure bet that his environment and practices are no where near good enough.
MY GOD!!! (Score:3, Insightful)
As long as the file gets there safely, you don't care what they do with it on the other end, right? (That is the most common scenario.)
So these people are trying to shoot ants with cannons. Massive overkill. REALLY all you need is scp, and unless you are running Windows, it is already built-in and needs little if any configuration. It's ready to fly.
You would be hard pressed to get better security during transmission, and when it gets to the other end it is in its original form. No messing with keys or pads, no UN-encryption, in fact nothing at all for them to do. Send it via scp and there it is. All you need is for them to give you a username and password, which is a hell of a lot simpler than some of those other ideas.
How will the data be sent back? (Score:3, Interesting)
The other replies make a lot of sense in pointing out that your security policy is only as strong as the consultant's weakest link. Can someone potentially sniff the email as it goes by? Sure. Is anyone actually watching? Probably not.
PGP or GPG keys sent via email are always vulnerable to "man in the middle" attacks unless you verify the fingerprints through other secure channels, etc and so forth. Is anyone taking the trouble to do that for access to your data? No. Seriously.
You could probably even get away with putting all the data into a single ZIP file, and then putting THAT single ZIP file into a password protected ZIP file. (If you have more than a few files in a password protected ZIP file, there are apps out there that can do some comparisons and crack them open in moments.) One file in a ZIP, with a strong password given over the phone, should keep out the nosy and all but the more educated hackers. The educated hacker already has access to your system after asking HR's password on a "support" call.
I'd agree with the masses - GPG. However, it is VITAL that the consultant knows to encrypt the data sent BACK or it is just a waste of time. Good luck!
Don't send it at all (Score:5, Insightful)
You are about to send sensitive data to a third party who will load it into a new database and send you back the database. That's insane.
You need to bring the destination (the database) in-house. Either load the data yourself, or get the consultant to come in-house to load the data. Under no circumstances should the sensitive data travel outside your network boundary. It's not a question of "how strong is my encryption" at all.
AES 256 (Score:4, Insightful)
Not by email... (Score:3, Insightful)
1) Strongly encrypt the data via your favourite method
2) Setup an Sftp with a user name/strong password for the consultant*
3) Send the user name/strong password to him/her via email (PGP/GPG)
4) Keep the login log in a very safe place, along with any other email exchange, keys, etc that show the transfer has occurred and by whom.
* If you want to have a even better "paper" trail, have them send you the IP of the host that they will be logging in from and limit access to just that host. Also have make sure that this IP is verifiable owned by the consultant firm. Keep the verification.
If all of the above is done, you have made sure that the login has been done through the only *one* IP allowed (owned by the consultant firm), through a login that only one person has. So, any fuck-ups are there's and there's alone.
But, if possible, I'd also require them to keep the data encrypted and only decrypted for use, preferable not to a HDD (ram disk). Not to mention any other mechanism that you can think of. Also make sure that the paper work requires any and all requirement to be applicable to any subcontractors as well as any of the subcontractors subcontractors, etc. Because, these consulting firms have a rather poor track record of keeping this data secure. And if they don't do it, and bad things happen, there is legal recourse on your part (as well as possibly the people who's data it is).
PGP yet again .. with some real world examples (Score:4, Interesting)
I'm sure if someone worked hard enough they could have broken it, but since the firewall would only allow connections from specific IPs, it would have been tough to inject data into the system.
This meant that the biggest threat wasn't someone stealing the raw data, but someone on the inside gaining access to the data after it was processed or was being processed and possibly in an unencrypted state. The DBA used some type of Oracle encryption to prevent someone gaining access to the database and being able to run SQL queries and return unencrypted data without some type of key (I don't know how it worked
So
bzip, split and send three ways, scp, email, pendr (Score:4, Funny)
When he totally freaks out and starts screaming. Rename the file to GrowYourPenisNow.doc, spoof the From: header to be from hotmail.com, add a subject line V1agra and send.
Nobody will ever bother to read it.
Encrypt, encrypt, encrypt... (Score:3, Interesting)
Completely open source, implement as you'd like.
Basically, you give them multiple keys, each by different methods (phone, fax, in person, postal mail, IM, etc), and you select the encryption methods. You encrypt the message on an off-line machine, and pass it to an online machine for delivery. The encrypted message goes out through any unsecured channel (i.e., email). They decrypt on their offline machine and now they have the message. All in all, it could be an easy and secure system. Since my code is open source, you can rehash it any way you'd like.
This is pretty much what I wrote it for. Secure, unbreakable transmissions over unsecure networks, where it's a given that someone will intercept it.
I include an encrypted message in my tagline. I'll Paypal $10 to the first person who cracks it.
My biggest concern would be that they're reading it on a machine that has Internet access. You can secure your servers like Fort Knox, but we all know perfectly well that every foreign machine is suspect. That's a risk you have to be willing to take.
I've seen sites that provide "secure" data on demand to authenticated users, over SSL via their web browser. You can key it to the end user's IP, and require a user:pass, but there's still potential for abuse.
If your information is that sensitive, you should only allow access:
1) If they are on the secure portion of your network
2) That part of the network does not have Internet access
3) You have a strong security policy for that part of the network
4) You have a strong security policy for the workstations on that part of the network.
Since that doesn't usually fly in the business world, you'll have to make the exceptions, which you're asking about. Make sure you have upper management approval in writing for the exceptions that you are going to make, so when it hits the fan, you are not the responsible party.
Do you want theory or reality? (Score:3, Informative)
For the "real" answer - Using WinZip, pick 256-bit AES encryption and zip your file. Then send it via regular email, and call the recipient with the password (and although you don't need to pick an easy password, prepare to have to repeat it a few dozen times if you choose anything even remotely secure).
That satisfies any privacy/data security laws applicable to the situation, including HIPAA (presuming the recipient actually has the right to access the requested data) if this happens to involve sending medical records. No, not a glamorous solution, but it works.
Send to another person... (Score:3, Insightful)
Let me get this straight... (Score:3, Insightful)
Your consultant wanted you to email the personal data to them to begin with? Well, first on the wish list would be a new consultant, preferably one who takes security seriously enough to not ask that confidential personal data be sent via email. It's not like they don't know what kind of data they have there, and the lack of consideration for security in acquiring the data from you does not bode well for how it will be handled once they have it. I would probably require that they either come on site and work with the data via your machines on your network, or I would demand a partnership agreement with them that spells out hefty penalties if they fail to follow specified security practices, especially if that failure leads to data compromise.
Zixmail (Score:3, Interesting)
This is really simple, people (Score:3, Interesting)
-ducks-
You need a security policy. (Score:3, Informative)
I can't stress this enough. You need a company information security policy.
Your information security policy should at a minimum cover the following items:
I plan to write a blog post today or tomorrow at our blog, http://securitymusings.com [securitymusings.com] which will go into a little more detail on this.
Now for a direct answer to your question: strongly encrypt the data using a 128-bit (or longer) standard encryption algorithm such as 3DES, AES, or Blowfish. If you are using password-based encryption, use a long and random password, such as those generated by any good password generation application. (GRC has a web-based one. [grc.com]) Use at least 20 random characters to create a sufficiently entropic password. Communicate the password out-of-band, such as via telephone, fax, or mail/fedex. There are lots of available tools to do proper encryption, such as PGP/GPG, WinZip, etc. Use one, don't write your own.
Re: (Score:3, Informative)
Back when I worked for a defense contractor, FedEx was legal for shipping classified hard drives.