Feeds

Home Office reaches half-way hash in secure data handling

Encryption bureau to operate like internal post office

The Essential Guide to IT Transformation

Analysis The UK Home Office has introduced procedures to handle encrypted personal data from external partners. However, guidelines on how the new Home Office Central Cryptography service will work raise concerns about possible shortcomings with the service which, while a big improvement, falls below best practice in sectors such as banking.

Procedures outlined in the guidelines follow a major Whitehall review prompted by the HMRC data loss debacle. The guidelines are a break from working practices that saw CDs with sensitive unencrypted data regularly winging their way via internal mail, sometimes to oblivion, but fall short of offering a full end-to-end service.

The Home Office Central Cryptography service (announced in June) will make use of PGP to handle data but, once received, emails will be decrypted and forwarded to their intended recipients within the government department. While the government secure intranet provides security protections, an end-to-end system would be preferable. The reader who forwarded us the documents went further, suggesting it "defeats the whole purpose" of sending data encrypted in the first place.

Files up to 6.5MB in size will go to an email address and a dedicated machine within the central cryptography bureau, while the guidelines call for files between 6.5MB and 50MB in size to be handled through an external email service (gmx.com). Files larger than 50MB are to be sent on an encrypted CD or DVD via either courier or recorded delivery.

Mid-range files are to be left on servers before they are picked up by their intended recipients. These files are too big to email internally but too small to come via recorded media so instead they will be "placed in a 'pick-up' zone on the network folder for immediate retrieval and deletion".

The system uses of symmetric-key cryptography, so both the sender and the Home Office will share the same key for a particular communication. (This is less secure than public-key cryptography where each party uses a set of two mathematically related keys to lock and unlock messages.) External parties are advised to use complex passphrases to encrypt messages and to send them under separate cover, as explained below:

The encryption must be carried out using 3rd-party pre-defined passphrase only. The sender should ensure a strong passphrase is created. The encrypted file may be created as a PGP file or a self-decrypting executable (.exe) file. The passphrase should be sent to the Bureau separately to the encrypted data (the Bureau will contact the sender for passphrase).

Jamie Cowper, director of marketing at PGP, observed that the required use of strong passphrases sent out separately from the main communication, shows the Home Office has sought expert advice (probably from the GCHQ's CESG group) in developing its plans. "You'd be surprised, but some people sent encrypted discs with the passphrase attached on a post-it note," he added.

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.