FRCC Secure Transfer & Storage Infrastructure. Training for new data transfer process

Transcription

1 FRCC Secure Transfer & Storage Infrastructure Training for new data transfer process

2 Training Objects Understand the changes in regards to the data transfer process using PKI Installation Key management Preparation of Evidence Creating the encrypted file Transfer of file(s) to FRCC using new website 2

3 Installation Software Installation: Installing GNU Privacy Guard for Windows Gpg4Win 3

4 The program needs to be downloaded from Gpg4Win Web site Download the Current Release (top of the listing) 4

5 Double Click the downloaded file. Click OK, Click Next, 5

6 Click next on the license agreement page 6

7 Change the default selection to the following (Next Slide). 7

8 The only ones checked are Kleopatra, GpgEX, Gpg4Win Compendium. Click Next, More information on these option later in the presentation. 8

9 Click Next, 9

10 Select the options you would like, click next 10

11 Click Install 11

12 Completed, Click Next 12

13 Your choice, click finish 13

14 Key Ring/Manager Once the Gpg4Win has completed the installation process, you will find the following icons on your desktop, if you selected this option during installation. If not just use the windows menu. 14

15 Gpg4win is an installer for Windows and contains several Free Software components: GnuPG The core; this is the actual encryption tool. Kleopatra A certificate manager for OpenPGP and X.509 (S/MIME) and common crypto dialogs. This is your Key Ring/Manager GPA An alternative certificate manager for OpenPGP and X.509 (S/MIME). GpgOL A plugin for Microsoft Outlook 2003/2007/2010 ( encryption). * Rudimentary support Outlook 2010/2013 GpgEX A plugin for Microsoft Explorer (file encryption). Claws Mail A complete application with crypto support. Gpg4win Compendium The documentation (for beginner and advanced users), available in English and German. 15

16 16 Questions?

17 Key management Creation of your Public/Private key pair Accessing the FRCC Key Repository Public Key Storage Import FRCC Public Key Owner Trust & Certify Certificate on import 17

18 Key Management Creation of your key pair Kleopatra Select File then New Certificate 18

19 Key Management Select Create a personal OpenPGP key pair 19

20 Key Management Enter in all required information, click next when ready 20

21 Key Management Review information, if correct click create key 21

22 Key Management Having clicked the Create Key you will need to enter in a password/passphrase Needs to be as strong as possible Needs to be safe guarded 22

23 Key Management Key pair has been created Highly suggested to backup you public/private keys 23

24 Key Management Next step is to import FRCC public key, you can access our public key from here ompliance/frcc Public Key Storage 24

25 Key Management Must be signed in to access the files and/or folders Access the folder, download the key to your system for the import process, site will active in June

26 Key Management Import a public key 26

27 Key Management Find and import public key 27

28 Key Management Once import has completed, you will see confirmation that 1 key has been imported 28

29 Key Management Once a public key has been imported into your key manager, you must validate trust and certify the key. 29

30 Key Management Return to your key management program - Kleopatra, right click the key that has been imported. The menu will provided 2 selections (both are required) Change Owner Trust Certify Certificate 30

31 Key Management Menu selections Step #1 Step #2 31

32 Key Management Change Owner Trust 32

33 Key Management Certify Certificate Select the highlighted items to certify the certificate (key), click next when ready 33

34 Key Management Defaults are fine, click certify 34

35 Key Management You will be prompted for your password / passphrase, enter it and continue 35

36 Key Management Suggestions Backup your key pair to a very secure location Limit access to the private part of the key pair password/passphrase (this can be changed as needed by you) 36

37 37 Questions?

38 Preparation of Evidence Some key points: Understanding and the importance of sensitivity levels of data being sent New file naming convention of encrypted file Always include FRCC public key in all encrypted files sent 38

39 Preparation of Evidence Packaging Identify the sensitivity level of the data being transferred to FRCC Most Sensitive Sensitive General Transfer - includes uploading and downloading 39

40 Secure Transfer Most Sensitive evidence/information such as Firewall Rules (redacted) Network topologies including IP s or other documentation with extensive network address information Cyber vulnerability assessment results or reports containing specific vulnerabilities Physical Security Perimeter drawings Read only access, data will not be removed from the vault 40

41 Secure Transfer Sensitive evidence/information such as All other sensitive/confidential evidence/information submitted by registered entity Includes both O&P and CIP information Can be transferred and used on encrypted laptops etc. Will be removed/deleted from laptops etc. after use 41

42 Preparation of Evidence Packaging Use proper naming conventions of encrypted file prior to transfer XXXXX.ONP.YYYY-MM-DD.001.gpg File extension is added during creation Package number of file (001 to 999) Evidence, Audit, or Request Date Evidence Type (CIP, ENF, ONP, TFE, RAM, DTR) The first 5 characters of the file name are for the Entity Acronym, also known as short name. Proper naming allows for automation of FRCC data/evidence handling 42

43 Examples for file names With 3 character short name DEF.ONP gpg With a 4 character short name FMPA.ENF gpg With a 5 character short name COVPA.RAM gpg 43

44 Secure Evidence Packaging Step #1 Identify the evidence data to be sent, Create folder(s) based on sensitivity, place requested data in each folder as needed. ** Please note the individual file name(s) cannot exceed 99 characters in total, this includes dots, spaces, dashes, etc. The compression process used Gpg4Win will omit the file and the program doesn t provide any warning when doing this. 44

45 Secure Evidence Packaging Example: 45

46 Secure Evidence Packaging Step #2 - Check Sum/ Hash File Create a hash/check sum of your evidence and perform a virus check on all files Select evidence files and perform a virus check using your local anti-virus scan software. Include a copy of the anti-virus scan report in a TEXT file antivirus-check.txt as part of the evidence package Create a hash listing of all your evidence using SHA1 hashing. With the installation of Gpg4Win a set of tools are installed along with the software. One of the features is the ability is to produce a check sum file or hash of all files within a folder 46

47 Secure Evidence Packaging Step #3 Using the Gpg4Win checksum tool Select or highlight the evidence folder that contains all files to be encrypted, right click to access windows content menu. Select the menu option More GpgEX options, then select Create checksums. 47

48 Secure Evidence Packaging Once completed it will display where the check sum file has been placed. Step #3 Cont. 48

49 Secure Evidence Packaging Another tool that can produce the check sum/hash file is a utility called Multi-hasher which can be used to perform the hashing function. Execute Multihasher and select SHA-1 as the hashing algorithm and select folder or files of your target files. A copy of MultiHasher software can be downloaded from website: Step #3 Cont. 49

50 Secure Evidence Packaging Select the hash listing of the files and copy/paste it in a text file titled hash.txt. Include the text file with the evidence information you are packaging. Step #3 Cont. 50

51 Secure Evidence Packaging Step #4 Encryption The next steps will guide in the use of Gpg4Win to encrypt all the files into one encrypted file for sending to the FRCC 51

52 Secure Evidence Packaging Right click the evidence folder containing the files for encryption From the content menu select the Sign & encrypt Step #4 Cont. 52

53 Secure Evidence Packaging Default dialog menu, see next step for changes needed Click on button next to the Archive name (OpenPGP): To enter correct file name Step #4 Cont. 53

54 Secure Evidence Packaging Follow steps outlined below in the image, once ready click save Step #4 Cont. 54

55 Secure Evidence Packaging Using the image as a guide, check the settings on this menu, Then click next Step #4 Cont. 55

56 Secure Evidence Packaging Select the required certificates to use Step #4 Cont. 56

57 Secure Evidence Packaging Step #4 Cont. 57

58 Secure Evidence Packaging Signing Step #4 Cont. 58

59 Secure Evidence Packaging Once encryption completes you will see this dialog on the screen. The process has completed successfully Step #4 Cont. 59

60 Secure Evidence Packaging Checking our save folder we ll find the newly created file (note file extension has been added) Step #4 Cont. 60

61 61 Questions?

62 Secure Transfer Access to the new transfer site Signing in and Access Selecting the correct folder New Entity Secure File Transfer 62

63 Secure Transfer To access the site use the following url The direct link from the FRCC.COM compliance sidebar/menu OR Sign-in using your FRCC.COM website account name and password. 63

64 Secure Transfer 64

65 Secure Transfer After signing in you ll receive a welcome message 65

66 JAVA Security Warning When you sign in you may be prompted with a security warning from java. Follow your company policy in regards to these type of warnings. Default response is to check the Do not show this again for this app and web site and click the allow button. 66

67 Secure Transfer 67

68 Secure Transfer When accessing FRCC s Transfer site Select correct transfer folder Selection based on data sensitivity m XYZ FileArea XYZ File Area Entity Secure File Transfer Folder Secure Vault Secure Vault For Most Sensitive Data Secure Working Secure Working For Sensitive Data 68

69 Secure Transfer Folder Labeled XYZ File Area NEW Entity Secure File Transfer Folder Primarily used for FRCC to provide info to the registered entity, but could be used to submit general correspondence to the FRCC 69

70 Secure Transfer Folder Labeled Secure Vault Most Sensitive evidence/information such as Firewall Rules (redacted) Network topologies including IP s or other documentation with extensive network address information Cyber vulnerability assessment results or reports containing specific vulnerabilities Physical Security Perimeter drawings Read only access, data will not be removed from the vault 70

71 Secure Transfer Folder Labeled Secure Working Sensitive evidence/information such as All other sensitive/confidential evidence/information submitted by registered entity Includes both O&P and CIP information Can be transferred and used on encrypted laptops etc. Will be removed/deleted from laptops etc. after use 71

72 Secure Transfer Enabling Web Client Pro - Option Its recommend for easier uploading and navigation to switch to the Web Client Pro version of the interface. To enable this feature, access the Tools drop down menu, then click on the Enable Web Client Pro. You can receive additional JAVA Security Warnings when you enable this 72

73 Secure Transfer Additional Message(s) for Web Client Pro 73

74 Secure Transfer Web Pro Enabled 74

75 Secure Transfer Once you have web pro enabled Open (double click the folder for upload) 75

76 Secure Transfer Drag and Drop Files Once file is dropped into window transfer starts 76

77 Secure Transfer Once the transfer has completed successfully, a confirmation is sent FRCC will review received data and it has been correctly received based established policy and procedures using the sensitivity definitions provided, any data received incorrectly, a request will be made to resubmit by the entity 77

78 In Summary We have covered Installation Creation and import Public/Private Keys Packaging of Evidence Transfer of encrypted files to FRCC 78

79 Questions? If you have additional questions please send them to the following address, with subject line of PKI Training 79