FRCC Secure Data Transfer. Users Guide V1.5

Size: px

Start display at page:

Download "FRCC Secure Data Transfer. Users Guide V1.5"

Spencer Fisher
6 years ago
Views:

1 FRCC Secure Data Transfer Users Guide V1.5

2 Table of Contents I. Introduction... 2 II. Part 1 - Software Installation... 3 III. Part 2 - Creating Your PKI Certificate... 7 IV. Part 3 - Importing FRCC Public Key Certificate V. Part 4 - Validate & Certify FRCC Key Certificate VI. Part 5 - Evidence Upload File Naming Convention VII. Part 6 Packaging the Evidence VIII. Part 7 - Transferring the Evidence to FRCC IX. Revision History... 30

3 Introduction FRCC entity secure transfer site uses high level of encryption using a Public Key Infrastructure (PKI) RSA-2048 public token provided by FRCC. The data in storage is encrypted using BitLocker 256 Advance Encryption Standard (AES) encryption. FRCC transfer site (https: securetransfer.frcc.com) once authenticated, offers entities two distinct folders labeled Secure Working (SW) and Secure Vault (SV) to deposit their evidence. Evidence deposited in SW (90%) is used for all sensitive evidence and SV (10%) is used by those entities that consider their CIP data most sensitive, such as firewall configurations and un-redacted network diagrams. Because both SW and SV servers are both identical using a high level of encryption (e.g. PKI and AES), entities are encouraged to deposit their evidence in the SW folder. Once an entity deposits the encrypted evidence package, the system transfers the package to the set of back-end servers (i.e. SW and SV). The package is automatically hashed by the entity encryption process for non-repudiation. The main difference with SV is that evidence can only be viewed internally by FRCC via Microsoft s Remote Desktop Protocol (RDP), using the product s base 128bit encryption only from the FRCC Compliance trusted local area network (no external/remote access or local copies can be removed from SV per company policy). The process in this document is meant to guide an entity in installing the Microsoft Windows software Gpg4win, then show the process for creating your very own public and private key. The next step is to import the public key from FRCC that will be used for encrypting the evidence package and upload to the secure transfer site ( The entity at this point must validate and certify the FRCC key before it is used to transfer the evidence package. The procedure ends by explaining the proper naming convention that must be used to upload a file successfully. The file name allows for automation of FRCC data/evidence handling. If the file name does not follow the proper naming convention, the Secure File Transfer process will not accept the file/evidence and it must be resubmitted. A tool called the FRCC Evidence File Name Calculator has been developed and provided by FRCC Compliance to facilitate the entities with how to properly name their file(s). In addition, this tool can be used internally to track multiple file uploads. The final step in the process is for the entity to logon to the Secure Transfer site and select the appropriate transfer folder, SW or SV Please be aware that the software requires Administrative rights to install this software on your workstation/server. You may need to consult with your IT department for additional assistance. If you have any questions about this process, please send an to: compliancemanager@frcc.com. Remember that your one-stop-shop website for all secure file transfer information is located on the FRCC website at: Thank You! FRCC SECURE DATA TRANSFER AUGUST

4 Part 1 - Software Installation GPG4win Background Gpg4win is not a program in itself; rather, it's a suite of five utilities bundled along with a comprehensive manual and a powerful encryption engine. The utilities included are: Kleopatra (a certificate manager), GPA (an alternative certificate manager), GpgOL (a plugin for Outlook 2003 and 2007), GpgEX (an add-on for Windows Explorer, 32-bit only), Claws Mail (an application), and a manual entitled Gpg4win Compendium. At the core of Gpg4win lies the engine, GnuPG, also known as the GNU Privacy Guard. This is an open-source implementation of OpenPGP, a powerful and open encryption standard. GnuPG uses an encryption system called public-key cryptography: Each user has a private (secret) key, as well as a public one that they can freely distribute. To encrypt a file or an to send to another user, you need their public key. Only that user can decrypt your message, since only they have the right private key (and the passphrase that goes along with it). About: Gpg4win enables users to securely transport files with the help of encryption and digital signatures. Encryption protects the contents against an unwanted party reading it. The following components are used by FRCC for the secure transfer process: GnuPG This is the actual encryption tool. Kleopatra A certificate manager for OpenPGP and X.509 (S/MIME) and common crypto dialogs. GpgEX A plugin for Microsoft File Explorer (file encryption). Gpg4win Compendium The documentation (for beginner and advanced users), available in English and German. Gpg4win requires at least Windows versions 7 or newer (up to Windows 10) operating system to be installed). Both 32 and 64bit systems are supported. FRCC SECURE DATA TRANSFER AUGUST

1. Close Windows Programs: First ensure that any Window programs (open windows) executing on

1 as of this version of the document) of GPG4WIN via this link https://www.gpg4win.org/ a.

Select Language: The installation assistant will start and ask for the language to be used.

Welcome and License Agreement: A welcome dialog box will appear next Welcome to the installation

5 1. Close Windows Programs: First ensure that any Window programs (open windows) executing on your computer are shutdown 2. Download the Software: Download the latest version (e.g. V3.1.1 as of this version of the document) of GPG4WIN via this link a. Click the big green button (download Gpg4win) on the left to get started 3. Select Language: The installation assistant will start and ask for the language to be used. Select English and click [OK] button 4. Welcome and License Agreement: A welcome dialog box will appear next Welcome to the installation of Gpg4win click on [Next>] button. The next dialog displays the licensing agreement. Read the license if you wish, otherwise click on [Next >] button FRCC SECURE DATA TRANSFER AUGUST

6 5. Select Components to Install: The next diagram, lists the components needed for installation. The only components necessary to sign and encrypt the data are: GnuPG, Kleopatra, GpgEX and Ggp4win Compendium (documentation), Select GnuPG, Kleopatra and GpgEX, then click the [Next >] button Remember this installation only needs the following elements : GnuPG: Is the GNU Privacy Guard main program Kleopatra: Is the Key manager for OpenPGP and x.509 certificates GpgEX: Is the GnuPG shell extension Gpg4win Compendium: Is the Gpg4win documentation The other selections remain unchecked. FRCC SECURE DATA TRANSFER AUGUST

$C:\Program Files (x86)\gpg4win. The next step will display Installation Options 7.$ Installation Process: During the installation process you will see a progress bar (refer to illustration) and information

Installation Process: During the installation process you will see a progress bar (refer to illustration) and information

7 6. Installation Location and Options: The next step will pre-populate a destination folder for the installation such as; C:\Program Files (x86)\gpg4win. The next step will display Installation Options 7. Installation Process: During the installation process you will see a progress bar (refer to illustration) and information on which file is currently being installed. You can press [Show details] button at any time to show the installation log process FRCC SECURE DATA TRANSFER AUGUST

After these steps, you are ready to work with the program. Proceed to Part 2, Creating Your PKI Certificate. Part 2 - Creating Your PKI Certificate 1.

8 Once the installation has completed, click the [Finish] button. This will be a good time to read the README file which contains up-to-date information on the Gpg4win version that has just been installed. After these steps, you are ready to work with the program. Proceed to Part 2, Creating Your PKI Certificate. Part 2 - Creating Your PKI Certificate 1. Creating the Key Pair: Create your key pair certificate in Kleopatra by clicking: [File] then click on New Key Pair from the dropdown menu 2. Choose Format: Select the Create a personal OpenPGP key pair option and click the [Next] button FRCC SECURE DATA TRANSFER AUGUST

Click the [Next] button Take a moment to review the information entered in the

9 3. Enter Details: Enter the information as shown below including Company or personal Name, address. Click the [Next] button Take a moment to review the information entered in the previous steps. If you need to make a change, click the [Cancel] button. If, correct, click [Create] FRCC SECURE DATA TRANSFER AUGUST

10 4. Enter Passphrase to protect your new key 5. Please keep in mind when entering your passphrase (or password) ensure that it is strong, such as 14 characters which include caps, lower case, numbers and special characters. Most important, safeguard and protect the key. If your key is ever compromised, you should generate a new one by following the steps in Part Key Pair Successfully Created: When the key pair creation is successful, you will see the following dialog box, click [Finish] button. FRCC SECURE DATA TRANSFER AUGUST

11 Now that you have successfully created your certificate. We recommend you consider performing a backup of your public/private keys. FRCC SECURE DATA TRANSFER AUGUST

Part 3 - Importing FRCC Public Key Certificate 1. You must import FRCC public key used to encrypt your evidence by following this link: https://www.frcc.com/compliance/pkir/sitepages/home.

12 Part 3 - Importing FRCC Public Key Certificate 1. You must import FRCC public key used to encrypt your evidence by following this link: Click on FRCC Compliance Public key o (2) windows will open Click on drop-down arrow Click on Send To and then on Download a Copy Click [Save] the file in a location you can import on the next step using Kleopatra. Access the Key Repository and download the key, you will find two files in the folder. The key is labeled FRCC Compliance Public Live. Click [Save] the file in a location you can import on the next step using Kleopatra. For example: the default location is the Downloads folder in Windows. FRCC SECURE DATA TRANSFER AUGUST

2. To import the FRCC public key you just downloaded,

Download folder or the folder where you saved the Public

Highlight the Public Key and click [Open] 4.

13 2. To import the FRCC public key you just downloaded, open the Kleopatra application, click: [File], then click Import dropdown menu: 3. Locate the folder where the key was downloaded and Download folder or the folder where you saved the Public Key from the last step. Highlight the Public Key and click [Open] 4. After the key has been imported, you will receive a confirmation: Click [OK] and the window will close. FRCC SECURE DATA TRANSFER AUGUST

click on the All Certificates tab: 2. Certification Process.

14 Part 4 - Validate & Certify FRCC Key Certificate 1. To validate, trust and certify FRCC Public Key, access the Kleopatra application and click on the All Certificates tab: 2. Certification Process. Highlight Change Owner Trust and the Certify Certificate then click the certificate to complete this step. FRCC SECURE DATA TRANSFER AUGUST

15 3. Check the box next to Compliance Manager and also next to I have verified the fingerprint then click the [Next] button 4. Click Certify only for myself and click the [Certify] button FRCC SECURE DATA TRANSFER AUGUST

16 5. Certification will show successful. Click the [Finish] button We recommend you consider performing a backup of your public/private keys. Remember to limit access to the private key by saving it in a secure location. FRCC SECURE DATA TRANSFER AUGUST

17 Part 5 - Evidence Upload File Naming Convention 1. File names allow for automation of FRCC data/evidence handling. If the file name does not follow the proper naming convention, the upload software will not accept the evidence and therefore, reject the file upload and the file must be resubmitted. See the illustration below for the format of the File Naming Convention: (1) The first 3 to 5 characters of the file name identify the Entity Acronym, also known as the short Entity name (e.g. LAK is Lakeland Electric etc.). (2) Evidence Type (e.g. ONP or CIP etc.): See the table below for all FRCC Evidence Types. (3) Date-For the illustrated example above the date of ONP or CIP you would use the official audit date or the request date for the evidence type being uploaded to FRCC. (4) The encrypted package number in sequential order of upload. This number can be.001 to.999. For example, during an audit you may upload 50 evidence files for data requests, this number would start with.001 to.050. (5) You DO NOT need to add the.gpg suffix prior to encrypting the package. This file extension is automatically added by the encryption process Questions? Contact FRCC via compliancemanager@frcc.com FRCC SECURE DATA TRANSFER AUGUST

18 The FRCC naming convention starts with a three (3) to five (5) character length acronym, which identifies the Entity. It is followed by the evidence type (see list below), then by the date the activity is officially taking place (for example: for an audit, enter the audit onsite start date) and ends with a sequential number for each upload (such as.001 for a first file upload and then is sequentially increased as required). Hint: For multiple file uploads we recommend the use of the Evidence File Calculator. Evidence Types: CIP DET DTR CRD EAD ENF ERA ICE IRA MIT ONP PDS RAM SCD SEL SET TFE To be used for all CIP Audit Evidence Information or Data. To be used for all Determination Information or Data To be used for all Data Request Response or Data To be used for all Certification Registration Data To be used for all Event Analysis Information or Data To be used for all Enforcement Information or Data To be used for all Entity Risk Assessment or Data To be used for all Internal Control Evaluation Information or Data To be used for all Inherent Risk Assessment Information or Data To be used for all Mitigation Plan Information or Data To be used for all O&P Audit Evidence Information or Data To be used for all Periodic Data Submittal Information or Data To be used for all Risk Mitigation Information or Data To be used for all Spot Check Information or Data To be used for all Self Certification Information or Data To be used for all Settlement Information or Data To be used for all Technical Feasibility Exception Information or Data Date of Activity for Evidence Types: For Audit/Spot-check ONP or CIP, use the start date of the audit/spot-check. The same date is to be used for all of the data requests pertaining to the audit/spot-check. For DET & SET uploads, the date will be determined by the FRCC Enforcement point of contact and it is to be used for the duration of the enforcement related activity. For ICE, Risk Assessment & Mitigation uploads, use the date established by the FRCC RAM point of contact and it is to be used for the duration of the RAM related activity. For TFE uploads, use the date the TFE was submitted via the CTS portal or contact FRCC via compliancemanager@frcc.com. For RAM uploads, use the date established by the FRCC RAM point of contact and it is to be used for the duration of the RAM related activity. For ICE, Risk Assessment & Mitigation uploads, use the date established by the FRCC RAM point of contact and it is to be used for the duration of the RAM related activity. FRCC SECURE DATA TRANSFER AUGUST

Typically, during an audit (CIP or OP) multiple files are uploaded.

19 2. The FRCC Evidence File Name Calculator tool has been created to assist entities internally track multiple file uploads, with the file naming convention and a checklist to facilitate and track evidence file uploads. Typically, during an audit (CIP or OP) multiple files are uploaded. It is critical for entities to use the naming convention to prevent any rejection of data submittals. Below is an example of the tool: FRCC SECURE DATA TRANSFER AUGUST

20 3. Where can I find the calculator tool? FRCC Evidence File Transfer Calculator Tool (ctrl + click to follow link), or by following the steps listed below (see illustration) FRCC SECURE DATA TRANSFER AUGUST

Part 6 Packaging the Evidence In a previous section, you learned about the file naming convention which is used to automate the transfer of the encrypted package.

21 Part 6 Packaging the Evidence In a previous section, you learned about the file naming convention which is used to automate the transfer of the encrypted package. Remember to use the correct file naming convention. The FRCC portal transfer process will NOT accept the file upload if the file name does not adhere to the naming convention and, therefore; entities will be required to re-submit. This section shows you how to encrypt the evidence package for submittal to FRCC Compliance. 1. First, create the folder that will be used to hold the evidence/data and copy all the evidence/data needed into the desired folder that is to be uploaded to FRCC. In the example below, we have created a folder and placed (4) evidence files: File A, File B, File C and File D plus two subdirectories. Hint: The Evidence Folder May Contain Files, Sub-Folders etc. etc. 2. Using the naming convention learned in Part 4, rename the folder Evidence for FRCC to the correct naming convention prior to uploading. For example, let s say that entity XYZ needed to upload CIP evidence for an upcoming audit commencing on June 30, After using the evidence name calculator, the correct file name would: XYZ.CIP NOTE: When the program encrypts the folder XYZ.CIP , it will tag the file with the suffix. gpg automatically. Remember that file extensions in Windows are either hidden or shown by the file explorer based on the Windows system file options. For more information, ask your local IT. If the files contain a lot of data and/or a large collection of sub-folders, the usage of a compression program such as 7 zip should be used before folder/file encryption. FRCC SECURE DATA TRANSFER AUGUST

Rename Folder to the required file naming convention: 3. After renaming the folder to for this example; (XYZ.CIP.

001), First, right click the folder with the evidence and click on More GpgEX options and then select Create

In this example, (3) three checksums will be created, one for the (4) four files and one for each subdirectory.

22 Rename Folder to the required file naming convention: 3. After renaming the folder to for this example; (XYZ.CIP ), First, right click the folder with the evidence and click on More GpgEX options and then select Create checksums 4. In this example, (3) three checksums will be created, one for the (4) four files and one for each subdirectory. The sha1sum.txt file will be created in each directory identifying all of the files with a unique hash number. When the previous Step (4) completes successfully, you will receive a similar dialogue box with the message at the bottom left, that indicates There were no errors. FRCC SECURE DATA TRANSFER AUGUST

23 5. In this step, the package is created. First, right click the folder with the evidence and click More GpgEX options and Sign and encrypt. FRCC SECURE DATA TRANSFER AUGUST

6. In this step perform the following: a. In the Encrypt for Others box, Click on the? and select the FRCC Compliance (Live Key) key, then click Ok. b. In the Output text box, modify the file name, changing the /tar.

24 6. In this step perform the following: a. In the Encrypt for Others box, Click on the? and select the FRCC Compliance (Live Key) key, then click Ok. b. In the Output text box, modify the file name, changing the /tar.gpg text at the end to the desired submission name determined in step 1 (e.g., ABC.XYZ ) so that it reads /ABC.XYZ gpg c. Click the Sign/Encrypt button; Enter your passphrase if needed and click Ok. d. It will then sign and encrypt the file. You should see the file appear within the folder and the dialog box should have the message. Signing and encryption succeeded ; click the Finish button 7. Highlight both FRCC Public Key and your Private Key for signing and click [Add] and then click [Next] and click [Next] again. Note: the FRCC Public Key and Private Key used to sign the package have moved to the bottom window. On the next screen, select Sign with OpenPGP, then click [Sign & Encrypt]. A pinentry message box will pop up. Enter your passphrase/password and then click [OK] FRCC SECURE DATA TRANSFER AUGUST

25 9. Upon successful completion of the sign and encrypt process, the dialogue box will show a message Signing and encryption succeeded, click [Finish] FRCC SECURE DATA TRANSFER AUGUST

26 This is what your Encrypted Package Ready for Upload will look like: Note: If the file is not named correctly during the packaging process, the file can be renamed prior to sending. Renaming the file does not affect the signature or validity of the file FRCC SECURE DATA TRANSFER AUGUST

10. At this point you should find the original evidence folder and the newly encrypted file using the correct naming

The encrypted and signed file is ready for upload via the FRCC Secure File Transfer.

If in doubt, perform a right click on the encrypted file properties and verify.

27 10. At this point you should find the original evidence folder and the newly encrypted file using the correct naming convention (example: XYZ.CIP ). The encrypted and signed file is ready for upload via the FRCC Secure File Transfer. NOTE: When the program encrypts the folder, it will tag the file extension with the suffix.gpg automatically. If in doubt, perform a right click on the encrypted file properties and verify. Example below shows both the file and type of file in the General tab and the full file name in the Details TAB. 11. If the file is named incorrectly and is already encrypted, simply rename the encrypted file to the correct name. You are ready to upload the evidence. FRCC SECURE DATA TRANSFER AUGUST

Part 7 - Transferring the Evidence to FRCC 1. Go to the FRCC Secure Transfer Site via https://securetransfer.frcc.com 2.

com The Secure Transfer Site is filled with lots of help. Before you call, first make sure the password has not expired and needs to be reset.

28 Part 7 - Transferring the Evidence to FRCC 1. Go to the FRCC Secure Transfer Site via 2. Login using the FRCC website login credentials: UserID and Password provided to you. Otherwise, request a UserID and Password by ing compliancemanager@frcc.com The Secure Transfer Site is filled with lots of help. Before you call, first make sure the password has not expired and needs to be reset. Reference the documentation or file upload name calculator via the Assistance and Documentation for Secure Transfer links at the bottom of the page. If you forgot the password or not able to logon or getting an error message when you try to authenticate with USERID and PASSWORD, chances are you need to RESET via this LINK: FRCC SECURE DATA TRANSFER AUGUST

If so, select the box that says Do not show this again for this

29 3. After a successful logon, you will receive this Welcome Message: You may receive a Java security warning message. If so, select the box that says Do not show this again for this app and web site and click [Allow] button FRCC SECURE DATA TRANSFER AUGUST

4. Now you will see (3) folders: XYZ File Area, where XYZ is the acronym of your entity identifier, SecureVault and SecureWorking : The folder(s) in the File Area is for FRCC to share or provide

30 4. Now you will see (3) folders: XYZ File Area, where XYZ is the acronym of your entity identifier, SecureVault and SecureWorking : The folder(s) in the File Area is for FRCC to share or provide information or documents to entities. Files in this area are deleted after 10 working days. DO NOT UPLOAD FILES TO THIS FOLDER!!! If a file or files are uploaded to this folder, FRCC will reject the upload and request that the entity resubmit using the required process. For evidence upload, FRCC offers entities two distinct folders to deposit their evidence: SecureWorking (SW) and SecureVault (SV). Evidence deposited in SW is used for all sensitive evidence and SV is used by those entities that consider some of their CIP data as most sensitive (firewall configurations and un-redacted network diagrams). NOTE: Because both SW and SV servers are both using a high level of encryption (e.g. PKI and AES), entities are encouraged to deposit evidence in the SW folder. FRCC SECURE DATA TRANSFER AUGUST

31 If you have any questions about this process, please Revision History Version Date Editor Description V1.0 5/2/2016 C. Valiente Creation of this guide V1.1 7/16/2016 C. Valiente Clarifications on steps were added. V1.2 7/28/2016 C. Valiente Updated New Evidence Type Table V1.3 8/10/2016 C. Valiente and M. Alba Updated with corrections and clarifications. V1.4 9/2/2016 C. Valiente, J Guentner, Wordsmithing to enhance clarification for M. Alba and R. Ramai V1.5 4/28/2018 C. Valiente and R. Ramai users. Update User Instructions and Data Classification FRCC SECURE DATA TRANSFER AUGUST

FRCC Secure Transfer & Storage Infrastructure. Training for new data transfer process

FRCC Secure Transfer & Storage Infrastructure Training for new data transfer process Training Objects Understand the changes in regards to the data transfer process using PKI Installation Key management