How to Encrypt Files Containing Sensitive Data (using 7zip software or Microsoft password protection) How to Create Strong Passwords School IT Systems Support Standards and School Effectiveness Hertfordshire Development Centre SROB220, Robertson House, Six Hills Way, Stevenage, Herts, SG1 2FQ Doc Ref S1218 Published January 2012 School IT Systems Support (SITSS), Hertfordshire County Council Technical Support Centre Accredited by the Learning and Performance Institute (formerly, Institute of IT Training) RM Approved Support Partner Fully accredited by Capita SIMS for proven quality of SIMS support
CONTENTS FOREWORD... 1 DOWNLOADING THE SOFTWARE (7-ZIP)... 2 ENCRYPTING DOCUMENTS, FILES OR FOLDERS... 4 TO ACCESS THE FILE (DECRYPTION)... 6 HOW TO SECURELY ENCRYPT A WORD OR EXCEL DOCUMENT (SIMILAR METHODS EXIST IN THE OTHER MS OFFICE PRODUCTS)... 7 Using Word 2003... 7 Using Excel 2003... 8 Using Word 2007... 9 Using Excel 2007... 10 Removing Password Protection from a Word 2003 Document... 11 Removing Password Protection from an Excel 2003 Document... 11 Removing Password Protection from a Word 2007 Document... 12 Removing Password Protection from an Excel 2007 Document... 12 CREATE STRONG PASSWORDS... 14 PROTECT YOUR PASSWORDS FROM PRYING EYES... 15 TOP TIPS FOR INTERNET SAFETY AT WORK... 16 S1218
School IT Systems Support Foreword Schools may choose to use any email provider other than the HCC preferred supplier of Microsoft Live@Edu. It is therefore vital that files containing sensitive or personal data are encrypted or at least password protected (until your school has software encryption such as 7-zip) before transmitting electronically. This document offers a solution using 7-zip software and instructions on password protecting an Excel or Word document. It is recommended that such protocols are included in the school s ICT Acceptable Use Policy which should be issued to all users. For more information on Microsoft Live@Edu please click on the following link. http://www.thegrid.org.uk/eservices/email/index.shtml The following extract is taken from FAQs concerning Live@Edu. http://www.microsoft.com/liveatedu/faq.aspx?locale=en-gb&country=gb Can I trust Microsoft with my school's data? Yes, Microsoft is committed to the security and privacy of your school's data. We apply enterprise-grade standards and processes that have come with 30+ years of experience. Live@edu securely stores data with multiple datacenters around the world and does not show 3rd party ads in the email interface. Also, Live@edu services are engineered with essential controls for Education, such as bad word filter, anti-bullying or closed campus functionality. Check out Securing Microsoft Cloud Infrastructure (http://www.globalfoundationservices.com/security/documents/securingthemscloudmay09. pdf) for more information. BUT note that the transport of emails to users is still vulnerable unless they use a specific secure method of accessing the email. For schools not using Live@Edu it is vital that confidential or sensitive data that needs to be emailed from schools is encrypted to a min of AES 128 bit level using encryption software such as 7-zip. Each workstation that will be used for sending such emails will require this software installation. Your technical support supplier may be able to deploy this software as a package to the relevant workstations. All SITSS managed schools will have 7-zip software installed on CC3 and CC4 machines. If you have any issues installing this software then contact your technical support provider. Select Option 1 followed by Option 2 if you would like general help or advice regarding email and internet connectivity or email sitss.internet@lea.herts.sch.uk Doc Ref S1218 1 of 17
School IT Systems Support Downloading the Software (7-zip) 1. Go to www.7-zip.org/download.html 2. Select the Download for Any Windows version ignore the blocker at this stage if it appears 3. Wait for the clock to countdown and Click on 7-Zip hyperlink 4. If a download blocker appears click on options and select Download File 5. Click on the Download box, again checking if any blocker appears as in previous step 2 of 17 Doc Ref S1218
School IT Systems Support 6. Select Save and choose a location to save the file to 7. When the file has been downloaded close the panel 8. Go to the location that you saved it to and double click the 7z ***.exe to initiate the installation. (The *** is the version number which you downloaded) 9. Click Run 10. Accept the default location 11. Select Install. The application will install, close the panel by the Finish button. You will now be able to encrypt files and folders that you can send by email Doc Ref S1218 3 of 17
School IT Systems Support Encrypting documents, Files or Folders 1. To encrypt your documents, files or folders run the 7Zip File Manager program 2. Select the location of the file that you wish to encrypt in the drop down box 3. Highlight the file and then select Add Browse Button Enter Password Encrypt file names The Add to Archive window will open and you will be offered a number of options. 4. Archive. This is where the encrypted document or folder will be saved. The default location is the same folder as the original document. You have the option to save to another folder by selecting the Browse button and browsing to the required folder 5. Archive Format. The default format is 7z but it is recommended that this is changed to zip format by using the dropdown option. Using the zip format means that the recipient of the e-mail will be able to use any standard zip software, including the Microsoft built-in zip compression, and therefore will have no need to install 7zip themselves 4 of 17 Doc Ref S1218
School IT Systems Support Change to zip 6. Enter the password that you require which should be EIGHT characters, mixing numbers and letters. Re-enter the password. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons 7. You can select that the file name also be encrypted if you wish. It is recommended that the file name or the subject name of the email does not contain information that could identify individuals 8. All the other defaults can be left as they are 9. A file will then be created in the location that you chose. It will be the same name as the original file but with a.7z file extension (some file extension may show as.7x but behave the same) 10. Open your email program, attach the encrypted document to the email and then send it to the intended recipient. Please note that the recipient must also have 7- Zip installed on the PC upon which the attachment is to be opened If you have any issues installing this software then please contact your technical support provider. Doc Ref S1218 5 of 17
School IT Systems Support To Access the File (decryption) 1. To access the file Open the email and Save the encrypted document to a folder, My Documents for example Extract Enter Password 2. Open 7Zip file manager, select the document and click Extract 3. Enter the password which should have been sent in a separate communication 4. By default the decrypted document will be extracted to the same folder as where the encrypted document was saved to, now access the file using the usual application ie Microsoft Word or Excel 6 of 17 Doc Ref S1218
School IT Systems Support How to Securely Encrypt a Word or Excel Document (similar methods exist in the other MS Office products) Using Word 2003 1. Create your document 2. When finished, choose the Save As option from the File menu 3. In the Save As dialogue box, choose Tools > Security Options 4. Enter the password that you require which should be EIGHT characters, mixing numbers and letters. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons 5. Select the Advanced Button 6. From the dropdown in the Encryption Type Box, choose RC 4 Microsoft RSA SChannel Cryptograhic Provider 7. Click Ok Doc Ref S1218 7 of 17
School IT Systems Support 8. Confirm your password remember that passwords cannot be recovered so ensure that you make a note of passwords and the corresponding documents 9. Click Ok and Save your document 10. Attach the document in the email as required. Remember the subject of the email should not identify individuals and the password should be sent to the recipient in a different communication Using Excel 2003 1. Create and finish your document 2. Select the File menu and choose the Save As option 3. In the Save As dialogue box, select Tools > General Options 4. The Save Options box will then open. Enter the password that you require which should be EIGHT characters, mixing numbers and letters. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons 8 of 17 Doc Ref S1218
School IT Systems Support 5. Click Advanced and in the dropdown on the Encryption Type box choose RC 4 Microsoft RSA SChannel Cryptograhic Provider 6. Click OK 7. Re-enter password - remember that passwords cannot be recovered so ensure that you make a note of passwords and the corresponding documents. Click Ok 8. Continue to Save the document to a location of your choice 9. Attach the document in the email as required. Remember the subject of the email should not identify individuals and the password should be sent to the recipient in a different communication. Using Word 2007 1. Click the Microsoft Office Button, point to Prepare 2. Select Encrypt Document 3. Enter the password that you require which should be EIGHT characters, mixing Doc Ref S1218 9 of 17
School IT Systems Support numbers and letters. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons 4. Click Ok 5. Re-enter the password to confirm and click OK 6. Continue saving your document to a location of your choice 7. Click No if presented with this message 8. Attach the document in the email as required. Remember the subject of the email should not identify individuals and the password should be sent to the recipient in a different communication Using Excel 2007 1. Click the Microsoft Office Button, point to Prepare 2. Select Encrypt Document 3. Follow Steps 3 7 as per Word 2007 10 of 17 Doc Ref S1218
School IT Systems Support Removing Password Protection from a Word 2003 Document 1. Use the password to Open the document 2. Select the File menu and choose the Save As option 3. In the Save As dialogue box, select Tools > General Options 4. The Save Options box will then open, delete the passwords 5. Click Ok 6. Continue to Save your document to a location of your choice Removing Password Protection from an Excel 2003 Document 1. Open the file using the password 2. Select the File menu and choose the Save As option Doc Ref S1218 11 of 17
School IT Systems Support 3. In the Save As dialogue box, select Tools > General Options 4. The Save Options box will then open, delete the passwords 5. Continue to Save your document to a location of your choice Removing Password Protection from a Word 2007 Document 1. Use the password to open the document 2. Click the Microsoft Office Button, point to Prepare, and then click Encrypt Document 3. In the Encrypt Document dialog box, in the Password box, delete the encrypted password, and then click OK 4. Save the file Removing Password Protection from an Excel 2007 Document 1. Do one or both of the following: Open the file using your open password and as read/write Open the file using your modify password and as read/write 2. Click the Microsoft Office Button, and then click Save As 3. Click Tools, and then click General Options 4. Select the password, and then press DELETE 12 of 17 Doc Ref S1218
School IT Systems Support 5. Click OK 6. Click Save 7. If prompted, click Yes to replace the existing file Doc Ref S1218 13 of 17
School IT Systems Support Create Strong Passwords Strong passwords are important protections to help you have safer online transactions. Keys to password strength: length and complexity An ideal password is long and has letters, punctuation, symbols, and numbers Whenever possible, use at least 14 characters or more The greater the variety of characters in your password, the better Use the entire keyboard, not just the letters and characters you use or see most often Create a strong password you can remember There are many ways to create a long, complex password. Here is one way that may make remembering it easier: What to do Suggestion Example Start with a sentence or two (about 10 words total). Think of something meaningful to you. Long and complex passwords are safest. Turn your sentences into a row of letters. Use the first letter of each word. lacpasikms (10 characters) Add complexity. Make only the letters in the first half of the alphabet uppercase. lacpasikms (10 characters) Add length with numbers. Put two numbers that are meaningful to you between the two sentences. lacpas56ikms (12 characters) Add length with punctuation. Put a punctuation mark at the beginning.?lacpas56ikms (13 characters) Add length with symbols. Put a symbol at the end.?lacpas56ikms" (14 characters) 14 of 17 Doc Ref S1218
School IT Systems Support Protect your passwords from prying eyes The easiest way to "remember" passwords is to write them down. It is okay to write passwords down, but keep them secure. It is critical that you remember your password. If you forget your password and you have used Microsoft software, Microsoft cannot retrieve it. Store the passwords that you write down in a secure place away from the information that they help protect. Use strong passwords that combine uppercase and lowercase letters, numbers, and symbols. Weak passwords don't mix these elements. Strong password: Y6dh!et5. Weak password: House27. Passwords should be 8 or more characters in length. A pass phrase that uses 14 or more characters is better. For more information, see Help protect your personal information with strong passwords http://www.microsoft.com/security/default.aspx Cyber criminals use sophisticated tools that can rapidly decipher passwords. Avoid creating passwords using: o Dictionary words in any language o Words spelled backwards, common misspellings, and abbreviations o Sequences or repeated characters. Examples: 12345678, 222222, abcdefg, or adjacent letters on your keyboard (qwerty) o Personal information. Your name, birthday, driver's license, passport number, or similar information Doc Ref S1218 15 of 17
School IT Systems Support Top Tips for Internet Safety at Work 1. Defend your computer Keep all software current (including your Web browser) with automatic updates and install all security updates that your IT department recommends Use antivirus, antispam, and antispyware software and activate your firewall 2. Think before you share sensitive information Look for signs that a Web page is safe, before you enter sensitive personal or business data a Web address with https ( s for secure) and a closed padlock ( ) beside it Never give sensitive info in response to an e-mail or instant message (IM) request 3. Think before you click Pause before you open attachments or click links in e-mail or IM even if you know the sender; they could be phony. Confirm with the sender that the message is real or visit the official Web site by typing the address yourself Be wary of clicking links or buttons in pop-up windows 4. Use strong passwords Lock your online accounts, computer, phone, and other devices with passwords at least eight characters (longer is better), and include upper and lower case letters, numbers, and symbols Keep passwords and PINs secret. Don t disclose them to coworkers or businesses (like an Internet café operator), or be tricked into giving them away Don t use the same password everywhere 5. Protect yourself from e-mail scams Look out for alarmist messages, misspellings and grammatical errors, deals that sound too good to be true, requests for sensitive info like account numbers, and other signs of a scam Turn on a filter that warns you of suspicious Web sites 6. Protect your data on the go When you use public Wi-Fi, choose the most secure option, even if you have to pay for it. It could include password-protection and encryption Confirm the exact spelling of the wireless network you re connecting to Beware of clever (slightly misspelled) fakes 16 of 17 Doc Ref S1218
School IT Systems Support Encrypt the data on your laptop (or USB flash drive) in case you lose it or it s stolen using software such as Truecrypt. Instructions available on the Grid within the document network_manager_guidance_for_schools_on_data_security_may_2010.doc at http://www.thegrid.org.uk/info/dataprotection/index.shtml#securedata Guard your laptop, smartphone, and PDA as carefully as your wallet For further information or guidance on esafety please visit the Grid at http://www.thegrid.org.uk/eservices/ For further information or guidance on Data Security please visit the Grid at http://www.thegrid.org.uk/info/dataprotection/index.shtml Doc Ref S1218 17 of 17