SLD - PGP Trial Service for Whole Disk Encryption

This document describes the trial PGP whole disk encryption (WDE) service to enable participating users to encrypt devices such as personal computers and laptops

Introduction

OUCS is offering a trial service of PGP WDE. Pilot departments have been identified who will test out a central PGP service. The trial will run from November 1st, 2011 through to October 31st, 2012.

Summary of OUCS's Responsibilities

OUCS will run the central PGP Universal Server for the purpose of policy management, data recovery and 'key management'. This will be hosted on a single server with no redundancy at present for the purposes of the trial. The main boot disk on users devices will be automatically encrypted on enrollment and users will not be able to permanently decrypt the disk themselves. Users will be able to create virtual encrypted drives and will be able to encrypt additional internal disks and removable devices. However, once a disk or removable device is encrypted the user will not be able to permanently decrypt it themselves.

Users will be able to encrypt and decrypt individual files though will not have access to their local keyring via the PGP Desktop client software. The private decryption keys however will be stored in a file on the user's machine. Users must report the loss of any private keys to their IT Support Staff. OUCS will also hold an Additional Decryption Key (ADK) to which any data encrypted to a user's key, will also be encrypted. This could then be used to decrypt any documents in the event of a user losing their own key.

OUCS will be responsible for issuing whole disk recovery tokens (WDRTs) in the event of a user forgetting their passphrase and/or locking their disk. WDRTs will be issued only to the ITSS responsible for a particular user during the duration of the trial.

As this is a trial service, no serviceability targets or hours of service are stated. Similarly, training and support can only be limited to begin with. The service will be offered on a best efforts basis only, but cannot be guaranteed.

Summary of User's Responsibilities

  • Users are responsible for ensuring that all University owned data is backed up before disks are encrypted and that data is backed up regularly throughout the duration of the trial.
  • Users will need to enter their passphrase in order to "unlock" access to their encrypted disk/devices.
  • Users must not disclose their passphrase to anyone, under any circumstances and are responsible for keeping their passphrase secure.
  • In the event of passphrases being written down or stored on electronic media, this should be done in an approved secure manner, such that only the user has access to the passphrase.
  • Passphrases will be stored by PGP Desktop only for the current session. They will be destroyed at the end of the session.
  • Users are responsible for ensuring that security updates are applied to operating systems and any other software, for running up to date Antivirus software, and for maintaining safe browsing habits.
  • HOWEVER, updates to operating systems should not be applied when advised by the WDE project team.
  • Users must report any security incident involving their machine to their local ITSS. This includes any virus/malware infections.
  • Users are responsible for providing keys and/or decrypting files encrypted to their keys at the request of law enforcement under the Regulation of Investigatory Powers Act (RIPA). However the University may also be required by law to decrypt such content by use of the ADK.
  • Users are responsible for checking local import/export laws before taking cryptographic technology abroad.

Known Risks

The following risks have been identified so far, but are considered acceptable to the University for the purposes of this trial project.

  • No formal risk assessment has been carried out for this project and so this list is not conclusive.
  • There is no formal policy on the use of encryption.
  • Users forgetting their passphrase will be unable to access their machines until a WDE token has been issued. OUCS will endeavour to do this within one working day but no guarantees are made for the duration of the trial.
  • No guarantees are offered by OUCS on the level of support, or speed of response, to support requests for PGP Universal Server, due to lack of resources.
  • There is no formal process for testing operating system updates which may cause problems with the PGP software. Testing and advice on updates will be provided on a best efforts basis.

Resources