Security Controls

Overview

This document describes the controls available across the range of digital tools in the Hwb Platform and how these tools can be used to enable organisations to maintain the security of the information they use.

Government Security Classifications

The Government Security Classifications cover three levels: OFFICIAL, SECRET and TOP SECRET.

The levels are defined as follows:

_______________

Information processed within the school environment will be at the OFFICIAL level.

For OFFICIAL data, information security controls should:

• Protect against deliberate compromise by automated or opportunistic attack
• Aim to detect actual or attempted compromise and respond

Full details are available in the associated Cabinet Office documentation.

Hwb Security Controls

For Hwb, security controls are referred to as standard and enhanced, only some aspects of Hwb have enhanced controls available.

Standard controls are intended to be suitable for the majority of Hwb users and to provide appropriate protection for low sensitivity personal data and OFFICIAL information.

Control Selection

For personal data the decision about what controls to use lies with the data controller (in schools this will normally be the headteacher).

In addition to the proposed approach for Hwb, formal advice is available on the ICO website to assist data controllers to decide what level of control is necessary.

The following table illustrates typical usage scenarios, however there are likely to be legitimate reasons to deviate from this model depending on a organisation’s specific circumstances; any such deviation is a local risk management decision.

E-mail Security

E-mail is not secure by default, in theory anyone with access to an e-mail as it travels across the Internet can view the contents. The content of an insecure e-mail is similar to a postcard while it is going through the postal delivery system. 

The diagram below illustrates a simple e-mail journey without encryption, it is unlikely that someone with access to the route taken by the e-mail across the Internet will be able to read it, but it is possible. 

Encryption can be used to reduce the risk of e-mails being viewed during transmission between e-mail systems. 

Encryption of e-mail is recommended for any e-mail containing personal data, doing so will ensure that no matter how lucky or clever a hacker is they will not be able to read the contents of the e-mail while it is travelling across the Internet. 

There are many different options for encrypting e-mail, some of which are easier to use than others, though the choice of which encryption method to use should be primarily based on the sensitivity of the e-mail. 

There are three e-mail encryption options available in Hwb: 

• Enforced TLS 
• Office 365 Message Encryption 
• S/MIME 

The following table summarises potential usage scenarios and considerations for use for each of the options available in Hwb. 

Trusted Domains

Hwb has been configured to enforce TLS for all e-mails sent and received to these trusted domains.

Multi-Factor Authentication (MFA)

Authentication is the term used to describe the process of checking someone is who they claim to be.

Most people are familiar with username and password or a fingerprint for authentication and for a long time relying on these was adequate for preventing hackers gaining access to someone’s account.

The different ways of authenticating someone is based on three properties or factors:

• Something you know – this is the most common property used for authentication and usually takes the form of a password or PIN.
  
  
• Something you have – must be a physical ‘thing’ like a smartphone and often will involve submitting a code to confirm that you currently have the item.
  
  
• Something you are – this relies on biometrics like a fingerprint or facial recognition.

In isolation each factor is susceptible to attack, but when combined they can be difficult to defeat. A combination of more than one type of factor is often referred to as 2-step verification (2SV), but also known as two-factor authentication (2FA) or multi-factor authentication (MFA).

Given the increasing incidence and sophistication of phishing attacks, for online systems such as Hwb, the use of an additional factor is a very effective way to ensure that a leaked password does not provide full access to a user’s account and all the information it contains.

The use of MFA is strongly encouraged due to the benefit it has for preventing unauthorised access to information, particularly if it protects personal data of a sensitive nature.  MFA is an important security feature both for organisations and users’ own personal online accounts.

MFA on Hwb (enhanced control)

MFA requires both a password and submission of a time-limited code which is generated by the Microsoft Authenticator app.  All non-learner account holders need to download and install the app on a smartphone or other internet enabled mobile device and link it to their Hwb account if they want to log on to Hwb outside the trusted network of their school or organisation. The app does not need an ‘always on’ internet connection after installation, so it will still work in places with weak or no network coverage.

After the Microsoft Authenticator app has been installed it will generate a code which changes every 30 seconds and must be entered during log on to Hwb. Your Hwb account can only be linked with one instance of Microsoft Authenticator i.e. it can only be used on one smartphone or other internet enabled mobile device. More information about the app is available from Microsoft.

For MFA to be effective non-learner account holders with access to Hwb must not share their smartphone or device with others or leave them unattended and unlocked. 

MFA setup instructions are available on Hwb.

If you have any queries or require assistance, please follow your local IT support arrangements in school or through your local authority in the first instance. Advice and guidance are also available from the Hwb Service Desk: support@hwbcymru.net / 03000 25 25 25.

Collaboration

Hwb has defined recommended combinations of controls applicable to collaboration areas. 

The standard controls are anticipated to be the most suitable configuration for most of the collaborative working undertaken by Hwb users. 

Azure Multi-Factor Authentication (MFA) and Azure Rights Management (RMS), described in more detail below, are Enhanced controls, they are recommended wherever there is a need to work collaboratively with sensitive data. 

Local risk decisions and guidelines should be followed whenever working with personal data, however the anticipated usage scenarios for the different levels are:  

• Enhanced- Suitable for sensitive information 
  • Level 1 – recommended to ensure that documents remain secure by having controls that ‘travel’ with the document.  
    •  This control level may also be suitable where there is an identified need to collaborate with large numbers of external users and confidentiality of low sensitivity information is important. 
  • Level 2 – recommended only for small groups of users; there is a reliance on users’ awareness and vigilance with respect to information security.
• Standard– Suitable for every day working and collaboration, which may include identifiable data, but will normally be unsuitable for more sensitive information 
  It is recommended that external sharing is constrained to small groups of users due to the lack of knowledge of how third parties manage information security.

Personal Files

Multi-Factor Authentication (MFA) – Enhanced Control 

Personal cloud storage drives can benefit from MFA being applied to a user’s personal account, in the same way as other services.

File level Password Protection - Enhanced Control 

Microsoft Office’s native password protection can be used to protect files containing sensitive data, though this does introduce some restrictions on the access methods for the document (summarised below). 

The Google G Suite for Education online applications for files do not directly support password protection.