User Guidance and Responsibilities

Office 365 is the e-mail system provided for all users of Hwb (learners require consent).  It is a standards-based e-mail system that benefits from a number of configuration options that can provide robust security.

The default configuration of Office 365 provides a secure way of sending e-mail between Hwb users as well as some partner organisations. The link to the current list of verified partner organisations is here; Trusted Domains.

The list of partner organisations that are configured to receive secure e-mail from Hwb is established in conjunction with local authorities and regional education consortia.

Note: Until a partner organisation has been verified it should be assumed that e-mails will not be secure and enhanced controls considered.

Office 365 has additional options for encrypting sensitive e-mail. Further guidance should be sought from your headteacher or local authority information security officer as required. For more information please visit Security Controls.

The following flowchart provides a graphical representation of the recommended decision process for deciding the appropriate encryption method for e-mails containing personal data and a similar process can be applied to other sensitive data.

G Suite for Education and Office 365 both have options for working collaboratively:

G Suite for Education:

• Classroom
• Team Drives
• Sites

Office 365:

• Teams
• Groups
• SharePoint
  (incorporates both directory and site functionality)

With a potentially large number of users with access to shared working areas, care should be taken when storing sensitive data in these areas.

Specific areas for securely collaborating with sensitive data can be configured to help ensure:

• access is constrained to those with a need to know the information
• enhanced protection for documents to reduce the risk of accidental release of information

For more information please visit Security Controls.

Note: The enhanced level of protection for documents can necessitate the use of the desktop version of Microsoft Office for creating and editing documents.

For staff with regular access to the most sensitive data additional security controls are available and should be considered (to help prevent password-based attacks).

Hwb provides each user with access to Google Drive and Microsoft OneDrive.

Note: Password protection is available in desktop versions of Microsoft Office.

Password protection of individual files containing sensitive data can be an effective way of ensuring only those with the password can access the contents if confidentiality is a concern.

In such situations advice should be sought about password complexity, length and distribution. Password guidance is available below.

There are many desirable properties for passwords, but this guidance will focus primarily on the properties that are effective for preventing hackers. An effective password would be: 

• Unique
• Difficult to guess

Other desirable properties of passwords sometimes conflict with these, for example ideally a password is easy to remember, but this often results in passwords that are easy to guess or are not unique (an alternative option to easily remembered passwords is recommended below). 

There are two main ways hackers can try to gain access to passwords: 

• Hacking password systems
  If a website is hacked, the hackers might be able to gain access to the password system and copy all the passwords used on the site. They can use these passwords to takeover individual accounts. 
• Phishing attacks
  Phishing attacks will usually only compromise one password at a time, but they do not require hacking into a system first. 

If hackers are able to match a password to your identity, for example via your registered e-mail address or a username, they will try to use the password to access other systems.

For example, if your social media password is the same as your online banking password and a hacker accesses the passwords used on social media they may be able to access your online banking as well. 

While having unique passwords will not help prevent an initial attack being successful, it will prevent subsequent attacks against other systems that you use. 

Some hacking attacks are based on someone trying to access an account by trying to guess passwords, usually this type of attack is based on hackers having a list of passwords that they can use in automated attacks. The lists can be based on combinations of the following information: 

• Keyboard patterns, for example ‘1q2w3e4r’
• Common passwords observed from hacked systems, for example ‘sunshine’
• Names of sports, films, singers or other popular themes

Most systems, including Hwb, have controls to slow down online password guessing attacks, but it is not possible to completely eliminate them.

One of the desirable properties for passwords is that they are easy to remember, but for most people this is not practical without either: 

• Selecting common words as passwords
• Recycling passwords across systems
• Using a repeatable and predictable format

None of the above options results in a password that will reliably resist hacking attacks. 

One alternative to trying to remember multiple passwords is to use a password manager, this is an application that will store all your passwords so that you do not need to remember them. Using a password manager means you can use:  

• Impossible to guess passwords that are highly resistant to brute-force attacks
• A different password for every site you register on 

Many password managers can be synchronised across devices or backed up online to avoid single points of failure. 

Using a password manager is highly recommended.