How to Encrypt Files Containing Sensitive Data … · How to Encrypt Files Containing Sensitive Data (using 7zip software or ... HOW TO SECURELY ENCRYPT A WORD OR EXCEL DOCUMENT

School IT Systems Support Herts for Learning Ltd SROB220, Robertson House, Six Hills Way, Stevenage, Herts, SG1 2FQ

Doc Ref S1218 V3

Published February 2014

© School IT Systems Support (SITSS) Herts for Learning Ltd, 2014

Technical Support Centre Accredited by the Learning and Performance Institute (formerly, Institute of IT Training) RM Approved Support Partner

Fully accredited by Capita SIMS for proven quality of SIMS support

How to Encrypt Files Containing Sensitive Data

(using 7zip software or Microsoft password protection)

How to Create Strong Passwords

S1218 V3

CONTENTS

FOREWORD ................................................................................................................... 1

DOWNLOADING THE SOFTWARE (7-ZIP) ................................................................... 2

ENCRYPTING DOCUMENTS, FILES OR FOLDERS ..................................................... 4

TO ACCESS THE FILE (DECRYPTION) ........................................................................ 6

.7z extension files ................................................................................................. 6

.zip extension files ................................................................................................ 6

HOW TO SECURELY ENCRYPT A WORD OR EXCEL DOCUMENT (SIMILAR METHODS EXIST IN THE OTHER MS OFFICE PRODUCTS) ...................................... 8

Using Word 2003 .................................................................................................. 8

Using Excel 2003 .................................................................................................. 9

Using Word and Excel 2007 ............................................................................... 11

Using Word and Excel 2010 ............................................................................... 12

Removing Password Protection from a Word and Excel 2003 Document .......... 13



CREATE STRONG PASSWORDS ............................................................................... 16

PROTECT YOUR PASSWORDS FROM PRYING EYES ............................................. 17

TOP TIPS FOR INTERNET SAFETY AT WORK .......................................................... 18

School IT Systems Support

Doc Ref S1218 V3 1 of 19

Foreword

Schools may choose to use any email provider other than the HCC preferred supplier of Microsoft Outlook 365 (https://login.microsoftonline.com/ ).

However, it is vital that all files containing sensitive or personal data are encrypted or at least password protected (until your school has software encryption such as 7-zip) before transmitting electronically.

This document offers a solution using 7-zip© software and instructions on password protecting an Excel or Word document.

It is recommended that such protocols are included in the school’s ICT Acceptable Use Policy which should be issued to all users.

For more information on Microsoft Outlook 365 please click on the following links.

http://www.thegrid.org.uk/eservices/email/news/

http://office.microsoft.com/en-us/academic/

The following link discusses Data Security within Outlook 365.

http://office.microsoft.com/en-us/business/microsoft-business-security-solutions-FX103045813.aspx?CTT=1

BUT note that the transport of emails to users is still vulnerable unless they use a specific secure method of accessing the email.

Each workstation that will be used for sending such emails will require this software installation. Your technical support supplier may be able to deploy this software as a package to the relevant workstations. All SITSS managed schools will have 7-zip software installed on CC3 and CC4 machines. If you have any issues installing this software then contact your technical support provider.

Call the Service Desk on 01438 844777 Select Option 1 followed by Option 2 if you would like general help or advice regarding email and internet connectivity or email [email protected]

https://login.microsoftonline.com/

http://www.thegrid.org.uk/eservices/email/news/

http://office.microsoft.com/en-us/academic/



mailto:[email protected]


2 of 19 Doc Ref S1218 V3

Downloading the Software (7-zip)

1. Go to www.7-zip.org/download.html

2. Select the Download for any of the Windows version of the .msi – ignore the blocker at this stage if it appears

3. A notification will appear at the bottom of the screen, click on Run

4. If the warning as below is displayed select Run (if no warning is displayed go to step 7)

5. The Setup box will then display, accept the location offered and click Install

6. The Welcome to 7-Zip dialogue will open

http://www.7-zip.org/download.html



7. Click Next

8. Tick to accept the terms and click Next

9. Accept the default Custom Setup and click Next

10. Click Install

11. Click Finish to close the installation



Encrypting documents, Files or Folders

1. To encrypt your documents, files or folders run the 7Zip File Manager program from the Start, All Programs area

2. Select the location of the file that you wish to encrypt in the drop down box

3. Highlight the file and then select Add

The “Add to Archive” window will open and you will be offered a number of options.

4. Archive. This is where the encrypted document or folder will be saved. The default location is the same folder as the original document. You have the option to save to another folder by selecting the Browse button and browsing to the required folder

5. Archive Format. The default format is 7z but it is recommended that this is changed to zip format by using the dropdown option. Using the zip format means that the recipient of the e-mail will be able to use any standard zip software, including the Microsoft built-in zip compression, and therefore will have no need to install 7zip themselves

Browse Button

Enter Password

Encrypt file names



6. Enter the password that you require which should be EIGHT characters, mixing numbers and letters. Re-enter the password. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons

7. You can select that the file name is also encrypted if you wish. It is recommended that the file name or the subject name of the email does not contain information that could identify individuals

8. All the other defaults can be left as they are

9. Click OK

10. A file will then be created in the location that you chose. It will be the same name as the original file but with a .zip or .7z file extension

11. Open your email program, attach the encrypted document to the email and then send it to the intended recipient. Please note that the recipient must also have 7-Zip installed on the PC upon which the attachment is to be opened if you leave the file extension to be .7z

If you have any issues installing this software then please contact your technical support provider.

Change to zip



To Access the File (decryption)

.7z extension files

1. To access the file Open the email and Save the encrypted document to a folder, “My Documents” for example

2. Open 7Zip file manager, select the document and click Extract

3. Enter the password which should have been sent in a separate communication

4. By default the decrypted document will be extracted to the same folder as where the encrypted document was saved to, now access the file using the usual application ie “Microsoft Word” or “Excel”

.zip extension files

1. Open the email

2. Double click on the zipped attachment

3. You can chose to Open or Save the attachment first

4. When selecting to Open the file by double clicking, the follow dialogue box will open

Extract

Enter Password



5. Enter the password that has been sent to you in a separate email

6. The opened file can then be saved to a location of your choice



How to Securely Encrypt a Word or Excel Document (similar methods exist in the other MS Office products)

IMPORTANT

Please be aware that files exported from SIMS as .rtf or any none .doc, .docx, .xls or .xlsx type files cannot be encrypted directly as described in the following instructions. It may have appeared to allow you to encrypt but it will not ask for the password upon trying to open it. You will need to save the file as a Word or Excel document and then encrypt as described.You may see the following warning.

Using Word 2003

1. Create your document

2. When finished, choose the Save As option from the File menu

3. In the Save As dialogue box, choose Tools > Security Options

4. Enter the password that you require which should be EIGHT characters, mixing numbers and letters. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons

5. Select the Advanced Button



6. From the dropdown in the Encryption Type Box, choose

“RC 4 Microsoft RSA SChannel Cryptograhic Provider”

7. Click Ok

8. Confirm your password – remember that passwords cannot be recovered so ensure that you make a note of passwords and the corresponding documents

9. Click Ok and Save your document

10. Attach the document in the email as required. Remember the subject of the email should not identify individuals and the password should be sent to the recipient in a different communication

Using Excel 2003

Please see Important notice on page 8.

1. Create and finish your document

2. Select the File menu and choose the Save As option



3. In the Save As dialogue box, select Tools > General Options

4. The Save Options box will then open. Enter the password that you require which should be EIGHT characters, mixing numbers and letters. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons

5. Click Advanced and in the dropdown on the Encryption Type box choose

“RC 4 Microsoft RSA SChannel Cryptograhic Provider”

6. Click OK

7. Re-enter password - remember that passwords cannot be recovered so ensure that you make a note of passwords and the corresponding documents. Click Ok

8. Continue to Save the document to a location of your choice

9. Attach the document in the email as required. Remember the subject of the email should not identify individuals and the password should be sent to the recipient in



a different communication.

Using Word and Excel 2007

IMPORTANT


1. Click the Microsoft Office Button , point to Prepare

2. Select Encrypt Document

3. Enter the password that you require which should be EIGHT characters, mixing numbers and letters. The recipient of the emailed document will need to know this password in order for them to open it. They should be notified of the password in a separate communication for obvious reasons

4. Click Ok

5. Re-enter the password to confirm and click OK



6. Continue saving your document to a location of your choice

7. Click No if presented with this message

8. Attach the document in the email as required. Remember the subject of the email should not identify individuals and the password should be sent to the recipient in a different communication

Using Word and Excel 2010

IMPORTANT


1. Create and finish your document

2. Select the File menu and click on Protect Document drop-down

3. Click Encrypt with Password

4. Enter the required Password and re-enter when prompted

The password that you enter should be EIGHT characters, mixing numbers and letters. The recipient of the emailed document will need to know this password in order for them to open



it. They should be notified of the password in a separate communication for obvious reasons

5. Click OK

6. The document now shows that a password is required to open this document

7. Save or Save as as normal

Removing Password Protection from a Word and Excel 2003 Document

1. Use the password to Open the document

2. Select the File menu and choose the Save As option

3. In the Save As dialogue box, select Tools > General Options

4. The Save Options box will then open, delete the passwords



5. Click Ok

6. Continue to Save your document to a location of your choice

7. The Save Options box will then open, delete the passwords

8. Continue to Save your document to a location of your choice


1. Use the password to open the document

2. Click the Microsoft Office Button , point to Prepare, and then click Encrypt Document

3. In the Encrypt Document dialog box, delete the encrypted password in the Password box, and then click OK

4. Save the file


1. Open the file using the password

2. Select the File menu and click on Protect Document drop-down



3. Select Encrypt with Password

4. Remove the password from the Password field

5. Click OK

6. Save the file



Create Strong Passwords

Strong passwords are important protections to help you have safer online transactions.

Keys to password strength: length and complexity

An ideal password is long and has letters, punctuation, symbols, and numbers

Whenever possible, use at least 14 characters or more

The greater the variety of characters in your password, the better

Use the entire keyboard, not just the letters and characters you use or see most often

Create a strong password you can remember

There are many ways to create a long, complex password. Here is one way that may make remembering it easier:

What to do Suggestion Example

Start with a sentence or two (about 10 words total).

Think of something meaningful to you.

Long and complex passwords are safest I know my security.

Turn your sentences into a row of letters.

Use the first letter of each word.

lacpasikms (10 characters)

Add complexity. Make only the letters in the first half of the alphabet uppercase.

lACpAsIKMs (10 characters)

Add length with numbers.

Put two numbers that are meaningful to you between the two sentences.

lACpAs56IKMs (12 characters)

Add length with punctuation.

Put a punctuation mark at the beginning.

?lACpAs56IKMs (13 characters)

Add length with symbols. Put a symbol at the end. ?lACpAs56IKMs" (14 characters)



Protect your passwords from prying eyes

The easiest way to "remember" passwords is to write them down. It is okay to write passwords down, but keep them secure.

It is critical that you remember your password. If you forget your password and you have used Microsoft software, Microsoft cannot retrieve it. Store the passwords that you write down in a secure place away from the information that they help protect.

Use strong passwords that combine uppercase and lowercase letters, numbers, and symbols. Weak passwords don't mix these elements. Strong password: Y6dh!et5. Weak password: House27. Passwords should be 8 or more characters in length. A pass phrase that uses 14 or more characters is better.

For more information, see Help protect your personal information with strong passwords http://www.microsoft.com/security/default.aspx

Cyber criminals use sophisticated tools that can rapidly decipher passwords.

Avoid creating passwords using:

o Dictionary words in any language

o Words spelled backwards, common misspellings, and abbreviations

o Sequences or repeated characters. Examples: 12345678, 222222, abcdefg, or

adjacent letters on your keyboard (qwerty)

o Personal information. Your name, birthday, driver's license, passport number,

or similar information

http://r.office.microsoft.com/r/rlidAWSContentRedir?AssetID=XT011004511033&CTT=11&Origin=1033

http://www.microsoft.com/security/default.aspx



Top Tips for Internet Safety at Work

1. Defend your computer

Keep all software current (including your Web browser) with automatic updates and install all security updates that your IT department recommends

Use antivirus, antispam, and antispyware software and activate your firewall

2. Think before you share sensitive information

Look for signs that a Web page is safe, before you enter sensitive personal or business data–a Web address with https (“s” for secure) and a closed padlock ( ) beside it

Never give sensitive info in response to an e-mail or instant message (IM) request

3. Think before you click

Pause before you open attachments or click links in e-mail or IM even if you know the sender; they could be phony. Confirm with the sender that the message is real or visit the official Web site by typing the address yourself

Be wary of clicking links or buttons in pop-up windows

4. Use strong passwords

Lock your online accounts, computer, phone, and other devices with passwords at least eight characters (longer is better), and include upper and lower case letters, numbers, and symbols

Keep passwords and PINs secret. Don’t disclose them to co-workers or businesses (like an Internet café operator), or be tricked into giving them away

Don’t use the same password everywhere

5. Protect yourself from e-mail scams

Look out for alarmist messages, misspellings and grammatical errors, deals that sound too good to be true, requests for sensitive info like account numbers, and other signs of a scam

Turn on a filter that warns you of suspicious Web sites

6. Protect your data on the go

When you use public Wi-Fi, choose the most secure option, even if you have to pay for it. It could include password-protection and encryption

Confirm the exact spelling of the wireless network you’re connecting to

Beware of clever (slightly misspelled) fakes



Encrypt the data on your laptop (or USB flash drive) in case you lose it or it is stolen using software such as Truecrypt. Instructions available on the Grid within the document network_manager_guidance_for_schools_on_data_security_may_2010.doc at http://www.thegrid.org.uk/info/dataprotection/index.shtml#securedata

Guard your laptop, smartphone, and PDA as carefully as your wallet

For further information or guidance on eSafety please visit the Grid at http://www.thegrid.org.uk/eservices/

For further information or guidance on Data Security please visit the Grid at http://www.thegrid.org.uk/info/dataprotection/index.shtml

http://www.thegrid.org.uk/info/dataprotection/documents/network_manager_for_schools_on_data_security_may_2010.doc

http://www.thegrid.org.uk/info/dataprotection/index.shtml#securedata

http://www.thegrid.org.uk/eservices/

http://www.thegrid.org.uk/info/dataprotection/index.shtml