Secure online communications - Revision history

Ivan at 15:01, 31 May 2016

2016-05-31T15:01:00Z

← Older revision		Revision as of 15:01, 31 May 2016
Line 341:		Line 341:


	=='''Online privacy'''==		='''Online privacy'''=

	'''Basic privacy measures when browsing online'''		'''Basic privacy measures when browsing online'''
Line 361:		Line 361:


	=='''Generating and sharing images, video, audio and digital stories'''==		='''Generating and sharing images, video, audio and digital stories'''=

	APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:		APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:
Line 396:		Line 396:


	=='''Managing Organisational Infrastructure'''==		='''Managing Organisational Infrastructure'''=

	The following principles apply to management of organisational infrastructure:		The following principles apply to management of organisational infrastructure:

Ivan at 14:59, 31 May 2016

2016-05-31T14:59:55Z

← Older revision		Revision as of 14:59, 31 May 2016
Line 341:		Line 341:


	==='''Online privacy'''===		=='''Online privacy'''==

	'''Basic privacy measures when browsing online'''		'''Basic privacy measures when browsing online'''
Line 361:		Line 361:


	==='''Generating and sharing images, video, audio and digital stories'''===		=='''Generating and sharing images, video, audio and digital stories'''==

	APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:		APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:
Line 396:		Line 396:


	==='''Managing Organisational Infrastructure'''===		=='''Managing Organisational Infrastructure'''==

	The following principles apply to management of organisational infrastructure:		The following principles apply to management of organisational infrastructure:

Ivan at 14:58, 31 May 2016

2016-05-31T14:58:14Z

Tarryn: /* Virus protection */

2015-05-29T13:05:53Z

Virus protection

← Older revision		Revision as of 13:05, 29 May 2015
Line 244:		Line 244:

	Firefox: NoScript, BrowserProtect, BetterPrivacy1		Firefox: NoScript, BrowserProtect, BetterPrivacy1

	Chrome: NotScripts2.		Chrome: NotScripts2.

Tarryn: /* Virus protection */

2015-05-29T13:04:08Z

Virus protection

← Older revision		Revision as of 13:04, 29 May 2015
Line 231:		Line 231:
	* Hide such data inside another, seemingly innocent type of data using steganography. techniques		* Hide such data inside another, seemingly innocent type of data using steganography. techniques

	='''Virus protection'''=		=='''Virus protection'''==

	Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one's computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.		Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one's computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.
			It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2. GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).
	It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.

	GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).


Line 250:		Line 247:

	Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.		Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.


	='''Dealing with sensitive data'''=		='''Dealing with sensitive data'''=

Tarryn: /* Backing up data */

2015-05-29T13:02:51Z

Backing up data

← Older revision		Revision as of 13:02, 29 May 2015
Line 204:		Line 204:
	Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.		Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.

	='''Backing up data'''=		=='''Backing up data'''==

	'''General'''		'''General'''
Line 230:		Line 230:
	* Hide such data on your portable device in a secret encrypted drive1, or		* Hide such data on your portable device in a secret encrypted drive1, or
	* Hide such data inside another, seemingly innocent type of data using steganography. techniques		* Hide such data inside another, seemingly innocent type of data using steganography. techniques


	='''Virus protection'''=		='''Virus protection'''=

Tarryn: /* Online data storage and sharing */

2015-05-29T13:02:04Z

Online data storage and sharing

← Older revision		Revision as of 13:02, 29 May 2015
Line 135:		Line 135:
	=='''Online data storage and sharing'''==		=='''Online data storage and sharing'''==

	Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.		Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members '''MUST''' use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.

	~~What should NOT be stored in APC OwnCloud~~

	APC'~~s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).~~		'''What should NOT be stored in APC OwnCloud'''

	Collaboration with external partners		APC's OwnCloud instance is '''NOT''' encrypted. Team members '''MUST NOT''' use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).


			'''Collaboration with external partners'''

	Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.		Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.
	Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.		Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.

	Shared calendars
			'''Shared calendars'''

	APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.		APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.

	OwnCloud and contact synchronisation		'''OwnCloud and contact synchronisation'''

	APC staff are encouraged to use APC's OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google's servers.		APC staff are encouraged to use APC's OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google's servers.


	Collaborative document editing		'''Collaborative document editing'''

	Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.		Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.

	Riseup's Etherpad: https://pad.riseup.net		Riseup's Etherpad: https://pad.riseup.net

	MayFirst's EtherCalc (spreadsheet): https://calc.mayfirst.org		MayFirst's EtherCalc (spreadsheet): https://calc.mayfirst.org


	Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.		Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.
	Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.		Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.

	OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.

	Instant messaging and voice		''OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.''


			'''Instant messaging and voice'''

	For team's instant communication, APC uses Jitsi VoIP & instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers).		For team's instant communication, APC uses Jitsi VoIP & instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers).


	Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.		Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.


	Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.		Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.
Line 177:		Line 187:
	If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!		If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!

	To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.
			To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows
			use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.


	Using wifi		'''Using wifi'''

	Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:		Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:

Tarryn: /* Online data storage and sharing */

2015-05-29T12:57:21Z

Online data storage and sharing

← Older revision		Revision as of 12:57, 29 May 2015
Line 133:		Line 133:
	When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don't control.		When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don't control.

	='''Online data storage and sharing'''=		=='''Online data storage and sharing'''==

	Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.		Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.

Tarryn: /* APC Security Policy */

2015-05-29T12:56:58Z

APC Security Policy

← Older revision		Revision as of 12:56, 29 May 2015
Line 60:		Line 60:
	='''APC Security Policy'''=		='''APC Security Policy'''=

	'''Email and email list communication'''		=='''Email and email list communication'''==

	'''Email client security settings'''		'''Email client security settings'''

Tarryn at 12:53, 29 May 2015

2015-05-29T12:53:15Z

← Older revision		Revision as of 12:53, 29 May 2015
Line 2:		Line 2:

	The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.		The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.

	Below is an overview of some of the DOs, DON'Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON'Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.		Below is an overview of some of the DOs, DON'Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON'Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.

← Older revision		Revision as of 14:58, 31 May 2016
Line 296:		Line 296:


	Anti-virus, anti-spyware and back-up applications		'''Anti-virus, anti-spyware and back-up applications'''

	For recommendations on application choice, see Virus protection and Backing up data sections.		For recommendations on application choice, see Virus protection and Backing up data sections.


	Other software		'''Other software'''

	There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.		There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.


	Document sharing standards		'''Document sharing standards'''

	Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.		Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.
Line 313:		Line 313:


	Passwords		'''Passwords'''

	[Basic information and why you shouldn't use the same password for everything]		[Basic information and why you shouldn't use the same password for everything]
Line 324:		Line 324:


	Web browser password managers		'''Web browser password managers'''

	Storing passwords directly in your browser's password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.		Storing passwords directly in your browser's password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.

Line 340:		Line 341:


	Online privacy		==='''Online privacy'''===

	Basic privacy measures when browsing online		'''Basic privacy measures when browsing online'''

	When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:		When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:
Line 350:		Line 351:


	Anonymous browsing and circumvention		'''Anonymous browsing and circumvention'''

	Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.		Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.


	Other anonymous communications		'''Other anonymous communications'''

	Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff's connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.		Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff's connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.


	Generating and sharing images, video, audio and digital stories		==='''Generating and sharing images, video, audio and digital stories'''===

	APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:		APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:
Line 371:		Line 372:


	Storing A/V material and images		'''Storing A/V material and images'''

	Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC's OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.		Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC's OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.


	Sharing A/V material and images		'''Sharing A/V material and images'''

	A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.		A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.


	Phones and Other Portable Devices		'''Phones and Other Portable Devices'''

	All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.		All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.


	Threats Resulting from Social Engineering Activities		'''Threats Resulting from Social Engineering Activities'''

	A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.		A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.
Line 395:		Line 396:


	Managing Organisational Infrastructure		==='''Managing Organisational Infrastructure'''===

	The following principles apply to management of organisational infrastructure:		The following principles apply to management of organisational infrastructure:

	General		'''General'''

	* Administrative passwords to all APC mailing lists will be changed twice a year.		* Administrative passwords to all APC mailing lists will be changed twice a year.
Line 407:		Line 408:


	Staff exit management		'''Staff exit management'''

	* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.		* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.
Line 415:		Line 416:


	Agreement with organisational partners on sensitive information		'''Agreement with organisational partners on sensitive information'''

	When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:		When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:
Line 423:		Line 424:


	Activity-specific security policies		'''Activity-specific security policies'''

	When organising an event that is of a sensitive nature such as when participants' identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:		When organising an event that is of a sensitive nature such as when participants' identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:
Line 434:		Line 435:


	Online Databases and Access to Servers		'''Online Databases and Access to Servers'''

	When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:		When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator: