Impressive display of security clue from the Student Loans Company

[fanf]

The Student Loan Company executive management board minutes from a meeting just over a year ago says the following in section 6, "update on data security processes":

RSJ provided an update on Data Security and advised that information which was being received from external sources confirmed that the transfer of data on removable media devices was now unacceptable. He stated that there was a need to consult with HEI’s as to the method of transferring Attendance Confirmation Reports as SLC now had PGP encryption software available which could replace the previous method of transferring the data via CD’s. He also stated that the PGP software which SLC were using should be checked to ensure that it was on the US Government list of standard encryption as HEI’s are only permitted to use PGP software from this list.

Not shipping media is good. Using end-to-end encryption is good. (Unlike banks which seem to like SMTP over TLS, which provides no additional security for inter-domain communication.) I wonder why the choice of PGP instead of S/MIME - I believe that PGP usually requires an add-on whereas S/MIME is often built in to MUAs. Perhaps they've been nobbled by a vendor.

Comments

[uitlander]

I saw the PGP thing come through on a mailing list this morning. Now, does this mean that we will need to provide PGP to the University?

[fanf]

This should only affect a few staff in the Old Schools, if I understand correctly.

[hilarityallen.livejournal.com]

Which might make it MISD's problem.

[bellinghwoman.livejournal.com]

Depends if Attendance Confirmation Reports are submitted by the individual Colleges or not - I believe I'm right in thinking (although I can't be certain) that each College has its own relationship with the SLC. If ACRs are submitted by the Colleges, MISD wouldn't be involved; if they are submitted by PRAO or SRS they might be.

[simont]

I'm idly wondering why UK higher education institutions are constrained to use crypto from the US government's standard list. I mean, it'd make sense to use such products when talking to US institutions, fair enough, but for domestic use surely they ought to be able to use their own judgment?

[fanf]

The context is communication with the SLC. It looks to me like they have
sensibly decided to follow someone else's security standards for encrypted email,
rather than drawing up their own. The requirements only apply to the very small
number of University or college staff who need to send attendance confirmation
reports to the SLC.