This wikipage gives guidance on how to securely send and receive files over the internet.

Main page on Information security | Pages tagged with Information security

Norsk versjon - Sikker sending og mottak av filer og dokumenter

Before selecting the service to use, you must first familiarize yourself with NTNU’s Policy for Classification of Information Assets. The table below is a guide for use of the different services. As a general rule, strictly confidential information must not be transferred over the internet even if extra security mechanisms are used. To share strictly confidential information, infrastructure with strict access control, like TSD or NICE-1, are recommended. Confidential information can be transferred under certain conditions. Familiarize yourself with the risks and local practices at your own unit.

2. Requires encryption

If you are receiving information from an external sender that should be secured (e.g. personal data), the security mechanisms in Microsoft products can be used, as many institutions use O365 products. We recommend using AIP, Password in documents, or encryption using 7-zip. Alternatively, you can use Uninett FileSender with 7-zip as described below.

Send and receive passwords (encrytpion key)

The recipient must know the password you used when the information (file) was encrypted. The password must follow the general requirements for passwords at NTNU.

The password must not be sent via the same channel as the information you are sharing. If you send information over email, you can for example send the password via SMS or secure services like Signal. If you send the password via the same channel as the file, anyone who wishes to decrypt the data will find it very easy.

Sikt FileSender

FileSender is a service provided by Uninett to universities and university colleges in Norway for sharing files internally and externally. FileSender is especially useful when you need to share large files. FileSender requires Feide log-on and you use your NTNU username to log in. The recipient does not need to log in to access the file. You can also receive files from external users via the voucher function in FileSender.

https://filesender.sikt.no

How to send files with FileSender

Log into the service by clicking the Feide button. When you access the service it will look like this:

The file(s) being sent can be added either via drag & drop or via the “Select files” button. If there are very strict requirements for security we recommend that you give the files you are sharing neutral names, because the recipient will be able to see the file name and type in FileSender.

Enter recipient’s email(s), subject of the message and the message text. The last two are optional.

If you are transferring confidential data the files must first be encrypted using 7-ZIP and the password must be sent separately in a different channel, for example SMS. “File Encryption (beta)” must not be used as it is not secure enough. Additionally, we recommend using the parameter “Expire” to set an expiry date on the file so that confidential information is not kept in FileSender longer than necessary.

When everything is ready ,click the “Send”-button at the bottom, in the middle of the page. You will then get a “receipt window” where you can check if the file has been opened:

The recipient will receive an email with a link to the download site. When you click the link, you will arrive at the following site (does not require login):

After the recipient has clicked “Download” they will be asked to enter the file’s password. The file opens when the correct password is entered.

Receiving files from external users with FileSender

Through FileSender, you can receive files from external users who do not have a FEIDE-logon. This function can be useful in cases where you need to collect personal information for different purposes (job appointments, diplomas, etc.). Choose the “Ask for files” button as illustrated in the picture below (this will send the recipient a “voucher” via email). Note that you still need to exchange an encryption key via another channel than email.

Enter recipient’s email(s), subject of the message and the message text. The last two are optional. VSelect the relevant alternatives for the transfer in the right-hand column. The recipient will receive a link in their email with the voucher. When the recipient clicks on the link they will access a site to upload the file.

If the data being transferred are confidential, the sender first has to encrypt the file(s) using 7-ZIP, and the password must be sent in a different channel, for example SMS. “File Encryption (beta)” must not be used as it is not secure enough. Additionally, we recommend using the parameter “Expire” to set an expiry date on the file so that confidential information is not kept in FileSender longer than necessary.

When the external user has uploaded their file and sent it, it will show up under “Guest transfers” at the bottom of your dashboard in FileSender. When you click on “+” by Transfer ID, you will see the information as illustrated in the image below.

When you click on the download button (marked with red in the image above), you will be asked for the password. If you enter the password the file should open as usual.

Contact

If you have questions, contact the Digital Security Sectionvia email: sikkerhet@ntnu.no