Thread: NZ Information Security Manual

Originally Posted by Bagheera

An outline of the required handling of such information is:
SENSITIVE information should not generally be stored on systems accessible from the public Internet and must:

not be transmitted via email
use GCSB-encrypted access
when working off-site, use encryption on mobile devices communicating over public infrastructure, the Internet or non-agency-controlled networks
use RealMe login authentication.

source: https://www.digital.govt.nz/standard...y-information/

They could debate the finer points between IN-CONFIDENCE and SENSITIVE.

I also hate to tell you this, but some the information on that site is incorrect (and bad). For example email can be used for information up to RESTRICTED, this is what Seemail is for. There is no such thing as "GCSB-encrypted", GCSB encrypt jack shit for other organisations. And encryption is used on almost everything, and nobody in their right mind would use RealMe in the way they prescribe.

If you are looking at NZISM as a path to say the registry cannot exist (or be on the internet) you are barking up the wrong tree. I give you this advice as a person who works in this space.

Originally Posted by vulcannz

They could debate the finer points between IN-CONFIDENCE and SENSITIVE.

I also hate to tell you this, but some the information on that site is incorrect (and bad). For example email can be used for information up to RESTRICTED, this is what Seemail is for. There is no such thing as "GCSB-encrypted", GCSB encrypt jack shit for other organisations. And encryption is used on almost everything, and nobody in their right mind would use RealMe in the way they prescribe.

If you are looking at NZISM as a path to say the registry cannot exist (or be on the internet) you are barking up the wrong tree. I give you this advice as a person who works in this space.

Wot you said

Thanks @vulcannz.
I was hoping you'd educate us on this.
Too good to be true, eh ?