To ask the Secretary of State for Innovation, Universities and Skills whether his Department uses WPA2 encryption protocol on all its wireless networks. (259812)

Information is a key asset to Government and its correct handling is vital to the delivery of public services and to the integrity of HMG. The Security Policy Framework, the Data Handling Report and the National Information Assurance Strategy produced by the Cabinet Office provide a strategic framework for protecting information that Government handle and put in place a set of mandatory measures which Departments must adhere to.

It is not in the interest of the security of the Department, or that of the public, to disclose detailed information pertaining to the specific technical measures employed to protect our networks (wireless or other). Disclosing such information would enable criminals and those who would attempt to cause disruptive threats to the Department to deduce how to conduct attacks and therefore potentially enhance their capability to carry out such attacks.

The Department follows CESG guidance on the use of the Wi-Fi Protected Access 2 (WPA2) communications security protocols in order to protect wireless networks carrying protectively marked (up to RESTRICTED/IL3) traffic. The configuration and operation standards for WPA2 are set out in CESG’s Infosec Manual Y, Use of WPA2 Wireless Security in Government Systems. The Department also complies with HMG IA Standard No 4—Communication, Security and Cryptography for the encryption of data.

To ask the Secretary of State for Innovation, Universities and Skills (1) if he will place in the Library a copy of his Department’s IT security hierarchy; (259814)

Information is a key asset to Government and its correct handling is vital to the delivery of public services and to the integrity of HMG. The Security Policy Framework, the Data Handling Report and the National Information Assurance Strategy produced by the Cabinet Office provide a strategic framework for protecting information that Government handle and put in place a set of mandatory measures which Departments must adhere to.

It is not in the interest of the security of the Department, or that of the public, to disclose detailed information pertaining to electronic breaches of security of Department’s IT systems. Disclosing such information would enable criminals and those who would attempt to cause disruptive threats to the Department to deduce how to conduct attacks and therefore potentially enhance their capability to carry out such attacks.

To ask the Secretary of State for Innovation, Universities and Skills what IT security policy his Department has; what procedures are in place to ensure the policy is being followed; what his Department’s policy is on encryption of data when it leaves departmental premises; and what sanctions are in place for failure to comply with this policy. (259851)

Information is a key asset to Government and its correct handling is vital to the delivery of public services and to the integrity of HMG. The Security Policy Framework, the Data Handling Report and the National Information Assurance Strategy produced by the Cabinet Office provide a strategic framework for protecting information that Government handle and put in place a set of mandatory measures which Departments must adhere to.

The Department of Innovation, Universities and Skills is compliant with the security policies contained in the Government Security Policy Framework including those for information security and assurance.

Depending upon the circumstances, a range of sanctions are available including disciplinary or administrative action, and in extreme or persistent cases, termination of employment/services and, if appropriate, criminal proceedings.