ENCRYPTION IMPLEMENTATION GUIDE

You’ve gone back and forth on encryption, its benefits and challenges, and you’ve made the decision: to keep your data truly safe, your organization needs encryption. So what now? You’ve got options available, but what is the best, safest way to implement encryption without disrupting your users’ workflow and effectiveness?

Step One:

Time to Start Thinking …

Let’s face it, every company is different, so it stands to reason that a data protection policy will vary from company to company. The data protection requirements of a small delivery company will be significantly different from a large multi-national organization. But everyone is at risk of a data breach.

Data has value. Credit card details, medical histories, financial reports … It all can (and will) be stolen and sold. Data thieves have multiple options available to them: for example hacking, targeted attacks, and malware. At the same time, human error continues to be a major risk factor for causing data breaches, and can be just as hard to prevent as a malicious attack.

We are all human, and we all make mistakes. Who hasn’t accidentally emailed a file attachment to the wrong person, or left a phone or device behind at airport security? Phishing scams are successful at stealing someone’s credentials because we’re not totally vigilant all the time. Unfortunately, the tiniest slip-up can easily lead to a data breach. Most people know that it’s time to start looking into a solution to mitigate these risks and to solve these challenges. But, where do you begin?

Step Three:

Full Disk Encryption

Start with the basics: what happens if your device is lost or stolen? Full disk encryption, sometimes called device encryption, is particularly relevant with the increasing use of mobile devices for business. Most devices come with some sort of built-in protection in the operating system (Microsoft BitLocker in Windows and Apple FileVault in macOS).

But most businesses have some mixture of the two operating systems, four if you include iOS and Android for mobile and tablet devices. You’ll want a cross-platform solution that lets you centrally manage keys and recovery functions across platforms, while at the same time offers strong protection and access control of your encryption keys.

Full disk encryption is important, but it’s also limited in scope – it only protects the device in the case of loss or theft. More important is what it doesn’t do: full disk encryption does nothing in terms of data security for a running device, and does not protect against targeted attacks, hacking, data-stealing malware, other human error scenarios or other threats.

Why is this important? Data loss is a different problem than it was in the past. Research shows the most common cause of data breaches is hacking or malware. This is why we urge companies to simultaneously implement file encryption to run alongside full disk encryption.

The most common cause of data breaches is hacking or malware.

Step Four:

File Encryption

There’s a temptation when setting up your file encryption process to overcomplicate things, picking and choosing what data is encrypted and how, and who can access what information. Some will argue that you should only protect what is important. But that is a part of the problem: if you only protect what is important, you have to identify what qualifies as important. And what happens when your rules for making that determination fail and leave you exposed to a data breach? We recommend beginning the process by encrypting by default. Assume all data created by your employees has value and it’s safest—and easiest—to protect everything. The trick here is to choose an encryption option that is transparent to the employee’s daily workflow.

Transparent means that in the majority of cases it doesn’t require a change in your users’ processes. It also means that they can access encrypted content on all the devices they use to perform their job. Encryption, after all, works best when users don’t realize it’s there. HTTPS is a great example of encryption providing protection with very little to no end user knowledge. Millions of users don’t realize that their browser has swapped from HTTP to HTTPS to protect their order or transaction – it simply works.

When looking to use file encryption, there are a few important choices to make at the beginning:

• Location-based encryption vs. application-aware encryption
• Key management: multiple-key vs. one organization key
• What to encrypt initially

Location-based vs. application-aware

Location-based encryption, often called file and folder encryption, is based on which folders your end users are likely to store important documents in. The challenge with location-based encryption is that it requires your users:

1. to strictly adhere to structured corporate procedures,
2. to know and be able to identify what is important, and
3. to know where they should store these files in order for them to be encrypted.

This opens you up significantly to human error. It requires a lot of employee education and compliance. Inevitably, users will fail to follow proper guidelines or procedures, and sensitive documents will end up unprotected.

In contrast, application-aware encryption—also known as “always-on encryption”—lets administrators define a list of trusted applications employees use to create materials. Only these applications have access to the key(s) needed to create encrypted files and access encrypted content. Wherever the trusted applications save a file, it will be encrypted. Location becomes irrelevant at that point, solving the problem of location-based encryption. Ideally the user never notices this process—the files are encrypted, but because they’re using the trusted application, files open and close without an issue. Application-aware encryption provides less chance of a user making an innocent mistake and accidentally leaving data exposed.

Multiple-key vs. one organization key

Key management can be one of the most complex parts of managing any encryption solution. Fortunately the level of complexity is fully in your control. Again, we recommend beginning simply and adding complexity as needed. By starting with one shared organization key, you begin your encryption process transparently. Internal collaboration is simple, and external collaboration can be easily controlled.

From there, though, there are definitely reasons you might want to assign special keys (or group keys) to select groups. Industry regulations mandate access control based on users’ roles and responsibilities, such as finance or HR departments, which have access to confidential organizational and personal information. A good analogy is ensuring everyone has access to your house, but limiting access to the family safe.

IT administrators can quickly get bogged down with too many group keys, so use them sparingly. Remember, if you start with “always-on encryption” and one organization key, you can revisit the model and add layers later.

What to encrypt initially?

The simplest approach is, as noted earlier, a “day forward” approach; that is, each time an employee creates or modifies an existing document it will be automatically encrypted. For many organizations, there’s no real need to go back and encrypt older documents. If a user updates an older document, the new version will be automatically encrypted. The right encryption solution will, however, give you the tools you need to encrypt older files and documents if you choose, such as encrypting all existing files by extension (.doc, .xls, etc.).