Importance of Encryption (Plus Tools to Use)
You've likely seen headlines for articles about different companies suffering data leaks. Stories about risks to user data and privacy are also common. These hacks are a continuing wake-up call to the need for tighter digital security. This is especially true for those of us who work with sensitive patient/client information. Here, I want to discuss the importance of encryption methods. I will also detail some of the best tools you can use to protect the data on your computer.
This post is targeted to those who work with sensitive information. But, these tools can be helpful for a wide range of uses, including:
- Encrypting your previous tax return files
- Helping to make sure your online accounts aren't hacked
- Keeping your family photos safe
For those working with sensitive information, these tools are crucial. You've likely received emails from work about increasing security. This can include encrypting computers, requiring encryption of phones, and so on.
These precautions are for a good reason, and you should be using them yourself! Once you have everything setup, you won't notice any change to your workflow. (Other than sometimes needing to enter a password).
So why is encryption and security important? If someone steals your unencrypted device, they can read everything on it. If your passwords are weak, people may gain access to your accounts. This means your own data is at risk, but also data about others you work with.
To keep this data safe, there are several free tools available. First, I'll cover what encryption actually is. Then, I'll go through tools for encryption and strong passwords.
What is encryption?
For anyone unfamiliar with encryption, it is a way to protect your data. Applications can usually read all data because they lack protection. Passwords can help, but the data is still there and readable. By encrypting data, you jumble it up so it becomes unreadable. This jumbling follows a pattern based on a key, created at the time you encrypt. When you want the file to be readable, you give access to the key so the data can un-jumbled. By having control of the key, you can choose what/who can read the data and when.
Modern encryption involves a lot of steps that prevent others from guessing the key. Those steps aren't important here, though. Just know that by using the right tools, your data should be safe. So with that, let's look at the available tools:
One of the most important things to encrypt is your hard drive. By default, anyone who gets access to your hard drive can view all files on it. To prevent that from happening, you can encrypt the entire drive. Once encrypted, your system will have a key. It can then decrypt your drive as needed, without you noticing any difference. The key is often protected with your user password. Once you sign in, the decryption can happen as needed.
Many computers also protect the key with a piece of hardware. This extra layer means that the data will only decrypt on your device. (Unless you enter the key, which the encryption software gives you for backup).
For Windows, one of the tools for drive encryption is BitLocker. BitLocker is a tool offered by Microsoft, and free for Windows 8+ Pro. The benefit of BitLocker is the seamless encryption. Once you login, BitLocker handles the encryption/decryption for you. In the end, your workflow doesn't change. Yet if someone gets your hard drive, they cannot read the files on it without your key.
For Mac OS X, you can use FileVault. The process is the same as BitLocker: it happens in the background.
For Android, you can enable encryption in just a few steps. Go to system settings > security > encrypt phone. Your phone then prompts you to setup a PIN and encryption code. You're required to continue using a PIN after encryption, though it's a minor annoyance. After rebooting and encrypting, you're all set. When you restart your device afterwards, you'll just need to enter the encryption code.
For iOS, all you need to do is setup a PIN on your phone and you should be set. iOS has moved to encryption by default, while Android is still in that transition.
Sometimes, you only want to encrypt a set of files or folders. Even with your hard drive encrypted, this can be good for extra-sensitive data. Luckily, this is easy to do!
VeraCrypt, a program based on TrueCrypt, is a great free tool for this purpose. With VeraCrypt, you can create an encrypted file "container." This container acts like a folder that only VeraCrypt can open with a password.
Once created, you tell VeraCrypt where the container is, then enter your password. It will take a moment to decrypt the container, then it acts just like a folder. You can change files, copy/paste in and out of it, and so on. After you're done, just "dismount" the container from VeraCrypt, and everything remains encrypted.
When browsing the internet, many sites already include some encryption. If you see https, and sometimes a green lock icon, then encryption is active. Unfortunately, this encryption isn't always 100% protective. Plus, many sites still do not use it by default.
To encrypt your internet use, you can use a Virtual Private Network (VPN). VPN's encrypt your connection to a server. Your browsing then runs through that server, helping to keep it safe.
If you work at a large institution, they may offer a VPN service. In those cases, using their VPN is ideal (especially for work-related browsing). For personal use, there are many options available. But, you need to trust the VPN service you use! If malicious, the service will see everything you access.
A VPN isn't always needed. If you're at home or work, and the wifi is secure, you're likely fine. VPN's are useful when on public, unsecured wifi. For example, in a hotel, or at a coffee shop.
If you're interested in a VPN service, lifehacker details some options.
If you use weak passwords, encryption won't help to protect your data. Passwords are also the only way to protect much of your data in the cloud. Using strong passwords is a piece of advice that comes up often, and for good reason!
Many people don't use strong passwords because they expect inconvenience. It can be hard to remember, coming up with unique passwords is hard, etc. But you don't need to do most of the work if done right.
Password managers, like LastPass, can create and save passwords for you. You can have a strong, unique password on every site without needing to memorize. On your computer, the password manager will add it for you. On your mobile device, you only need to enter the password once, or use the manager's app. (If you need to see the password, the manager can show it to you).
A good service, like LastPass, backs up your password library. But, first, it encrypts it, so they never know your passwords. The encryption uses your master password (i.e., your "last password"). This password should be long and secure to protect your other passwords. Having that one password is easy, though. Just make sure you write it down and keep it in a safe place as backup!
Encryption and security are important, especially for those who work with clients/patients. As encryption methods have improved, they have become easier to use. As a result, there is no excuse to not use them anymore.
The tools I've listed should make the process painless. Take a couple hours on a weekend, beef up your security. Then, notice little change in your workflow!
Do you use different encryption tools? What has been your experience with them? Are you worried about using encryption? Let me know your thoughts in the comments!
Side note: This is my first post written with Hemingway Editor. The editor is a tool to help keep written work easy to read. If you felt like this post was easier to read, let me know! I can continue to use the tool so my posts are better.