The information that your business collects about its customers and commercial partners can be its most precious assets. Add to this the data that your website handles on a daily basis, and it soon become clear that the protection of that information is critical to the success of your business.
Encrypting the information that passes through your business is now much more efficient than in the past with several vendors offering off-the-shelf applications that any small business can use to effectively encrypt their data. Encryption can also go much further than simply protecting files on your local and remote servers. What about the code that makes up your website or the mobile app your business has created?
And with more business now transacted on the move, it's vital that people working away from your secure offices can also access sensitive files over a secure connection. Today, security and encryption need a more holistic approach to ensure that all aspects of your business' operations are protected.
Making a threat assessment
As no two enterprises are the same, most companies will build their own encryption platform that is specific to their needs. These systems can be built from basic components, but it's important to carry out a data audit to discover which data needs protecting and what level of encryption is needed.
The encryption systems you choose for your business may have to fulfil a number of key roles including:
- Protecting sensitive data on local hard drive storage.
- Delivering secure connections to remote workers.
- Preventing the copying of assets from your website.
- Protection from malware attacks.
- Secure delivery of email communications.
Once you have completed your threat assessment the next stage is to look for encryption systems and vendors that can offer either a unified platform that can be applied to all the areas your threat assessment has revealed as vulnerable, or your business can build its own encryption systems from a number of available components.
Your business encryption choices
For small businesses their encryption platforms will start with their desktop PCs. Both the Windows and Mac OS operating systems have a level of encryption built into them that can be applied to any file, folder or entire hard drives. For Mac users the FileVault encryption system can be turned on via System Preferences. Windows users have EFS or Encrypted File System that can be applied to any file or folder.
Windows 8 (Enterprise and Pro) editions also have what is called BitLocker, which allows you to encrypt an entire hard drive and not just files and folders as with EFS. You can still work with your files normally, and when a new file is created it is automatically encrypted. This level of data protection is useful to give your business a level of protection against malicious attacks on the sensitive data it contains.
Third-party systems also exist including DES and SecureDoc that can offer your business a robust encryption platform that can include files on removable media such as USB sticks. If your company archives a lot of information, securing this with encryption can be achieved with systems such as Pkware's SecureZip.
And if your business uses mobile data systems such as tablet PCs, Symantec have applications that can be used to secure the data on these devices, which can also use a secure VPN (Virtual Private Network) if these devices need to connect to your office-based servers to access sensitive information. All data passing over a VPN is encrypted for security. Look closely at the data encryption component of the VPN your business is using to ensure you're confident that the data moving over the network is secure at all times.
Your business should also ensure that all backups of the data it contains are also fully secured. As the cloud has become more important as a data repository, it's vital that your business ensures that any service it uses to store sensitive data is also secure. Look closely at the service level agreement your business has with its off-site data storage service providers to ensure high levels of security are maintained at all times.
Protecting your online and customer data
If your business has an e-commerce website then you have a responsibility to protect the personal data that your site will handle. This invariably means payment details including debit and credit cards.
Standard encryption for payment information is to use 128-bit encryption using the Secure Socket Layer protocol. Companies that have become leaders in this area include Thwate and Verisign that are now trusted by consumers and should form part of your business' encryption and security systems.
Also, businesses often forget that their websites are themselves part of their digital assets and should be protected with data encryption. Systems like HTML Protector and HTML Guardian can help your business protects its website from unauthorised copying.
The Data Protection Act compels your business to ensure that it manages the collection, storage and manipulation of sensitive personal data competently. The proper application of encryption is a vital component in your business' data protection responsibilities.
Data encryption can offer a secure working environment for your business. However, it is important that the encryption in use doesn't affect the day-to-day operation of your enterprise. Encryption should be an asset and not a burden, so test the encryption systems you are thinking of using before rolling them out across your business.
