How and where do I encrypt sensitive client data?

Reviewing how data is encrypted can get buried as a “to do” item – but it should be No. 1!

In Part 1 of this post I looked at what data encryption is, why its important for us to understand it, and what data should be encrypted where. This is Part 2, where I look at some encryption processes and software options.

You are most likely already using different encryption tools for different aspects of data storage and transit; so for example the software used to encrypt emails may be different to the software used for encrypting data stored on servers or PC’s. If you’re shopping for new encryption software, it may not be as simple as finding one provider that does a complete job everywhere.

Software marketing promises data security? Only the small print will tell you if the makers guarantee data security for business purposes

Specific software recommendations are beyond my expertise, but if you start by checking out reviews of encryption software for businesses, you’ll find a very mixed bag of offerings.

Local device Encryption

Some software packages, such as VeraCrypt, will encrypt data held on your local PC hard drive. This is essential for any device which could be stolen or misused by a third party. Another option for local devices is BitLocker, an encryption package that is part of Windows Pro operating systems.

Email encryption

Other encryption software, such as Cellcrypt, offers secure messages and encrypted voice calls for mobile devices. There are also numerous packages that offer end-to-end encryption for emails sent either from desktop computers or mobile devices. Microsoft Office 365 Enterprise E3 and E4 users can configure an email encryption service which does not require the email recipient to download software to unlock the encrypted email – instead they enter a pass-code.

Encryption of data in transit

Our sensitive data travels a lot, which means we need to know where it is going and whether its secure in transit

This is a complex but essential area of IT security and expert knowledge and input is essential. When our data travels, there’s a high risk of that data being accessed if it is not protected. Lower cost “network level” encryption and data protection is possible but it requires a combination of solutions which are beyond the remit of my basic knowledge.

One method is to create and use Virtual Private Networks to encrypt data in transit, commonly between local PC’s, mobile devices and servers on a work network. There is even a free worldwide network called Tor which claims to enable its users to use the internet anonymously and through encryption, and some commercial VPN options can be found here.

Encryption of data held “in the cloud”

So you’re using someone else’s computer to store your data. The provider says its secure and suitable for holding sensitive data, but is that assurance enough? Maybe not, especially if that guarantee cannot be found in the contractual small print. But there are software products which encrypt data you hold on someone else’s equipment, so if it is compromised it cannot be read. One of these products is BoxCryptor.

Encryption of data held on a server

Is the data “at rest” on your server encrypted? If not, it could be vulnerable. On Windows Servers, you can use Bitlocker to encrypt data at rest. Thales (formerly Vormetric) say their products offer encryption solutions for any server.  If you are not sure what server you have and whether data is encrypted on it, you need to know how it is encrypted, and also what the potential vulnerabilities are even if the data is encrypted.

What next?

You and I may be in deep water with this complex area of IT, but we need to know that we have the right solutions in place

As usual as with all IT related matters, this isn’t an easy decision making process and definitely one where you need to orientate yourself on the key issues then carefully assign the practicalities of choice and implementation to an impartial IT professional, with appropriate oversight from management. Now for the important disclaimer:  I cannot verify the suitability of any product mentioned in this post for use by law firms!

Some further guidance on encryption practicalities and the legal framework is provided by the Information Commissioner’s Office, and the Law Society provide comprehensive guidance on Cyber-Security issues for law firms.

If you haven’t done so already, the Law Society’s free online cyber-security course for Legal and Accountancy professionals is a great starting point for getting yourself orientated on the relevant issues. You could also complete a data/information security audit, where you work with IT professionals to complete a comprehensive report or map which shoes you how where your every aspect of your sensitive data is stored and sent, and addresses any potential vulnerabilities.

Whether you’re expert or inexpert on IT issues, your comments are welcome. Please also get in touch with me if you provide IT services to law firms and would like to write regular posts for this site on IT issues.

Share this post, like or follow
RSS
Follow by Email
Facebook0
Facebook
Google+
https://www.lawpracticemanager.co.uk/it/how-do-i-encrypt-data/
LinkedIn11
Martyn

Ben

I set up Law Practice Manager because I enjoy sharing fresh and original opinions and posts on law management issues.
Facebook and Twitter: @LawManager1
LinkedIn group: https://www.linkedin.com/groups/8538343

One thought on “How and where do I encrypt sensitive client data?

  • November 20, 2017 at 11:00 am
    Permalink

    Hi there ,

    I was reading your page here: lawpracticemanager.co.uk/it/how-do-i-encrypt-data/

    I noticed you are linking to a resource on Tor, and while it gave me more info, I was still confused about the difference between Tor and Proxy. After diving more into it, I found this resource that made it all very clear to me: http://www.vpnmentor.com/blog/proxies-vs-vpn-understanding-the-difference/

    I thought other users of yours would enjoy the clarifications too, if you decide to share it with them on your page.

    In hope I helped back.
    Rachel

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close