Awareness : Security Awareness Tips

Encryption: The Key to Privacy and Information Security

Advances in communications and computing technologies allow for easy information storage and transmission. But when information is sensitive, we must be careful and employ safeguards to protect it from unauthorized access, modification, and disclosure.

One such safeguard is encryption. Encryption is a procedure that scrambles information in a way that is decipherable only to authorized individuals or computers. Encryption should be used whenever sensitive data may be mobile, either online or on disk – email, electronic file transfers, laptops, USB drives, CDs, etc.

You probably already know that encryption is used when visiting certain websites that require you to log in. You may notice in your browser the “http” in the address line replaced with “https” (or in a different color), or you might see a small padlock to indicate a secure website. Just as encryption online prevents other people from seeing the sensitive data you type on the web, you should also use encryption to protect sensitive information stored on a laptop, removable disk or other portable storage, in case of loss or theft.

Likewise, if sensitive information MUST be transferred via email, encryption should be used. System administrators should also consider encrypting backup tapes, CDs, DVDs, etc., especially if sending media off-site.

The simple act of encrypting data can help avoid embarrassing situations. If personally identifiable data is lost and not encrypted, Florida data breach law requires notification to every person whose personal information may have been compromised. It also places the University at significant risk of fines, incident response expenses, loss of customers/patients, and damage to our image and reputation. Nationwide, of U.S. residents have been exposed since 2005 over 218 million records.

Encryption can be applied to individual files or an entire drive. Windows XP and Vista both have built-in tools to make documents readable to only your user account. Windows Vista (Ultimate and Enterprise editions only) also offers whole disk encryption. Mac OS X allows for encryption through the Disk Utility tool. It is also highly recommended that encryption be utilized on your home wireless network

Examples of sensitive information that should be encrypted include but are not limited to:

  • Credit card and banking information
  • Social security numbers
  • Protected Health Information
  • University financial information not for public disclosure
  • Research data/intellectual property
  • Personally identifiable donor information
  • Clinical trial enrollee information

If you need help with encryption and other security practices to keep sensitive data secure, contact your IT support group.

For more information

Posted: March 11, 2008