Encryption for your Business
To maintain compliance, many businesses are encouraged or explicitly required to encrypt sensitive information. While this includes information stored on a computer, often the use of e-mail encryption is often neglected. For businesses that are merely encouraged (rather than required) to use encryption, often they must have pre-written documentation justifying why encryption is not being used, in preparation for an audit or other industry review. Specific industry standards include:
- Health-related fields such as doctors, physical therapists, psychologists and mental health counselors are encouraged to consider the use of encryption technology for all patient information and other protected health information (PHI) as per the Health Insurance Portability and Accountability Act (HIPAA).
- Financial institutions and insurance companies are also encouraged to use encryption as per the Gramm–Leach–Bliley Act (Financial Services Modernization Act). Financial institutions are additionally advised to protect personal data from unauthorized access and misuse by the Payment Card Industry Data Security Standard (PCI DSS), specifically as per Requirements 3, 4 and 7 of the Standard.
- Accounting firms are required to present information on the effectiveness of internal controls in their annual report as per the Sarbanes-Oxley Act. The best practices of this act are further defined by the ISO/IEC 27002 information security standard, which strongly encourages the use of encryption.
Security Recommendations
This is not intended to be a comprehensive list; rather, a collection of the often overlooked issues in regards to security in a business setting.
- Encrypt the contents of all portable computers (laptops and netbooks).
- Encrypt the contents of all backups, external hard drives and USB flash drives.
- When replacing your computer or laptop, have the hard drive scrubbed of all sensitive data.
- Know and understand how to use SSL encryption on the Internet when accessing any sensitive or regulated information.
- Never, ever store your laptop in your car or the trunk of your car, even if "only for a moment". The majority of laptop thefts occur from cars, airports and hotels.
- Use e-mail encryption software for all correspondence.
- Do not use business computers for personal use or "web surfing" to prevent hackers, viruses or spyware from accessing your data.
- Use complex and unique six-character or longer passwords that use a combination of uppercase and lowercase letters along with numbers. Change your password on a regular basis and never store it in a document on your computer.
- Secure your wireless network with up-to-date industry-standard encryption.
- Change the default password on your wireless router and disable remote administration to prevent unauthorized access.
- Use business-class firewall software on your computer to limit the spread of computer viruses and other infections.
- Use a strong antivirus and antispyware program and keep it up-to-date. Don't skimp on the cost or forget to renew your annual license.
Home > Encryption
