I always really struggled to understand how encryption works and how it keeps businesses’ laptops safe.
I was confused because one day I had a non-encrypted laptop for which I used a password to get into, but which I also had a key fob that would give me a random number at the time of logging in, which was needed. And the day that I was given an encrypted laptop, I no longer had to use the two-factor authentication. It really confused me as to how that was going to be safer. But it is.
Protecting with a Password
Let’s imagine that instead of a laptop, you want to protect your clothes whilst you go for a swim. All the lockers are taken, so you need to leave your bag in the changing room. To keep it safe, you’ve added a lock. You’ve picked a lock with a combination code to open and close it, so you don’t have to carry the key into the swimming pool.
If someone can guess your code, they can open up your bag and grab your phone. And your clothes. And you’ve got an embarrassing walk home…
A 3 digit combination lock has 1,000 combinations. Going through each of those could take a little bit of time, although it could be very quick too.
But our opportunist thief can sit in the changing room, trying out combinations for as long as they like until they settle on the right number.
Even if you add some more digits and some more complexity, they can still take all the time they like, and once they’ve tried all of the necessary combinations, the contents of your bag are theirs.
Maybe they can’t crack it sitting right there – they can still grab the bag and try in more comfortable surroundings, or forcibly cut the lock off. And they’ve got your stuff.
This is like the old, unencrypted laptop. The opportunist can try as many times as they like to crack the code; and failing that they can bypass your operating system and extract your data directly from your hard drive.
Adding Encryption
So what happens when you add the extra protection of encryption?
For you, not much has changed. You still have your combination lock, and you still need to remember your code. The person trying to get access to the contents of your locker can still try to guess your code, and if they do, they’ll get access to your clothes.
But if they can’t guess your code, and instead steal your bag and try to cut the padlock off, the contents of your bag have been scrambled and shredded into something unrecognisable. The contents of the bag are useless without the key to that lock.
Similarly, if the thief of your encrypted laptop has failed to guess your password and tries to access the hard drive directly, that data is encrypted – unusable.
Hardware Backed Authentication
Most modern encrypted devices also add a second layer on top of this. In our analogy, this is an attendant in the changing rooms, who is paying attention to everything going on around them.
Guessing your combination wrong once or twice will get their attention, and spending several hours fiddling about with the numbers on a lock is likely to result in the opportunist being asked to leave the premises – without your bag.
A laptop with hardware backed protection will give you a restricted number of tries for guessing the password, and the gap between guesses gets longer and longer each time (as you may have experienced if you’ve ever handed your phone to a toddler, thinking there’s nothing they can do if the screen is locked…). Eventually, it will be locked permanently.
A Note on Password Strength
Back to that password, whilst complexity is a good tool, hence all the frustrating requirements for a different combination of capital and lower case, special characters and numbers on different services.
But a forgotten password can be even more problematic, either meaning that you are locked out from your data, or requiring easy password reset processes which can also be manipulated by people hoping to get access. And if you reuse passwords across sites and tools, it stands a much higher risk of being cracked.
The most useful password is a LONG but memorable password or passphrase, but nothing that someone could use social engineering to guess.
For example, I have just checked 2 potential passwords. The first was complex, taking a phrase and substituting numbers for letters etc. It had 10 characters, including upper case, lower case, a special character and numbers.
The second was 4 normal but unrelated words, separated by full stops – granted this was now 27 characters, but so much easier to remember. I picked my words from things that were on my desk, but there are more sophisticated ways to do this.
The first password would take someone less than a second to crack, assuming that they were working offline with a hash database and the kit to crack quickly, working at ~10 billion guesses/second.
The second one would take 80 years.
Other Tools
Two Factor Authentication
I mentioned two-factor authentication (2FA) earlier, which is a different layer again, which has had various surges and slumps in popularity.
2FA means that you don’t just need something you know to log in (your password), you also need something you have (a fob which generates a random number, your phone, a card) which adds additional protection to your accounts or device – you’ll always need both to log in, which is much harder to crack. 2FA is still one of the cheapest and most effective protections available, encrypted device or not.
Password Managers
Password managers can be really useful meaning that you can keep track of different passwords across different tools and sites, and it can even generate secure passwords for you. Choose carefully, though. Whilst security breaches at password manager providers are rare, they do happen; and if you forget your credentials for your password manager, account recovery can be difficult.
Passkeys
More and more sites are also now enabling passkeys. These provide a different type of security altogether, removing the guessable password altogether and making use of public/private key approaches. This is definitely an area to keep your eye on, both for ease of use and security.
An important development with passkeys is that it can really help to avoid phishing attacks, where bad actors try to trick you to adding credentials to fake sites, as the passkey will only work on the legitimate site.
This will be of huge value once they are more commonly supported – but that benefit is undermined for now, as often a site will let you fall back to a password if the passkey isn’t available, and in a world where we are all using a variety of different forms of logins, a phishing site asking for a password instead of a passkey might not get the scrutiny that it deserves.
The Takeaway
Each element of security you add reduces the risk of someone accessing your data, and all of the consequences that brings. But it’s not a ladder with each rung better than the last – it’s a range of tools for a range of circumstances and risks. I have more security on my house, which holds all my precious people and things, than I do on my garage, which holds mainly a lot of old tat…
So when you’re looking at device security, remember that no-one can steal something that you don’t have with you – data minimisation should always be the first question. Do I need to have this on my mobile device? Could it be on a remote server which requires additional authentication rather than on my hard drive?
And then it’s fair to say that if your device holds personal data, encryption isn’t optional in the way it once felt. It’s now the expectation of regulators, and of insurers even for other kinds of data. Most modern devices come with it built in, but check yours does, and check it’s switched on.
There is no “one size fits all” for data security. Fort Knox is not available to us all (nor is it very portable). As ever, the key to compliance – and avoiding nightmare scenarios and sleepless nights – is to think things through and make a sensible decision based on the risks and options available to you, and if you want brownie points for me, keep a record of the decision and the reasons for it.