Project

With a continuing increase in cybercrime, businesses have turned to encryption to protect themselves and their data online. Recently, high-profile data breaches have added a sense of urgency for enterprises to ensure their employees are taking preventative action as part of their day-to-day business. Should businesses fail to implement procedures to safeguard the data of their enterprise and customers, they may be subject to fines, bad publicity and a lack of trust amongst customers.

To protect personally identifiable information (PII) and personal health information (PHI) while it is transmitted from one system to another, businesses often implement a secure messaging and document exchange solution. Those requiring seamless secure exchange capabilities within their workflows may integrate a solution, such as DataMotion’s secure message center to enable compliance while not compromising the user experience.

However, using encryption is not always enough to protect your business from malicious attackers. In this blog post, we’ll cover the reasons why a robust data security plan that extends beyond just encryption and other software solutions is important to keep your enterprise data safe.

Security services such as a Virtual Private Network (VPN) encrypt your internet connection. Some businesses believe relying on a VPN alone offers enough protection because it uses a type of encryption to encode data. While VPNs are often a crucial component of data privacy and safety, they are far from comprehensive. In fact, some countries regulate, or even ban, VPN usage, leaving businesses that operate in those areas without a VPN component entirely.

VPN encryption adds an extra layer of protection for browsing activity and sent or received files, and it’s ideal for businesses working with a distributed team or remote employees. That said, even businesses with the most robust VPN membership are still vulnerable to threats such as:

• Malware, spyware, and viruses
• Phishing schemes
• Compromised files and websites
• Unauthorized server access
• Online hacking
• Account mismanagement
• Unsecured data storage
• Data loss through natural disasters

Your business can (and should) use encryption to protect sensitive information and confidential communications. But this should be part of a larger strategy. If a cybercriminal finds a vulnerability somewhere along the data transmission path, or by getting their hands on your data encryption keys, your encrypted enterprise data can still be hacked and your systems compromised.

Below are five reasons why encryption as a sole line of defense isn’t enough to protect your enterprise data:

Encryption converts data into ciphertext, which usually prevents hacker access to it in the first place. Though they can try to bypass it, a high level of encryption, such as AES 256-bit, will provide a strong layer of protection that can take several years to crack. Most software (including DataMotion’s pre-built solutions and APIs) utilizes AES 256-bit encryption.

No matter how high its level, encryption alone does not prevent hacking. If hackers can’t bypass your encryption they will seek out other access points to your enterprise data. Encryption only protects whatever is encrypted, such as your internet connection, email, or files, but it does nothing to prevent you from other online threats. For example, a VPN might encrypt your internet connection, but your online accounts could still get hacked.

Email is particularly vulnerable as it can be intercepted and read. Most services, including popular ones such as Google, can’t guarantee their email is encrypted from every angle.

For example, if you are sending mail from one Gmail account to another Gmail account, great; if you’re sending it “out of network,” Google’s encryption no longer works. There are a number of solutions available to help here. Third-party services, such as those that use SafeTLS, help fully encrypt your email messages, something you won’t find included as a default in just regular old email. Other, more robust and integrable services, such as DataMotion’s secure message center, are available to build secure exchange into an enterprise’s workflows so you can easily and efficiently send sensitive data at scale.

Encryption is a roadblock for hackers, but not a door to a vault–they will simply find another way inside. It’s important to understand that using encryption is still helpful, but you’ll also need to use other methods to prevent data breaches to protect yourself online.

Encryption and a VPN can protect you against malware that is injected onto your device by a hack via your internet connection, but it doesn’t safeguard against clicking on malicious hyperlinks or inadvertently leaving your accounts open to attacks. You still need to avoid visiting risky sites and downloading potentially harmful files.

In a 2021 survey, more than half of the respondents with known data encryption issues cited unencrypted cloud services as a significant part of the problem. For businesses that rely on the cloud for data storage and communication, inadequate encryption could be a costly oversight.

It’s also easy to forget that mobile devices are at risk. There are apps available to encrypt your internet connection and files, but accessing the internet on a mobile device poses the same risk it would as if you were on a regular computer.

Even if you encrypt your internet connections and use caution when visiting websites and downloading files, the risk of a data breach remains. The threat may even lie with your vendors. Take the recent SolarWinds breach for example. A hacker injected malicious code into the vendor’s software update, the update was released, and once the update was deployed a hacker was able to walk right into the systems of a SolarWinds’ customer and steal their data.

Ensuring your vendors take proper precautions to protect their systems is one way to reduce the risk of this type of attack. For instance, DataMotion takes a zero-trust approach to security and uses military-grade encryption to secure your data in motion and limit access to only those people and systems who require it.  

Read more about the SolarWinds breach, as well as how to protect yourself from ransomware.

Even though complete immunity from cyberattacks doesn’t exist, learning about basic net security is likely to keep you much safer compared to the average internet user. When you are aware of the risks of completing certain tasks and know how to spot subtle details, you’ll eventually be able to notice suspicious ads, websites, links, messages and scams in advance.

If you’re running a business, be sure to train your employees so they can also help prevent cyberattacks. Having your employees properly educated on internet security is especially important if they have access to customer data or any devices that contain personal information of any kind. Update training materials and have ongoing awareness plans to keep your team up to date on emerging security risks, especially any that are trending in your specific industry. While you’re at it, take the time to review your current security infrastructure. Remember that security that is complicated won’t get used. If your current security measures are difficult to navigate or disrupt workflows, employees may bypass them, even if they’re aware of the risks.

Consider installing an anti-virus program if you don’t already have one, as it will allow you to scan for malware and remove it. It would be a good idea to use other security software as well, particularly ones that serve different purposes, so you have a higher level of protection overall.

You should also make sure you keep your encryption keys safe — many businesses make the mistake of storing this information on an unsecured server, like an unencrypted cloud platform, or keeping them in the same place as sensitive data.

Human error continues to play a pivotal role in data loss across industries. In fact, an IBM study found that it is a major factor in 95% of data breaches. No matter how highly-encrypted your data is, it is still susceptible to being transmitted to the wrong recipient via email, or otherwise shared via incorrect attachments or unsecured encryption keys.

Pairing encryption with other security and privacy tools, such as a content filter that detects (and then, in some cases, encrypts) sensitive information, and having a detection and escalation plan in place for accidental data misuse is most effective.

Major cloud email services such as Gmail and Yahoo Mail announced their use of TLS about two years ago (TLS is transport layer security – a type of encryption that can be applied to email transmissions). Both services announced they would send email (and attachments) using TLS whenever possible – which means – whenever the receiving email service or server is configured to accept TLS encrypted email.

For the average user – this is a good thing. We certainly hear enough these days about unsecure email and exposure of private conversations – so we should all be thinking about using a secure email service just to keep our communications private. After all – if we wanted them to be public – we could always post them on Facebook! And private conversations can cause harm if exposed to the wrong people – even if there’s nothing nefarious being disclosed regarding our business or personal dealings.

As noted – TLS has been the default transmission policy for Gmail for at least two years – but it was just brought to my attention that you can check if a Gmail message is sent or received using TLS by clicking on the ‘details’ of the message. It looks like this:

Gmail offers details of what TLS encryption is and how it is applied – ‘Learn More’ will take you to a page that describes what is happening when Standard (TLS) encryption is being used:

“TLS is being adopted as the standard for secure email. While it’s not a perfect solution, if everyone uses it, snooping on email will be more difficult and costly than it is today.”

‘While it’s not a perfect solution’ – this means it’s applied ‘opportunistically’. If the far end email service/server is configured to accept TLS – great – everything is secure end-to-end. If not – it drops back to unsecure delivery – and the risks of exposure that presents.

Gmail links to another page that goes into more detail about how TLS works – and again notes that it’s not going to work all the time:

 “Whenever possible, Gmail protects your info by using Transport Layer Security (TLS) to automatically encrypt emails you send or receive. TLS doesn’t work with messages from some email services. 

If you’re on a computer or Android device, you’ll know an email is not encrypted when you see the No TLS icon  . It looks like an open red padlock.”

Where Gmail’s ‘opportunistic TLS’ is good, DataMotion SafeTLS is better.  As an overlay to virtually any email service or address, SafeTLS checks the availability of TLS email encryption before it send the message – and if it is not available, it falls back to an alternative email encryption method that is not dependent on the recipient’s email service or server – so it always works.

SafeTLS gives users and recipients the best of both worlds. TLS is great because it is virtually transparent to the sender and recipient – it just works, and there’s no complexity to receiving the message or attachments. But to be really confident your message is secure (READ COMPLIANT!) – SafeTLS is the way to go. Yes – there’s a small cost to have it. But exposing your secrets, or the regulated information of a patient, partner, or business associate – can cost a whole lot more – in reputation, notification costs, fines or intellectual property loss.

Email encryption allows organizations to protect sensitive messages and increase their compliance with privacy regulations.  One common encryption method, known as opportunistic TLS, automatically tries to secure the path that messages take when they travel to recipient email systems.  Since this type of encryption is completely transparent to users, organizations often utilize opportunistic TLS to comply with privacy and security regulations.

Unfortunately, compliance strategies based on opportunistic TLS result in frequent breaches where sensitive data is sent over the public internet without encryption.