Why use encryption for my small business?

April 8, 2025

A Lesson About Small Business Encryption

Small Business Encryption is a growing solution trend, particularly because it can easily be deployed and add a powerful layer of protection for your business. But what about yours? With all of the complex cybersecurity solutions out there, many believe most are not necessarily suitable for smaller companies. However, several pragmatic solutions can impact companies of all sizes. Have you ever looked into what encryption solutions do, and whether they’re relevant to the work that you do?

What is Encryption?

In simple terms, encryption is like turning your unique messages into a secret code, so that only the intended recipient with the right key can read it. Here’s a few things to help

understand more about it:

• Its like Scrambling Data: Encryption scrambles data (like text, files, or emails) using a mathematical algorithm
• Unreadable Format: This scrambling process transforms the data into an unreadable format called ciphertext.
• Decryption Key: Only someone with the correct decryption key (or password) can reverse the process and read the original, readable data (plaintext). This is built into many tools so you really don’t have to do anything.
• Security: Encryption is crucial for protecting sensitive information from unauthorized access, whether it’s stored on a computer or transmitted over a network. 

• Examples:

  You encounter encryption when you use a secure website like ours (HTTPS), or when sending an encrypted email, etc.
  

MYTHS: Why would I need encryption on my laptop? Isn’t this overkill? 

• I already use a password to log into it, so it is safe.  
• I don’t store important data on my laptop so it does not matter.

CASE IN POINT

Consider the following recent scenario (one which we see regularly):

Stolen Laptop

An Individual’s laptop hard drive was not encrypted. None of the team laptop hard drives are, which is composed of both PCs & MAC.  

• This particular computer did not require a password to log in.  (NOTE:  its always important to have a password/PIN to log into your computer, although criminals can steal data from your computer whether you have a password or not.)
• The computer was stolen out of his car during a lunch appointment.
• The thief quickly accessed sites that were stored temporarily (cached) on the computer.
• The thief stole over 230 passwords quickly.
• Next the thief logged into the employee’s Google Workspace environment and deleted all of his contacts.  We assume all of the contacts were downloaded to support further mischief i.e. phishing attacks on his contact base.
• The thief deleted his OneDrive and emptied the recycle bin.
• The thief logged into his AOL account using the previously stored passkey.  This was easy as AOL was being used as his Google Account Recovery mechanism.
• The individual failed to renew his business’ cyber insurance policy a few months prior.

The victim soon realized there was an issue, and took the following steps:

• Changed his Google Workspace credentials, and forced logged out of all devices.
• The next day, the thief was back in his account by resetting his Google Workspace account using the account recovery mechanisms.
• Once this was realized, AOL account & Google Workspace accounts were reset.
• The victim was, however,  able to recover his data from Google.  Unfortunately, it did not retain any of the file structure. He will now have to go through every item individually.
• One Drive was lost and does not look like it is recoverable.
• The victim had to change their  230 passwords.

A few items to consider: Small Business Encryption recommendations

• encrypt all your business hard drives 
• ensure a proper device password is used
• Some Windows OS (i.e. Windows 10 & 11 home) do not support encryption.  If your laptop can not be encrypted, it is not suitable for business purposes.  
• If you are responsible for an organization, relying on folks to encrypt their drives is not a winning strategy.  We recommend deployment management software such as Remote Monitoring and Management (RMM) or Mobile Device Management (MDM) systems to encrypt your employees’ computer hard drive centrally.

Keep in mind, if your computer drive is not encrypted, everything stored on the computer can be stolen including passwords.

Categories: Definitions, Blog

Tags: Cybersecurity, Phishing, complacent, Encrypt