ICO Blog: Why encryption is
important to data security
By Simon Rice
28 August 2013
Storing any personal information is inherently risky. By recording it, you risk losing it, and that
risks upsetting people, and no-one likes upsetting people. But quite often, if you don’t store
personal data, you can’t provide a proper service. And that risks upsetting people too.
This is why, if you are collecting personal information, you must make sure you are looking after it
in a safe and secure manner.
In order to do this effectively action must be taken to reduce the risks of inappropriate disclosure.
Given that a large amount of data can now be stored on something as small as a smartphone or
tablet PC, there is a real danger that personal information could be compromised should such a
device end up being lost or stolen.
Using appropriate encryption can be a simple and effective means to protect personal data in
these circumstances, and one which we advise all organisations to take if the loss of the data could
cause damage and distress to the individuals affected. However evidence shows that data
controllers are still not addressing the problem.
This blog article aims to provide you with a useful insight into how encryption works and the
encryption options available to you and your organisation to help you keep personal information
secure.
The big misconception
Let’s get this one out of the way first. A common misconception is that just requiring users to login
to a device, or service, with a username and password provides an equivalent level of protection to
encryption. This isn’t the case. A password or PIN to control access to a device isn’t encryption and
it isn’t enough to protect against unauthorised or unlawful access. In practice a password can be
easily circumvented and full access to the data can be achieved.
How does encryption work?
Encryption software uses a complex series of mathematical algorithms to protect and encrypt
information. This hides the underlying data and prevents any inadvertent access to, or
unauthorised disclosure of, the information. This means that even if a device containing personal
information is lost or stolen, the information will remain secure as long as the would-be data thief
isn’t able to access the encryption key required to crack the algorithm.
Appropriate encryption products are widely available, but it is important that organisations
understand the type of protection a particular encryption product offers and the circumstances
under which personal data will be protected from unauthorised or unlawful access.
What encryption software should I use?
There are a variety of different encryption options available. The option that will be the most
appropriate for your organisation will depend on the sensitivity of the information you are using
and how it is being stored and processed.
For this reason it is difficult to provide a comprehensive list of software as everyone’s needs are
different. You can however look out for internationally recognised standards such as those
described on the encryption section of our website.
Full disk encryption
This is a process which encrypts the entire disk including all of the information and personal data it
contains. It is commonly used when encrypting laptops, desktops and mobile devices, such as
mobile phone and tablets. The disk will need to be decrypted with a key, which is often protected
by a password entered by the user, before the operating system boots up.
However, this may mean that there are circumstances when the data could still be at risk. For
example, if someone left a tablet unlocked and unattended in a restaurant then anyone who picked
up that device would have an opportunity to extract the unprotected data. It is also important to
recognise that if a file is transferred off the disk, for example if you sent the information in an
email or saved it to a different device, then the file will no longer be encrypted.
Full disk encryption is provided through a range of widely available third-party software and some
modern operating systems have a full disk encryption mode built-in, but they will usually require
the user to enable the protection.
Individual file encryption
This is a process which will encrypt an individual file or create an encrypted container into which a
set of files can be stored. When the container is closed it is encrypted. This means that if the
container itself is transferred to a different device, for example if it is emailed or saved to a USB
drive, then the personal data remains encrypted. However once the file is removed from the
container it is no longer encrypted.
Some modern operating systems are able to create encrypted containers, while a range of thirdparty software can also offer the same level of encryption. However it is important that this
encryption technique is not confused with adding password protection to a file or folder, as this
process will not result in the data being encrypted.
Most email client software will also support sending emails with the message content and any
attachments in an encrypted format. This approach does however require some initial
configuration of both the sender and recipient’s email software.
Encrypting data in transit
It is also important to know the difference between the encryption techniques used for data
storage and the encryption techniques used in data transfer.
You can transfer data using an encrypted data transfer protocol, such as Secure Sockets Layer
(SSL) or Transfer Layer Security (TLS). This is the technology that displays the padlock symbol in
protected web browsing. It provides assurance that the communication between client and server
cannot be intercepted. Furthermore it provides you with a means to validate where the data is
being transferred to.
The use of an encrypted transfer protocol does not provide any guarantee that data will remain
encrypted, or otherwise processed securely, once it is received at its destination. This will need to
be assessed separately.
The importance of keeping the key secret
You wouldn’t install high end locks on your house, only to leave the front door key under the mat.
The same applies for storing a laptop encryption key or password in the same bag as an
unencrypted laptop, or equally, sending encrypted data as an email attachment with the means to
decrypt it included in the body of the email.
If you do any of these then the safeguards provided by the act of encryption are illusionary,
because all of the necessary information required to decrypt the data is readily available. The
secrecy of the key used to encrypt the data is therefore of paramount importance.
To ensure the maximum level of protection offered by encryption, the key or password should be
transmitted using an alternative means of communication. For example the encrypted data could
be sent by email and the key provided over the telephone once the intended recipient has
confirmed that the data has been successfully received. By adopting this approach, even if you
accidentally send the data to the wrong recipient, the information will remain secure as the person
will not have the necessary key to access it.
And finally…
While encryption sounds like a complicated means of protecting sensitive personal information, the
crucial aspect to making it work is to identify the most suitable form of encryption and follow a
common sense approach to keeping the key, and therefore the data, secure. Using effective
encryption is usually easier to manage than adopting an alternative means of providing a similar
level of data security.
And the time and cost of proper encryption is put into sharp perspective by a quick glance over the
penalties issued in three recent cases where encryption wasn’t used (£700,000 in total). The price
of getting it wrong could therefore extend well beyond upsetting people…
Simon Rice
Group Manager, Technology
28 August 2013
If you'd like to get in touch with feedback or comments please find us on Twitter @ICOnews or
email blog@ico.gsi.gov.uk.