You don’t need to be an expert who knows exactly how cryptography works in your organization, but it’s a good idea to become familiar with what cryptography actually does for your business. This article attempts to bridge the communication barriers that can arise between IT security teams and upper-level staff by highlighting five applications of cryptography in daily life.
Applications of Cryptography in Daily Life
Cryptography is one of those peculiar things that benefits everyone multiple times every day, whether in business or as customers, without most of us even realizing it. It’s kind of like the ozone layer in that sense. The below image is a snapshot of the topics I’ll discuss here:
1. Encrypting Company Devices
If you have a suite of company laptops or tablets to facilitate business travel or remote work arrangements, it is essential to encrypt the hard drives on every one of those devices if you want to maximize information security. This is particularly important for industries such as finance and healthcare, where sensitive data is protected by several regulations.
Picture the scenario—a company executive takes his company laptop, which contains sensitive customer data, on his commute home from work. He leaves the laptop behind him and it’s not encrypted. Disaster strikes. Someone finds the laptop and uploads thousands of customer names, card details, and addresses on the darknet.
The scenario above has repeated so often over the years that it’s now completely unsurprising to wake up to a news story about a data breach caused by a stolen laptop.
An Intel-sponsored study as far back as 2011 found that the average cost of a stolen laptop for businesses was €35,284 ($49,246). There have been no similarly robust studies since. However, adjusting for inflation and the increased stringency of compliance penalties since 2011, you could reasonably add another 15-20% to those figures.
Full disk encryption is the type of cryptography that prevents such incidents. If your business doesn’t encrypt its company devices, now is the time to start. If your business already uses full disk encryption, now you know why.
2. Securing Email Communications
Prudent organizations should use file encryption methods to secure email communications where sensitive data is being sent. The most straightforward to implement is Pretty Good Privacy (PGP), which is a hybrid of asymmetric and symmetric encryption. Even though its implementation is straightforward, PGP requires some additional employee training.
Many organizations (of all sizes) don’t secure their email communications, though, which is an undeniable information security risk. The average cost of a breach per record leaked is $242. Whether the leakage from an unencrypted email of 1000 or even 10000 of such records constitutes a cost your business is willing to pay should determine if you need to encrypt your emails.
3. Protecting Sensitive Company Data
Internally, organizations should be encrypting their own sensitive data, such as intellectual property, so that only certain privileged employees can access that information. Proper access controls also contribute to this use of cryptography.
In fact, unless your organization’s IT security team operates on the least privileges principle, encrypting your trade secrets won’t work anywhere near as well as it can. File-level encryption works best for protecting specific folders and files from malicious insiders and prying intruders. Combined with proper access controls, file-level encryption is imperative.
4. Encrypting Databases
Cyber attacks on databases are commonplace. One of the most important applications of cryptography in daily life is to secure sensitive records contained in databases. This use case of cryptography not only ensures compliance with industry regulations; it also protects the identities of customers.
For example, a large dental practice might have a database with social security numbers and other sensitive patient data. If that dental practice cares about compliance or patient confidentiality, it needs to encrypt either the full database or the specific records that are sensitive.
5. Securing a Website
One of the applications of cryptography in daily life that pretty much everyone benefits from is the use of HTTPS to secure communications over a network. Any competent business with a website or mobile app for communicating with customers should be using HTTPS.
HTTPS is an example of a cryptographic use case because its port, number 443, is protected by an encryption algorithm. The older HTTP protocol is an unsecured version of HTTPS that communicates using clear text. HTTP is fine for blogs and other websites that don’t transact in sensitive data. For the majority of businesses, it’s an absolute must.
Closing Thoughts
Cyber attacks on cryptography can happen, and this article does not suggest cryptography is foolproof. However, attacks that seek to exploit cryptography are far more complex to carry out than taking advantage of organizations that neglect to use an effective encryption strategy. Bear these important applications of cryptography in mind the next time your IT security team badgers you about an incomplete encryption strategy at your organization.
If you enjoyed this article and you’d like me to write an engaging, well-researched article or blog post for your business on any technical IT topic, you can email me now by clicking the below button:
Get in Touch