More data records are being lost and stolen all the time. The increase in compromise of data is seen in an analysis of the second half of 2016 and first half of 2017. The number of breached data records rose 164% during that period to 1.9 billion records, per analysis by Gemalto. Incredibly, the 1.9 billion figure was already higher than the total volume in 2016. While the number of records being lost to data breaches is ascending, so is the related cost. One analysis found that the cost of a single stolen record resulting from a data breach was $225 in 2017, up from $221 in 2016.

In this context, security is paramount – and one of the primary steps toward security is encryption. This article looks at how encryption is useful to business and provides advice as you move forward in implementing it. Note that it does not talk about the types of encryption but instead focuses on managing the process as you encrypt organization-wide.

The function of encryption in business

Encryption is designed to protect data both while it moves and while it is stored in a network storage system or computer. Any entities that gather personally identifiable information (PII) should keep that information secure, and the standard way to secure data is by encrypting it. Through encryption protocols, small and midsize businesses (SMBs) and other organizations are able to protect names, birthdates, social security numbers (SSNs), and other types of critical data. By implementing encryption throughout their systems and to the data flowing through their service providers, businesses are able to protect themselves from various negative outcomes (including lawsuits and regulatory fines) if data is stolen.

Nefarious parties can easily look at any data that is unencrypted if they can access it, as when people steal laptops. Theft of unencrypted laptops is a common issue, as indicated by violations of the Health Insurance Portability and Accountability Act (HIPAA), with large settlements highlighted by the Department of Health and Human Services (HHS). Because lack of encryption is such an open window for abuse, it should not just be used for all your laptops but throughout the rest of your environment as well. After all, if the data is not encrypted, no one would even have to get your sign-on password to get access; they could just use a USB thumb drive to boot the computer and see the files.

Encryption is a huge point of focus for online business security. For example, businesses that accept credit card payments are required to follow PCI compliance requirements which make online transactions secure by encrypting data, among other safeguards. But encryption is not the only defense you need to protect data. A malicious user could get into the computer through a network connection that lacked proper security protections. Infection with malware that steals login data from the device could arise when an unsuspecting staff member clicks on a malicious email link. Other safeguards (such as firewalls, antimalware software, and staff training) would be necessary beyond encryption to prevent those types of attacks and others. Nonetheless, encryption is always a strong idea because you will greatly lower the chance that information is compromised.