In this abstract, we will talk about technical measures to protect information that you can do as an employee to create a strong information security system for the enterprise. We will answer the question: what is the difference between password protection and encryption? We will discuss the reliability of the two variants and see what implementations are available.
Ways to protect your data: password protection or encryption?
Information security is a complete list of prescribed rules, implemented technologies, and practices to prevent cyber fraud, data leakage, and illegal intrusion into the network and accounts. Therefore, the protection of personal data in information systems is not only the responsibility of the company but also of all employees. After all, any company consists of people, and to avoid all kinds of information threats, not enough good antivirus and the work of one specialist.
All information security experts have repeatedly reminded that a strong account password solves half of the common cybersecurity problems. Many people ignore this, and as a result, about 80% of all cyberattacks are related to weak passwords.
Password protection is a security process that protects information available through computers that you want to protect from specific users. Password protection allows access to certain information only to those who have an authorized password. Passwords are commonly used to log in to the network and to various Internet accounts to authenticate the user who accesses the website.
There are the following requirements for password protection:
- the password must contain uppercase letters, numbers, and other characters;
- do not use real words or familiar phrases;
- use multi-factor authentication when possible;
- be sure to update your passwords every three months;
- do not use the same password for multiple accounts.
Encrypting individual documents is an important part of a multilayered security strategy. Encryption will not protect documents from being deleted by malware or re-encrypted by ransomware. However, neither a virus, a Trojan encryptor, nor a hacker will get access to the information contained in encrypted documents. Of course, only if for the protection you used a strong, and most importantly, a unique password that was not saved, not sent, or used anywhere else. This kind of data protection is used in virtual data rooms for storing business-critical data. An encryption file system (EFS) will protect only those folders and files for which the user has specified the appropriate attribute.
Are password-protected files encrypted?
What to choose between EFS encryption and password protection of documents? These protections cover different use cases. EFS is completely transparent protection of the entire document folder. Once you log in, you can use any secure documents without entering additional passwords. Once an attacker learns the password for your Windows account, he will be able to access all EFS-protected files.
At the same time, encryption using Microsoft Office will require a conscious effort on your part. You will have to enter the password every time you open a document. However, the documents protected in this way will need to be cracked by an attacker one at a time, and the degree of protection of Microsoft Office can be very high.
Before taking any measures to protect the system and files, you need to understand what kind of threats you are going to build protection against. Protection against malware and ransomware works differently than protecting files in case your computer is stolen, which, in turn, is not enough to protect the really important data. However, some security measures must be taken in any case.