Devices and protection
Why every work laptop should be encrypted
Your laptop's password protects it from someone at the keyboard. It does not protect the drive inside from someone with a screwdriver.
1 min readExplainer
The short version
Encryption turns a lost laptop from a data breach into a hardware cost. It is built into Windows and Mac and costs nothing extra.
What encryption does
Without encryption, the files on a laptop’s drive are stored in plain form. Anyone who removes the drive and connects it to another computer can read them, whatever the laptop’s password.
With full-disk encryption, everything on the drive is scrambled. It is only readable after the laptop starts up and you sign in. A stolen drive is just noise.
It is already built in
- Windows includes BitLocker on business editions.
- Mac includes FileVault.
- Phones are encrypted when a passcode is set.
There is nothing to buy, and on modern hardware you will not notice any slowdown.
The recovery key
Encryption comes with a recovery key: a long code needed if the laptop cannot confirm it is safe to start, for example after a hardware change. Lose it, and the data is gone for good.
In a business, recovery keys should be stored centrally by IT, not printed and taped inside the laptop bag. Device management does this automatically.
What to check
- Is encryption turned on for every laptop, including the owner’s?
- Are recovery keys stored somewhere IT can reach them?
- Do phones that get work email have a passcode?
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.