Quelles sont les meilleures pratiques pour rendre le chiffrement facile à utiliser pour les utilisateurs non techniques ? (2024)

Working with small businesses, many of them hear the word "encryption" and just think that's way too complicated. There are many user-friendly options for encryption that you can deploy without even noticing. Entering a (strong) passphrase will open the encryption, and it looks just like using a password. iPhone users have encryption built right into the system. When the "unlock" their phones, I bet most users don't even know their phone was encrypted. It just works. That's the ease of use needed for "regular users". The concept of encryption can go very deep, but for day to day application, ease of use is the most important feature for adoption.

Texte traduit

Start with easy to use tools, then show your users that the cryptography does not bite them. Make them feel good and confident about it.When people feel more confident, it is easier to guide them to more complex systems.A good start is a password manager; they have become very user friendly nowadays and employ some good encryption.

Texte traduit

Encryption helps protect your privacy and security online. However, encryption can also be complicated and confusing for non-technical users. Therefore, it is important to choose user-friendly tools that make encryption easy to use.Some of the best practices for choosing user-friendly encryption tools i recommend:Look for tools that have a simple and intuitive interface. You should be able to encrypt and decrypt your data with a few clicks or taps, without having to deal with complex settings or options.Choose tools that are compatible with your devices and platforms. You should be able to use the same encryption tool across your computer, smartphone, tablet, etc., and sync your encrypted data seamlessly.

Texte traduit

One of the challenges of encryption is creating and remembering strong passwords that are resistant to brute-force and dictionary attacks. A good practice is to use a passphrase, which is a long and memorable sentence that contains a mix of lower and upper case letters, numbers, and symbols. For example, “My_favorite_book_is_1984!” is a better passphrase than “Ilovemydog15”. However, avoid using common or predictable phrases that can be easily guessed by attackers. Another good practice is to use a password generator or manager that can create and store random and secure passwords for different accounts and services. However, make sure that the tool uses a reliable encryption standard and protects the passwords from unauthorized access.

Texte traduit

Strong and unique passwords basically boils down to passwords you can't possibly remember. The average person has somewhere around 100 different applications they use, and that's 100 different strong and unique passwords needed. What happens in reality? People end up using the same passwords over and over again, or very weak passwords like their dog's name. There's an inherent risk in password managers - all eggs in one basket - but the benefits outweigh the risks.

Texte traduit

Encrypting both active devices and backups is a critical security measure to safeguard against data breaches. Device encryption ensures that data remains inaccessible without proper authentication, such as a password or biometric verification. Backup encryption, on the other hand, protects against data loss from catastrophic failures or ransomware incidents, allowing secure data recovery.

Texte traduit

Laptops retain a lot of value on the stolen market, so they're attractive things for criminals to steal. If your laptop is lost or stolen and contains protected information, whether or not its encrypted can make a big impact on the safety of the data - will it get into the wrong hands? - and your potential legal obligations to report the incident. Full disk encryption is easy to deploy - just don't forget your password! You'll have more peace of mind if your laptop ever goes missing, and you may save a lot of headaches for reporting.

Texte traduit

Encryption is a vital tool to safeguard your data online, but it does not guarantee your security unless you are alert and careful. I like to point the case of Ross Ulbricht, the creator of the notorious online black market Silk Road. Ulbricht relied on encryption to hide his website and transactions, and to dodge law enforcement. However, he also made some mistakes that led to his capture, such as using his real name and email address on public forums, and leaving clues of his personal information on his laptop. He also neglected to educate his users on how to use encryption properly and securely. This illustrates how even experts of cybersecurity can be vulnerable to error, thus one needs to take proactive measures to mitigate risks.

Texte traduit

Working with small businesses, I see a lot of people who are intimidated by the word "encryption". It sounds complicated, and hard to implement. The first step is to educate users that encryption is not the same as password protection. Password protection is like a padlock that after its opened, all the data is visible. With encryption, the data is completely scrambled without the decryption key. The "why" gets people to understand the need - encryption makes storing your data a lot safer. There are also a lot of easy-to-use tools where no technical knowledge is needed to engage encryption. Educate on the WHY and the EASY HOW, and people will get over their hurdles and encrypt.

Texte traduit

All portable devices should be fully encrypted - this means laptops, and any small devices you may use to backup or transfer data. You may have a company policy around this, but how do you know if everyone is complying? Larger organizations may have access to some sophisticated platforms to ensure compliance, but for the small businesses I work with on a daily basis, a simple audit could be the simple path to "trust but verify". If someone on your team loses a laptop containing protected information without encryption, it will have to be reported, opening the door to a lot of headaches. Educate employees about the WHY so they won't cut corners on this.

Texte traduit

Encryption is like a lock that protects your data from unauthorized access. But like any lock, it can become outdated, broken, or picked by hackers. That’s why you need to update and audit your encryption regularly to keep your data safe and secure.Updating your encryption is like changing your lock or getting a new key. It helps you fix any problems or weaknesses that might exist in your current encryption system.

Texte traduit

Encryption is like a secret language that only you and your intended recipient can understand. It helps you protect your data and communication from anyone who might want to spy on you or harm you. However, encryption can also be difficult and confusing, especially if you don’t know the rules and vocabulary of the secret language. If you need assistance or advice with encryption, you can ask for help from reliable sources, such as cybersecurity experts, consultants, or organizations. They can help you select the best encryption tools, set up your encryption correctly, solve any problems, and offer you support and guidance. You can also join online groups, forums, or communities that talk about encryption and cybersecurity topics.

Texte traduit

Ideally, encryption should be centralized, turned on by default and must not require any explicit action by the end users, especially non-technical end users. This would introduce the overhead of key management, performance issues due to encrypting non-sensitive data & possibilities of misconfiguration of encryption settings by end users. Encryption can be turned on by default at the disk-level and DB level by enterprise teams. Email encryption and HTTPS must be used to secure data in transit. End users should however be educated and trained in the basics of encryption to make them aware of the role of encryption in enterprise security and the role they play in it.

Texte traduit