Why encryption is a must for business owners

How valuable is your data? Can you afford to lose it? If not, it’s time to consider the role that encryption can play in protecting your systems from ransomware and other forms of cybercrime.

Cybercrime is increasing at an alarming rate, targeting both businesses and individuals, with a recent Australian Institute of Criminology report estimating its total annual economic impact in Australia at $3.5 billion. And the more complacent people are about the risks of data theft, the easier targets they become.

Mathias Gaertner is a world-leading expert on cybercrime. Mathias is a Cyber Security expert serving as external Data Privacy Officer for over 30 companies across Europe, and he was a Lecturer of Information Science for 16 years. As an Expert Witness for Systems and Applications of Information Technology for the German Government, Mathias argues encryption is an effective way to protect data against ransomware attacks and unwelcome intruders. 

“Encryption is a way to make sure that only the people with the correct decryption key can access your data,” he says. “Encryption helps to mitigate the risk of an attack or intrusion.

“If someone intrudes in your computer, they can see all of the files. However, if the files are encrypted, they can still see the files, but not the content of those files. And if the person can’t see the content of the file, they can’t make use of it. It doesn’t necessarily protect against stealing the files, but it makes that data unusable for others.”

Debunking the myth

Gaertner says it’s a myth that passwords, firewalls and other forms of perimeter security are sufficient protection against a cyber attack.

“The paradigm needs to change,” he says. “For the past 20 years we have been teaching people that this type of security is sufficient. But perimeter security doesn’t take into account the human factor.”

Gaertner says social engineering activities – ‘hacks’ achieved through human interactions – are what most often lead to people unwittingly inviting intruders into their network, leaving them vulnerable to ransomware.

“With ransomware, it’s usually the user who invites in the intruder through clicking a link in a phishing email that installs spyware,” he says. “This constitutes a breach which a firewall can’t work against.

“Perimeter security does not take into account intrusions from inside the firewall or network. But even if the intruder is within the network or firewall, if the data is encrypted, it makes that data useless to them.”

“It’s not a question of if you will be hacked, but a question of when”

For some cybercriminals, access to intelligence is the target. This is especially true of places like research labs, where there may be sensitive data or patented ideas stored within the network. 

“Gaining intelligence about someone’s work, patent or research can be a cyber criminal’s main interest,” Gaertner says.

But even if you’re not running a research lab, or another type of business that would seem to make an obvious target for cybercriminals, Gaertner says encryption is a must. 


“If you have data that is worth protecting, you should protect it with reasonable means,” he says. “Encryption helps mitigate against a successful attack against your systems. 

“It’s not a question of if you will be hacked, but a question of when. But even if you are hacked, the attacker shouldn’t be able to access your files if they’re encrypted.” 

After all, there’s often little rhyme or reason to where cybercriminals attack. The recent Microsoft Exchange attack, for instance, saw hackers take advantage of an identified attack vector to compromise at least 30,000 email systems, including schools, hospitals, city councils and businesses. 

The goal was to smash and grab as much data as possible before the vulnerability was closed, regardless of where the data came from, and make sense of it later. 

“I don’t see there being any businesses that shouldn’t use encryption,” Gaertner says. “It is easy to obtain and maintain, and the downside of not using it is significant.” 

How important is your data?

When choosing the level of encryption your business requires, Gaertner says it’s essential to consider what’s stored in your files, and what that could be worth to someone looking to either steal the intellectual property or place a ransom on the data. 

“The more important the information, the harder type of encryption you should use,” he says. “You have to find the right balance between the different types of encryption. There is everything from encrypting on a file level, where every file has its own password to access it, down to an encrypted disk that’s decrypted when the computer boots. You should consider how much security you need by how much worth there is in your data.” 

If you decide your data isn’t important, you’d better be sure about it – because even your employees’ personal information could become a target.

“Each business owner needs to think about the personnel intelligence stored in their data,” Gaertner says.

“All the information about their employees’ personal details – contact details, bank account numbers and addresses – can also be compromised, and people can have their identity stolen. Without using a suitable method of encryption, you, as a business owner, made it possible for that data to be stolen.

“You have to be able to understand the ‘what if?’ scenario. It’s like insurance: an intruder in the network may not be an everyday occurrence, but by using encryption, you are insuring yourself against the worst case scenario if there is a breach.”