Leveraging encryption
As a first step, you need to understand the applicable regulations and laws to determine whether some specific encryption requirements apply to your organization (or a part of it). For example, the following screenshot shows the different encryption requirements between the Payment Card Industry Data Security Standard (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA):
Figure 6.14 – PCI and HIPAA encryption requirements
However, you should not create your encryption policy based only on compliance requirements. Instead, you should create a robust encryption policy based on the following considerations:
- Implement full disk encryption (for example, BitLocker).
- Implement email encryption.
- Implement file-level encryption (for sensitive data).
- Encrypt backups.
- Create awareness campaigns to show the importance of encryption and why it must be applied at all levels (data at rest, in transit...
