3.4Encryption & protecting sensitive files
The essentials in 30 seconds
- Last line of defense: encrypted, a stolen or mis-sent file stays unreadable without the key.
- Disk + files: disk encryption verified, password-protected encrypted archive for sending.
- Two channels: the file via one channel, the password via another — never in the same message.
Running mini-case — Karim sends a sensitive file
Karim, an office employee in Algiers, must send a spreadsheet containing sensitive data to a partner. Instead of the cleartext file as an attachment, he checks that his workstation is encrypted, creates a strong-password encrypted archive and sends the file by email then the password via another channel. Loss or interception no longer means a leak.
This same case returns in the lesson, the diagram, the script and the 48h challenge.
1. The last line of defense
To encrypt is to make data unreadable without the key: the protection that survives theft of the device or file — stolen laptop, wrong recipient, accidental public share.
Disk encryption turns a stolen laptop into a paperweight: check that it is active on the workstation, the phone and the external backup drive. On a corporate workstation, IT normally enabled it — check.
2. Files and the two-channel rule
For one-off sending or storage, encrypt the file or archive with a strong password (office tools, archive with encryption). Encryption is only worth its key: strong password, kept in the password manager.
Absolute rule: the password always takes another channel — never in the same email as the file. In a company, first use the secure sharing tools provided: manual encryption is plan B.
🔎 Concrete example — Encrypt workstation and sharing
Karim turns loss into a non-leak.
Check active encryption (workstation, phone, external drive).
Encrypted archive: strong password for sending.
Send the file by email, the password via another channel.Reading: theft or interception without the key = unreadable.
Lesson: never the password in the same email as the file.
Section vocabulary
- Encryption
- Making data unreadable without the key: the protection that survives theft of the device or file.
Simple example: Karim's folder, unreadable without the password.
What it is not: a cleartext file protected by discretion alone.
Reflex: encrypt every sensitive file that travels.
- Disk encryption
- Protection of the whole disk: stealing the laptop yields nothing.
Simple example: Karim's workstation checked as encrypted.
What it is not: a merely locked session without encrypted disk.
Reflex: check encryption status on each device.
- File/archive encryption
- Protecting a document or zip with a strong password for one-off sending or storage.
Simple example: The encrypted archive sent to the partner.
What it is not: a cleartext attachment.
Reflex: strong password for each sensitive sending.
- Separate password sending
- Rule for encrypted sharing: file via one channel, password via another.
Simple example: File by email, password by call.
What it is not: file and password in the same email.
Reflex: two channels, systematically.
- End-to-end encryption
- Only sender and recipient can read: even the service operator sees nothing.
Simple example: A secure end-to-end messaging app.
What it is not: a sending readable by every intermediary.
Reflex: prefer the secure sharing tools provided.
In practice — Encrypt workstation and sensitive sharing
- Check your workstation encryption: Windows → Settings → Privacy & security → Device encryption / BitLocker (on a corporate workstation, IT normally enabled it — check).
- Do the same on your phone (encrypted by default if lock code active) and your external backup drive.
- Practise secure sending: create an encrypted archive of a test file (7-Zip → Add to archive → password, AES-256).
- Send the file by email and the password by SMS/call — the two-channel reflex.
Ready-to-say script — send a sensitive file (30 s)
“I am sending you the file in an encrypted archive by email. I will send you the password via another channel in a minute — do not reply with the password in the same thread.”
Say to the recipient before sending; strong password, stored in the manager.
Copy-paste template — encrypted sending sheet
FILE TO SEND: _______________
ENCRYPTED (yes / tool used): _______________
PASSWORD (strong + in manager): _______________
CHANNEL 1 (file): _______________ / CHANNEL 2 (password): _______________Micro-business / freelancer
Without corporate tools: strong-password encrypted archive + two channels, passwords in the manager.
SME Algeria
Karim first uses the secure sharing provided by the company; manual encryption stays plan B.
Office / employee
On a corporate workstation, have encryption checked by IT and back up recovery keys with them.
Beginner
Practise on a test file: one encrypted archive sent to yourself, password via another channel.
✓ Best practices
- Check that disk encryption is active (workstation, phone, external drive).
- Encrypt any travelling sensitive file (AES archive, protected PDF).
- Always send the password via a separate channel.
✗ Common pitfalls
- Putting the encrypted file and its password in the same email.
- Using a weak password for an encrypted file.
- Losing the password (file permanently unreadable).
Key takeaways
- Disk encryption turns a stolen laptop into a paperweight: check that it is active.
- A travelling sensitive file is encrypted — and the password ALWAYS takes another channel.
- An encrypted file's password must be strong: encryption is only worth its key.
- In a company, first use the secure sharing tools provided: manual encryption is plan B.
48h challenge — apply tomorrow
Check your workstation's encryption and create 1 test encrypted archive sent via two channels.
- I can check my workstation's encryption.
- I can encrypt a travelling file.
- I apply two channels to every sending.
Frequently asked questions
Does encryption slow my computer?
Not perceptibly on modern hardware: processors accelerate encryption natively. There is no longer a performance/security trade-off on this topic.
What happens if I lose an encrypted file's password?
The file is permanently unreadable — that is the point. Hence: encryption passwords stored in your manager (1.1), and BitLocker recovery keys backed up (IT manages them on corporate workstations).
How to send an encrypted file and its password?