Encryption at Rest and In Transit
In this training session, Catherine Sanders Reach walks legal practitioners through a comprehensive set of practical solutions for protecting data both while it is stored (at rest) and while it is transmitted (in transit). She begins with email encryption, reviewing built‑in Microsoft 365 options and third‑party add‑ons such as Trustify, Identilex Delivery Trust, and Veertru, and demonstrates Trustify’s workflow, including basic encryption, two‑factor and password authentication, and advanced controls like expiration, printing restrictions, and read‑once access. She then recommends Citrix ShareFile for combined secure cloud storage and email encryption. The presentation moves to device‑level encryption, showing how to enable BitLocker on Windows Pro and FileVault on macOS, and mentions third‑party tools like VeraCrypt. Next, she explains file‑level protection using Microsoft Word and Adobe Acrobat password encryption, highlighting password‑management tips. For cloud‑based storage, she evaluates zero‑knowledge folder encryptors (Boxcryptor and Sucasa), demonstrating Boxcryptor’s integration with OneDrive. She advises using a VPN (NordVPN) to secure network traffic, especially on public Wi‑Fi. Finally, she introduces JotForm’s encrypted forms for secure client data collection, covering key generation, password handling, and decryption workflow. Throughout, she stresses the importance of establishing strong passwords early, using password managers, and communicating encryption practices to clients.
Chapters
So welcome everyone to today's learning objectives program, and today we are going to talk about encryption at rest and in transit. And so we're going to go through a whole bunch of different tools, some of which you'll have to purchase, some of which you'll already have, in order to encrypt information whether you're sending it or whether it's sitting on your computer or or it's sitting on the cloud and you want to make sure that it's extra secure. So with that, we'll go ahead and get started. The first thing I want to talk about is email encryption. And so there's a number of different ways you can encrypt email, but unfortunately the only way that I know of that's built into any particular product is the Office 365 version. They, they had been calling all of these Office 365 and they called it E3. Now they've renamed this to Microsoft 365 Business. It's basically, it's the priorly called E3 version. It's $20 per user per month and it does have encryption built in. You can set up all sorts of cool rules that says if it recognizes there's sensitive information, it turns on automatically. But it does not necessarily have the level of sophistication that some of the add-ons do. And so in your materials that I'll send you, I've got some links to other products that you can use to— basically they're add-ons for either Gmail or Outlook. If you're using something other than Gmail or Outlook, two of these have web-based interfaces, so you would just go to their interfaces to actually encrypt an email. It encrypts the entire email, including any attachments.. And then the end user will have to do something at the end to decrypt it. And that's a good thing. That's why we're encrypting it. I have talked to many attorneys who are basically like, well, my clients don't want to have to do anything. You're going to have to explain to them that this is best practices and that you're doing this for their own protection. In some cases, if you're working with banks or financial institutions or other organizations, they'll insist that you encrypt it. So it's a good thing to have. And then with your consumer clients who may not understand, you'll just have to work with them. One of the things that I suggest— a lot of these products will require a password, and so probably the best thing to do is at the beginning of representation, establish a long and secure password with your client. It's not ideal for you to have to manage passwords for your clients and create them. However, this keeps you from having to have them create new passwords all the time. And you'll kind of get a better sense of what I'm talking about. But the products that I like for this, and it's certainly not a comprehensive overview of products on the market, it's more that these are the ones that I've played around with and tested and feel like they're good options, are Identilex Delivery Trust. Trustify and Veertru. And so what we're gonna do now is we're actually gonna go and I'm gonna demonstrate Trustify. And Trustify, in the demonstration that I'm gonna show you, is actually in my Outlook. It's installed. It's not free. So Trustify for an individual user costs about $5 a month. If you send Let's see, if you send 25 encrypted emails a month, it's about $6 a user. If you want 1 to 10 users and 100 emails a month, it's about $14 a month per user. So, you know, it's not free. It's not terribly expensive. And it is, as you're going to see, pretty robust in terms of what you can do. So let me open up Outlook. And here's my Outlook. So if I were going to send an encrypted email to somebody, I would just do what I normally do, go up and click on New Email, and you'll have a new email. And then I'm gonna click on the Trustify button that appears here in your ribbon. And I'm logged into Trustify and I've installed it and all that good stuff. So you'll see that you don't address your email in the normal address bar. You actually address it in Trustify. Now you can go down here and import your contacts from your address book. So whether that's you're using this in Gmail or Outlook, you can get it from your address book, or you can just add people to Trustify and it will remember those people. So I'm gonna type in an email address and you'll see that there's a little pencil to edit the contact. And so one of the things is I've added the cell phone number for this user, which is my other email address, and that's important in terms of the authentication. So I could go ahead right now Click on— it's already defaulted to encrypt this message— and click apply. And you'll see that it sends it from Trustify to that person, and then I can add my subject. And send it off normally. And then what would happen is the recipient— now, one of the things that has been happening with me, and you'll just have to have your, your clients check their spam, is that Google has been identifying this as spam, but Here's the email, and I'll tell it it looks safe. And you can see content is encrypted. Decrypt and open this message. And so I would decrypt and open this message, and they would create a username and password and have access to the email. What I'm going to do though is show you kind of a a different scenario. So this is perfectly fine if you're sending an email to someone who is— you're just sending something that you need to be encrypted, but it doesn't have to have authentication. And authentication means that there's a chance that someone could be sitting in between you and the recipient. So a lot of times in the real estate world, there's a lot of man-in-the-middle attacks where people are intercepting emails they could get this email and click decrypt and open it, and it would decrypt and open it without much ado. And so, or say you're working in a family law situation, you're emailing someone, and there may be a possibility that the spouse has access to the email account or whatever. So if you have that scenario, you want to add some additional security to it. So we'll go back into Outlook and send a different message. And you can see that it verified that the email was sent successfully. So I'm gonna click on a new email message and I'm gonna click on Trustify again. And I'm gonna type in the person who's gonna receive it. This is why it's important that I have their cell phone number because I have options. So I'm gonna click on Show Advanced. And up here you have a couple of different methods you can use for authentication. People are pretty used to the two-factor authentication, which means they, in addition to something that— it's something that you know and something that you have. In this case, a phone. And so as long as that email or the phone number is in there, you can use phone. When they get the email, they'll click and it will send them a code to their phone. You can choose to use a password. Here's the trick with the password. You create the password and you tell your client what it is, probably not via email. That's why I said you could start out with your clients explaining that you're going to be sending them encrypted and password-protected information, and here's the password that you're going to use with them, and just get that established right up front. So you can use a password. And then you can send another email that they would click on to verify. But for, again, the purposes of authentication with family law clients, real estate, things like that, I think either password or phone. So we're going to check on phone. Now you have a whole other, a lot of other options. You can have it expire in 30 days. You You can disable printing. You can require that authentication on reply. You can allow email access only once. You can change the replies to— you can track the links and see if people have clicked on it. Get notifications that the email was opened. You could limit the number of replies and all sorts of other things. So we're just going to keep it simple with a phone authentication. And click Apply. Again, it's going to put the address up here now, and we're going to say Test 2 with authentication. Now, if I added an attachment, um, this attachment is also secured, uh, with this entire email. So you don't have to worry about doing anything in addition to, um, encrypting the email. It encrypts the attachment. As well. So I'll click on send, and then I'll get another verification that that email has been successfully sent. And then I'll go and look at my Gmail, and, and you could just tell people to trust it and their spam. So here's the test, and you can see that the attachment's there, um, and if I try to click on it it won't open because you can see it has a lock icon on it. So I have to decrypt and open the message, in which case— let me move this over to— it really doesn't like it today. At any rate, They would click decrypt and open. It would say, do you want to get a message to your cell phone with a code? They put the code in, just like all the two-factor authentication works, and then they would be able to open the message. In that message, they would also be able to respond to you. So they can respond with an encrypted message, and it would go back to you. Encrypted. So it's a fairly simple process. As you can see, Google, because I've got a bunch of security settings set up, it doesn't like it with Gmail. But for the most part, you can always work with Trustify to set your clients up in a way that they can figure out how to use this more effectively. All right, there we go. So now once I told it it wasn't spam, and I've already used the code, and you can see that there's an attachment. Then if I click on reply, it's going to reply, and they can also add encrypted attachments., and then we'll go back to my email. Because I have Trustify already, it's going to show up like this. Decrypt and open the message. And you'll see the response. So that's pretty much it. That is about as good of an encryption as you can get for email. The other products I mentioned are also good. One that I also like is the Citrix ShareFile, and the reason I like Citrix ShareFile is because it does two things. One, It lets you save all of your documents in the cloud in a secure space. And then it also gives you buttons to add to Outlook so that when you go to send an email, you click on the button, it encrypts the email. It lets you pull a file from ShareFile and it puts a link to it. And then it also tracks all of your— in an interface in ShareFile, it tracks all of your encrypted emails. So If you need both secure document storage and email encryption all in one, you can use ShareFile. It's not, it's not super cheap to get the email encryption functions. It's $77 a month for 5 users. So if you have fewer than 5 users, you're still going to pay $77 a month, but it might be worth it if you're looking for secure document storage and the ability to encrypt email. And it's an unlimited number of emails that you can encrypt. And the other thing is there's a button in Outlook that lets you send an email and put a link for someone to send you a document. They click on the document and they upload the files in a secure space on ShareFile. So it's got a lot of bells and whistles for that $77 a month. So it's, it's worth looking into if you're not happy with what you're currently using for file storage and you're also looking for, you know, a pretty robust way to encrypt all the stuff. So the next thing we're going to look at is encrypting your hard drive. And I have the instructions for doing this. But basically if you have Windows 10, not the Home version, but any of the professional versions, you have something already built into Windows 10 called BitLocker. And then if you are a Mac person, you've got FileVault BitLocker Vault, which is also built in. And basically what these do is they encrypt the actual hard drive of your machine. So that being your laptop. If you have a desktop, you can encrypt the hard drive, but it's probably not nearly as, you know, at danger of being lost or stolen. Whereas with a laptop, if you leave it, you know, in a car, in your backpack, somebody steals it, if you encrypt the hard drive on it, then even if they remove the hard drive and try to get into it, they can't because it's encrypted. So any— if you have a lot of sensitive files sitting on your hard drive locally, then it's something to do. In fact, it's just something to do because it's really not that hard and might be worth your while. So I'm going to walk you through most of the steps. It's pretty easy. So What you do is you go search for BitLocker. And then I did a search for BitLocker, and all you have to do in a Windows machine is click Turn on BitLocker. And then you can enter a PIN. Choose how you unlock it. Or let BitLocker automatically unlock my drive. And basically, if you've already got a login for your machine, you can just let BitLocker automatically unlock my drive. Because if somebody got your laptop and went to go get into it, they would have to use the password that you use to log into your machine anyway. And so hopefully you've used a long, strong password for that. And so you don't have to have an additional PIN, but you can. Depending on how you feel about the security. And then you can also have a USB flash drive that you insert. So that's kind of a token authentication, but I'm just going to let it use my current login. And then new encryption mode, and that's for fixed drives versus— I can also have, if I had a like terabyte external drive that I use, I can put it in compatible mode so it could encrypt either one. And then we'll click next. And then you run a check. And obviously it runs this check. And then at the end of this, they want you to restart your computer. So I'm going to restart later, or otherwise I'll lose you all. And that's it. So that's as easy as that. And I've got the instructions for running the FileVault in Mac. There's also third-party encryption software if you want to use something else. Symantec and VeraCrypt and Disk Utility for Mac. There's plenty of other products on the market. The other thing to keep in mind is you want to encrypt the hard drive on your phone. I'm not going to be able to run through demos of doing that today, but I do have the instructions for the Android operating system and the Mac iOS operating system. And it's pretty easy to— I mean, basically it's the same kind of password protection to get into your phone. If you have that enabled on current phones, that also encrypts the drive on your phone. So that's kind of the overview of wanting to make sure that you have your hard drives locked down. So the next thing we're going to talk about is encrypting files. And so you can encrypt files to send them to people just as an attachment. So say you didn't necessarily need to encrypt the entire email because the sensitive information that you're passing along is in the file attachment itself. And so the good thing is this is not tricky and it doesn't require third-party software. It basically requires that you're using common tools like Microsoft Word. And so Microsoft Word actually has password protection built in that then will encrypt the document and then you can send it to somebody. So I'll show you how that works. So here's a document and I'm going to go into— and I have Office 365, but this is basically Office 2016. And this feature has been built into Microsoft Office forever. So if you click on File, click on Protect Document, you'll see that you have a number of options. So you can mark as final, which puts a little bar on it that says this document is final. But the one we're going to use is Encrypt with Password. So it asks you to encrypt the doc— now here's a Here's the thing to remember. This password, and they caution you right here, if you lose or forget the password, it cannot be recovered. So it says keep a list of the passwords. I use LastPass for password management, and within LastPass, there is a secure note space. So I can put the passwords for my documents in the secure note space. It won't prefill them like it does for websites, but I can go in and find it if I forget my password. If you don't use a password manager, I would recommend you look into them because it's— they're so useful. So I'm going to create a password and click OK, and then it will make you re-enter it like Now the password is basically applied to the document, and you click Back. And if I want to go— and I'm going to close this document and show you what happens if I need to open it again, because it will make me also put the password in to open it. So it's now password protected. No matter who opens it, whether it's you or your client, you have to put in the password. And there's your document back. If you want to remove the password protection, go back in, click on Protect Document, click there, and you can remove this password. And now, now it's not password protected anymore. And so if I were going to send that document as attachment, when someone tried to open it, they would have to put the password in the same way that I did. Another thing I wanted to show you, just because it's kind of cool, is under Protect Document, you can restrict editing. So say you wanted to send something to somebody, but you didn't necessarily want to password protect the document, you just wanted to protect certain portions of the document, you can click on editing restrictions and click on to make it read-only or that they can just use track changes or just comments or just form fills. The other thing that you can do is say I want anybody to be able to edit this portion of the document Select parts of this document and choose users who are allowed to freely edit them. So if I do that, then basically anybody who opens the document can edit this portion of the document and nothing else. And then once I click Yes, Start Enforcing Protection, you'll put in a password and then you'll have a read-only document or something that is limited to editing per your specifications. So those are a couple of different things you can do with Word. The other one I wanted to show you is Acrobat. And so if you have Adobe Acrobat, the full paid version, not the free reader, but the, the full paid version of Acrobat, it also has long given you the options to password protect the document. And again, it's pretty easy. So I'm gonna go open a PDF, and the current version of Acrobat is either 2017 or DC Pro. Nothing older than that is still supported by Acrobat, so if you haven't upgraded, it's time to upgrade. So I'm gonna click on Protect, and then you can see that I have restrict editing options And then I can add the password permissions, or if you want to get a little bit more robust, go to Encrypt, Encrypt with Password, and then you've got a bunch of different options here. So I can require password to open the document, and it'll be the same kind of thing that we did before. You can also restrict editing and printing of the document. So if I click on this, I can say you can't print it, you can't make changes. One of the things to be aware of about a PDF document is it's pretty editable. If somebody has Acrobat and you haven't restricted the editing abilities, they can make changes to it. So that's another thing you can add. You can also, it's by default disabling copying out of the document, which is useful. And so you would create another password here to apply these permissions, but we're not gonna do that on this one. And then you have some different options down here. I've never found any other reason other than encrypt all document contents. Click OK. Again, it's going to make you put your password in, and it also always reminds you that it's not going to do anything until you save it. So I'm going to save it, and then like we did before, It's going to ask me for my password in order to open the document. Again, all you have to do is supply the password and then attach it like normal, and then you're, uh, the recipient of that attachment could read the email, but there's no encryption on the email necessarily. You could apply it, but you don't have to. If really it's the password or the attachment itself that needs to be protected, and then they would have to have a password to put this in here. So that's how you basically add encryption via password for Acrobat and Word. Pretty easy. So a couple of different options to think about for other things is the cloud file encryption. And the reason that we're talking about this is when you store documents in the cloud, whether it be OneDrive or Box or Google Drive or OneDrive or one of the millions of other places you can store documents online, even though the information is encrypted to a certain extent on the cloud drives. If you read your terms of service, most of the time it will say that in order for them to provide the service to you, they have access to the documents. They're not going to read them. You can password protect them and add extra security, or you can use a third-party tool that basically encrypts entire folders that are saved in the cloud so Say you were doing a lot of mergers and acquisitions, you stored stuff to the cloud, but you were like, this stuff, you know, can't get into the wrong hands. We don't even trust the cloud storage necessarily. We want to add basically zero-knowledge encryption. So that zero knowledge means that nobody but you can get into the document and can read the document. You've got a lot of documents with Social Security numbers, other things like that. Anything that rises to the level of extremely sensitive, confidential, or is protected under data breach law or something like that, you can take an extra step to encrypt it. And so there's a number of products on the market. One of them is Boxcryptor. The other one that I like for this purpose is Sucasa. Boxcryptor is not free. There is a free version, but technically the free version is for personal use, not for commercial use. If you are using this in a law firm, you are using it for commercial use. It's $72 per year, and it gives you a bunch of extra bells and whistles. The other thing to keep in mind is once you install this, they remind you since we offer zero knowledge, we don't have your password. And they can't reset your password. And that's true of adding password protection to the documents and other things. They don't— nobody has the password except for you. So you have to figure out the best way to keep this protected. So just want to point that out. It's, you know, not without some risk. And so I've gone ahead and installed Boxcryptor, and what happens is it— I created an account, installed Boxcryptor, it automatically recognizes if you're syncing to a cloud drive. So Boxcryptor saw that I was already syncing to the cloud with OneDrive, and so it just creates this little toolbar up above my OneDrive. Now I've created a folder here called Confidential and Sensitive. If this is one of the folders within my OneDrive that I want to add additional security to, I could do the whole drive, but you'll see that you probably don't want to do that. So I've chosen a specific folder that is confidential. I'm going to right-click on it and you see this Boxcryptor option, and I'm going to click Encrypt. And it reminds you you need to have them all closed and make sure that it's synced up, all of which I've done, and I'm going to click OK. And then once I've done that, um, you'll see that it has moved that folder out of my OneDrive And what it's done is it has put it into a new drive folder called Boxcryptor. And you can see that the Confidential and Sensitive Encrypted folder is there. Now, I can open this folder and all of the documents only if I go through this X drive. It's created kind of a virtual drive on my machine. And that's the only way I can open it. I should not be able to open it through here. I can open the folder, but I can't open the files. And the other thing is, um, if I go to my OneDrive folder Online, you can see this folder's here, but you can also see that all of these file extensions have been changed to.bc, and that's.Boxcryptor. And what that means is I can't open any of these from the cloud. The only way I'm going to be able to open these files is if I go into the Boxcryptor folder and open them. So again, we now have a folder that's syncing from my local drive to the cloud, but they're not accessible from the cloud. They're only accessible from the devices that you've installed Boxcryptor on. Now the good thing is you can, even with the free version, install Boxcryptor on your phone and on your laptop, or on your laptop and on your desktop, and you can, you can If you pay, which you should, it's $98 a year, then you can have— oh, and the free version only lets you encrypt one cloud storage. So if you happen to use two different cloud storage spaces like Google Drive for your personal use and OneDrive for your work, with the paid version you can have multiple cloud instances if you're syncing and it basically will encrypt them. And then you can also install Boxcryptor on your phone, on multiple computers. And so you're not really reducing your ability to access the files except for if you went to a completely, you know, like a loaner laptop or something like that, or a computer at a kiosk in a hotel and tried to get access to these files. You wouldn't be able to access them because you don't have Boxcryptor. Although I think with the paid version, there is a way to log in securely BoxCryptor and get access to them. But basically, again, Microsoft has zero knowledge of these files. Something else that I wanted to show you in addition to BoxCryptor is encrypting not just your cloud storage, but your traffic online, period. So you've probably heard about VPNs. VPNs are virtual private networks. I think they've got both a good and bad reputation because the virtual private network also basically encrypts the traffic from your device to wherever you're going, whether that's Gmail or Office 365 or whatever. But it also masks your IP address and does some other things. And so they have been used for somewhat nefarious purposes, but the reality is if you're in a coffee shop using free Wi-Fi, there is a high-level possibility that that WiFi network could be compromised, that people can see traffic on it. And so this is why most of the security experts suggest that you have some sort of VPN on your laptop and on your phone. And NordVPN is not free. It— if you pay for the version, if you pay for it and you pay for a 2-year plan, it's $4 a month. If you want to do it On a monthly basis, it's $11.95, so it's worth getting a couple of years. It does slow your traffic down just a little bit, so it's gonna slow the speed on your phone and your laptop down just a little bit. But again, you've got a secure connection. You don't have to worry about if there's a man-in-the-middle attack or you're using some sort of unsecure Wi-Fi. So you can basically make sure that everything you do is really, really secure. And you just— they have lots of good instructions on, you know, they have video tutorials. You sign up for a NordVPN account and then you create a username and password to get installed onto your machines, and then you're, you're good to go. The other one I wanted to show you is something that I've been working with lawyers a good bit, which is requesting information from clients, not just documents, but say you're doing, you're collecting information from estate planning client or you're getting information from intake and you want to have that kind of zero knowledge encryption for form creation. And so you can, with JotForm, they have an encrypted version. It's free for 5 forms and 100 submissions. Or it's $14.25 a month for 25 forms and 1,000 submissions. So just depends on how many forms you have. But if we go over, I'll show you what this looks like. So I have a JotForm account. I use the free one just for demonstration purposes. And so you can see that it has kind of a tutorial on how to Create an encrypted form. So once you have an account, you click, click Create an Encrypted Form, and we're gonna say— then click Show More Options, and if you scroll down, it asks you, do you want to encrypt "Form data," and you click "Yes." "Please enter your password." This is the password for JotForm. And what you saw in action was, uh, my LastPass— I don't know my own passwords. LastPass has them all saved. I just have to remember the LastPass password. And You get a couple of options. I've already done this, so I have an existing key. You can create new keys, or if you already have your own public key, which you may or may not already have, you can choose that option. If you've never done this before, you would click to create an encryption key, and it basically creates a key, then it sends you a little file, and you save that file locally on your machine. So again, The way to decrypt these things actually lives on your laptop or your desktop, and so you want to make sure that that device is well backed up so you don't lose the encryption keys, because JotForm has, again, zero access to this. Can't recreate it for you, can't recover it for you. I'm gonna show you one that I've already created, just the magic of television. I'm gonna go over into my encrypted form. I'm going to show you what that looks like, so I'm gonna click on View Form. You'll see there's a little lock icon. I'm gonna put in a fake, and I'm gonna click Submit. Once I've done that, Just like you always do, you will get an email notification that you've gotten a response to your form. And then it'll say you've received an encrypted response, so click on View Response. Now here's the interesting thing again. Until you decrypt it with your private key, no one can see this information, including you. So I stored my encryption key in a folder that I can remember. I click on the key, I click on Open, and now I should be able to see the response. So again, if you need to collect information, this JotForm is HIPAA compliant, it's PCI compliant. I wouldn't use it for credit cards only because there's better tools to collect credit cards like LawPay and things like that. But if you do need to collect sensitive information from your clients, the JotForm encrypted forms is a good way to do that. So that's it. Quick tutorial today. Lots of different tools and things to consider. Not all of them free, but many of them easy once you get it set up and used to it. And if you have any questions, you can always email me at the Bar Association and we can set up individual tutorials or kind of walk through what your situation is, what you need to consider, what tools are out there that might be effective and simple and work for you and your needs.
