WinZip Enterprise Blog

Protecting the world's most sensitive data for over 30 years.

The best alternatives to Dropbox for business

For companies that use cloud-based solutions, one popular option is Dropbox, a cloud storage system with more than 500,000 US clients that use its enterprise system, Dropbox Enterprise. This number increased by 50,000 since 2019 (an increase of 11.11%), indicating its growing popularity among businesses.

Dropbox appears to be a solution designed to avoid data loss, which is the unwanted or unplanned removal or tampering of data that often includes sensitive information. Data loss also includes data that has been lost or corrupted, rendering it inaccessible or unreadable by the intended user.

Enterprise data loss can happen for a multitude of reasons. One of the most common is a system failure, which includes hard disk drive (HDD) crashes on desktop and laptop computers. In just the US, 140,000 hard drives crash each week. Mechanical failure is to blame for 60% of these hard drive failures, and misuse leads to failure in the other 40%.

Natural disasters (for example, floods and fires) can destroy or permanently damage computers and backup storage systems such as hard drives. This loss can be detrimental for businesses: 50% of companies that lost data due to a natural disaster immediately filed for bankruptcy.

Data breaches also cause data loss. Egress’ Insider Data Breach Survey 2021 found that 94% of organizations experienced insider data breaches in the previous year. The Ponemon Institute’s Cost of a Data Breach Report states the average cost of worldwide data breaches in 2020 was $3.86 million.

In many of these cases, data loss could have been avoided if businesses utilized a cloud storage system that offers automatic data backup. This shift could have a wide-ranging impact on organizations: one study reports that 55% of companies still use on-premises (physical) servers.

But Dropbox is not a failsafe approach to data storage. In a study involving IT leaders, 84% of respondents reported human error as the leading cause of serious data breach and data loss incidents. Employees who failed to follow established security procedures were responsible for attacks in 74% of organizations.

Even with a system such as Dropbox in place, data loss and data breaches can still occur. It is therefore vital that organizations consider another level of security for their data backup.

This article highlights the current trends among business backup storage solutions as well as the security risks of Dropbox and how they can be mitigated with other solutions.

The current state of enterprise backup storage solutions

According to 56% of IT professionals, the increased amount of remote work due to the global pandemic has led to an increase in data breaches. This is due in part to more human error by remote workers when sharing files and accessing shared servers.

As a result, many companies turned to cloud-based storage solutions for off-premises collaboration. By 2021, nearly 50% of all corporate data was stored on the cloud. Even entities such as Google, Facebook, Twitter, and LinkedIn moved their processes to cloud computing servers.

Companies in certain industries, however, still rely on on-premises solutions that are more customized to their needs. For example, up to 25% of companies in electronics and hardware do not use the cloud, and 16% of government entities remain cloud-averse. Up to 17% of finance organizations rely primarily upon on-premises servers. In many cases, the hesitation to move to a cloud-based system stems from logistics related to migration.

Solutions such as Dropbox may help avoid data loss from physical servers, but they also come with their own security challenges. For example, Dropbox is not immune to situations that cause data loss, such as human error and cyber-attacks.

File security limitations of Dropbox

Dropbox has a history of data attacks. In 2012, an undisclosed number of emails and passwords were stolen from Dropbox’s servers. In 2016, Dropbox admitted that this attack had involved the login credentials of 68.6 million users.

The gap between the Dropbox hack and its announcement about the severity of the attack raised eyebrows for many users. How do they know if sensitive data stored on Dropbox is safe? And how can businesses using Dropbox ensure data security for their customers and clients?

Dropbox does offer some security features such as the following:

  • Intransit data encryption. Intransit encryption protects data as it moves from one place to another, such as when data is transmitted over the internet to another user.

  • 256-bit Advanced Encryption Standard (AES) encryption. AES encryption employs blocks of cryptographic code in lengths of 128, 192, or 256 bits. With 256 bits, there are 2256 possible combinations to hack the key, making it virtually impenetrable.

  • Secure Sockets Layer/Transport Layer Security (SSL/TSL). Dropbox encrypts data in transit, which is further protected by 128-bit or higher AES encryption. Files at rest are encrypted using 256-bit AES.

The solution additionally offers an optional two-step verification layer and regularly tests its infrastructure for security vulnerabilities.

Despite these security measures, there are still possibilities for data stored on Dropbox to fall into the wrong hands or become lost.

  • Dropbox enables users to store files in public folders, which could easily be accessed by anyone. These files could also easily be uploaded to the wrong location, allowing access to unauthorized (or potentially nefarious) individuals.

  • Dropbox users are also still at risk of being victims of cyberattacks such as phishing. In a phishing attack, users are tricked into giving up their personal credentials and access to Dropbox accounts.

  • Dropbox does not offer the enterprise-grade, purpose-built security controls that many organizations need, such as the blocking of actions like copying, printing, or saving.

  • Dropbox does not offer redaction tools, which means that IT cannot control the levels of privacy within documents.

What to look for in a new data backup solution

With so many issues regarding security and use, it’s in your best interest to invest in an enterprise-level data backup solution. Some of the most important factors to consider are cost, security, ease of use, and regulatory compliance.

Cost

Many factors influence a data backup solution’s costs. Before researching the costs of different systems, take into consideration the following:

  • The amount of data that will be stored.

  • The number of users that need access to the solution.

  • Additional security measures (such as two-factor authentication).

  • Customer service, training, and support costs.

  • Data migration costs.

Security

When evaluating data backup solutions, consider the following security features:

  • Encryption. With encryption, data has an extra layer of protection in the form of uncrackable codes. Encryption ensures that even if your data falls into the wrong hands, it cannot be read.

  • Multi-factor authentication. Multi-factor authentication is an added layer of protection that requires users to not only enter one form of authentication, such as a password, but also pass through another layer, such as fingerprint identification on a smartphone.

  • Custom controls for IT. When IT can control certain aspects of a data backup solution—such as file and folder-level security and access—they can better tailor the system to your organization’s specific needs. (For example, your organization’s compliance requirements.)

Ease of use

The right solution balances security with ease of use. If backup processes are overly complex or require multiple steps to initiate the backup process, people will be less inclined to back up data regularly. Look for tools that enable automatic backups and are easily accessible to employees whether they are on-premises or offsite.

Carelessness is responsible for 60% of insider security incidents, and this behavior often stems from not understanding the importance or full scope of your data backup strategy. Since human error is one of the main causes of data breaches, employees must be adequately trained on internal file and folder management.

Regulatory compliance

Data security and storage-related requirements vary by industry: finance, healthcare, and insurance, for example, are subject to strict data standards since they deal with particularly sensitive information. These requirements may influence your choice when evaluating a data backup tool.

Some examples of regulatory standards are as follows:

Alternative data backup solutions to Dropbox

There are many choices when it comes to backup storage solutions. If Dropbox does not offer the enterprise-level data backup solution that your business needs, consider other solutions.

Alternatives to Dropbox for business data include:

  • Google Drive. Perhaps the most well-known option, Google Drive is free for all Gmail users but can be upgraded to enterprise accounts with pooled data sharing. Google Drive and all the apps in Google Workspace automatically sync with your desktop and smartphone.

  • Microsoft 365. Microsoft 365 is a cloud-based suite of Microsoft applications and services, including Microsoft Teams, Word, OneDrive, and more. It automatically syncs your folders and files to the cloud, ensuring they are available across a range of devices.

  • SharePoint. SharePoint is a collaborative platform that integrates with Microsoft Office. It offers basic backup features but lacks granular access controls for enhanced data security.

Secure data with WinZip Enterprise’s powerful backup routines

WinZip® Enterprise enhances the security and efficiency of the solutions such as Google Drive, Office 365, and SharePoint. While these solutions sync data, they often rely on third-party tools to back up your data and store it on a secondary storage platform.

Thanks to its native integration with leading cloud storage services, WinZip Enterprise gives you the ability to back up to any connected cloud account. Among its many enterprise tools is WinZip Secure Backup, which provides automated endpoint backup for additional data security. Additional features of WinZip Secure Backup include the following:

  • Deduplication (the removal of redundant data).

  • Compression (the reduction in file size).

  • Encryption (the encoding of information to make it impossible for third parties to decipher).

WinZip Enterprise protects data in transit and at rest with advanced encryption methods, including 256-bit AES encryption. This enables your IT department to implement and uphold data security standards across the workforce, including multi-cloud network environments.

See how WinZip Enterprise provides easy, secure data backup for your organization.

How to compress a PDF Into an email and other compression tips

File compression is the process of reducing a file or a group of files so they take up less disk space. There are two methods for compressing files: lossy and lossless.

Most types of computer files are redundant, with the same information repeated many times. Lossless compression identifies and removes these redundancies to store data more efficiently. None of the information is deleted or lost, which means lossless compression is also fully reversible.

Lossless compression is preferred whenever you need to preserve image quality, words, or data. For example, lossless compression of medical images ensures that all critical information is preserved and that the original image can be completely recovered. No data is lost during compression, and the image will not be distorted when it is decompressed.

While the file size can be reduced to aid in storage and transfer, lossless compression produces a larger file size than lossy compression.

With lossy compression, file size reduction is achieved by permanently removing unnecessary bits of data. This leads to much smaller files, but with the consequence of not being able to restore files to their original state after they are compressed.

Lossy compression is typically used with media files where data loss is not noticeable to the human ear or eye. For example, .JPEG is a lossy image format that is widely used for web-based images because it makes the images as small as possible to accelerate load times for a better user experience.

If you use lossy compression on files that are shared back and forth between collaborating individuals, more and more data is lost with each compression cycle. Eventually, the loss becomes detectable.

In this article, we will look at the benefits of compressing files, especially for organizations that handle sensitive data. We will also learn how to compress a PDF into an email.

Top benefits of file compression

When most people think about file compression, the main benefit that comes to mind is storage space optimization. For example, cloud services price storage options based on the number of users and the total amount of stored data. Organizations that need to secure a large volume of files will strain the cloud’s servers, increasing the price of the storage solution.

Here are just a few benefits of file compression:

  • Storage space optimization. Uncompressed files take up more space on hard drives and servers. With file compression, you can reduce files to anywhere from 15–90% of their original size depending on the data they contain.

  • Faster transfer speeds. File size impacts how quickly you can send and receive data. On average, a compressed file transmits in a tenth of the time needed to send the same file in an uncompressed format.

  • Enhanced mobility. As remote and hybrid work environments become more common, it is important to ensure swift and secure communications between disjointed parties. Compressed files are better for mobile accessibility, ensuring teams can work together from anywhere at any time.

  • Improved data security. Some file compression solutions, including WinZip® Enterprise, encrypt your files to protect sensitive data. Encryption grants access to data through unique keys, giving you more control over how files are accessed.

What files require compression?

A file can come in many sizes depending on the contents of the data. For example, a plain-text file with no attached or embedded style will be much smaller than other file types. However, the majority of current word processors use rich text format, which contains styles and formatting information that increase overall file size. As such, even text documents benefit from file compression.

Media files, such as videos, graphics, audio, and images contain embedded information that increases the overall file size:

Word documents, spreadsheets, and PDFs are other common file types whose size depends on the amount and type of embedded information:

  • Microsoft Word documents can contain embedded fonts that increase the file size. Inserting images into a Word document will also increase the overall size of the file.

  • Excel spreadsheets can take up significant storage space, even if they do not contain a lot of data. Empty, unused cells are a key contributor to overly large spreadsheet files because Excel will still process them as though they contain data. Referencing hundreds or thousands of empty cells will negatively impact the overall file size.

  • PDF files can contain images, links, videos, and many other data types. More data means a larger file. Embedded fonts can also increase the size of a PDF.

The Importance of file compression for sensitive data

Compression isn’t only useful for lowering file sizes or increasing transfer speeds. It also enables you to add file-level encryption for your sensitive documents. Encryption protects data from being accessed by unauthorized individuals.

For example, 256-bit Advanced Encryption Standard (AES) encryption makes data inaccessible to anyone without the proper decryption key or password.

Virtually impenetrable, AES algorithms are the worldwide standard for protecting sensitive, controlled unclassified, and classified information. Experts estimate that attempting to bypass 256-bit AES encryption using a brute-force attack would take trillions of years.

AES encryption is symmetric, which means it uses the same key to encrypt and decrypt data. This simplifies the encryption and sharing process. When you encrypt a file with a unique key and send it to a coworker, they will use the same symmetric key to decrypt the file.

Compression with encryption ensures the safety of the information in the file and compliance with data privacy regulations. Examples of such regulations include, but are not limited to, the following:

How to compress a PDF into an email

WinZip Enterprise is a comprehensive solution that protects your critical data and lets you zip, encrypt, and send virtually any file type, including PDFs.

Compressing a PDF with WinZip Enterprise takes only a few steps:

  1. Locate the file(s) you want to compress.

  2. Right-click to open the WinZip Enterprise dropdown menu and select one of the following options:

    1. Add to Zip file: This option enables you to create your own Zip file name, compression type, method of encryption, and other customizable features.

    2. Add to [filename].zip(x): Select this option to create a Zip file using the default compression method.

  3. Right-click on the zipped folder to open it in WinZip Enterprise and access advanced file management tools.

  4. Compose your email message and click “Attach File.” Select the zipped file(s), attach it to the email, and send it.

Compress and protect your data with WinZip Enterprise

WinZip Enterprise uses lossless AES encryption that reduces file size while increasing data security. This encryption occurs at the file level rather than the device level, ensuring that files are secure in transit and at rest.

File compression and encryption are only effective if the solution is easy to use and suitable for your needs. For this reason, WinZip Enterprise was developed to be fully customizable, ensuring that your IT team can set and enforce policies and standards that will keep your data safe.

WinZip Enterprise is also compliant with Windows Information Protocol (WIP), which secures corporate data on employee devices. By tagging corporate data on these devices, IT admins can deploy internal security controls that automatically encrypt data that is downloaded, saved, or retrieved from your organizations’ apps, networks, and protected domains.

Learn more about WinZip Enterprise’s file compression features and benefits.

HIPAA data protection requirements: what you need to know

If your organization qualifies as a Health Insurance Portability and Accountability Act (HIPAA) covered entity, you are legally required to abide by a set of rules and regulations. HIPPA rules define covered entities as the following:

  • Health plans, including many types of organizations and government programs.

  • Healthcare clearinghouses, including billing services, repricing companies, and community health information systems.

  • Healthcare providers who transmit health information electronically.

HIPAA data protection requirements apply not just to those in the medical industry, but also certain government programs, insurance providers, and business associates of covered entities.

HIPAA compliance is the process that businesses and individuals follow to keep people’s healthcare data private. HIPAA sets a standard for healthcare data management, seeking to protect a patient’s right to privacy and ensuring the appropriate security controls are in place if patient data is breached.

Keep in mind that the healthcare industry is governed not just by HIPAA regulations, but by other related data protection laws, such as the Gramm-Leach-Bliley Act and the Payment Card Industry Data Security Standard.

In this article, we’ll look at the various requirements that healthcare and insurance professionals must meet to protect user data.

Why HIPAA compliance matters

Compliance with HIPAA means you have adequate measures in place to protect patient data. HIPAA also protects organizations and employers by holding violators accountable for their actions.

Failure to comply with HIPAA rules is known as a HIPAA violation. Violations can lead to fines and civil and criminal penalties, even if the violations were accidental or unintentional.

It’s easier to violate HIPAA rules and regulations than you may think. Common examples of HIPAA violations include:

  • Violating patient privacy by snooping on healthcare records. For example, the University of California Los Angeles Health System was fined $865,000 when a doctor accessed celebrities’ medical records without authorization.

  • Denying or delaying patients’ access to their health records. For example, an Ohio medical services provider received a $32,150 penalty for failing to provide a patient with his requested medical records within 30 days of receiving the request.

  • Failure to use encryption or equivalent security measures. This must be done to safeguard healthcare information on portable devices. For example, Lifespan Health System Affiliated Covered Entity (Lifespan ACE), a non-profit Rhode Island health system, agreed to pay over $1 million to settle violations stemming from the theft of an unencrypted laptop.

Most HIPAA violations stem from simple human error. For instance, if a healthcare worker happens to click on a phishing link while using a device that stores sensitive patient health information, the hospital would then be exposed to a potential data breach.

Accidents and unintentional actions happen, but demonstrating compliance with HIPAA training requirements and its regulations can reduce the fines and penalties in the event of a violation.

Data protection laws for healthcare and insurance organizations

In the US, there is no national, comprehensive data privacy law. Instead, there are a variety of federal and state laws and regulations. This lack of uniformity can leave businesses confused about their data protection obligations, increasing the risk of non-compliant behaviors.

Here’s what you need to know about the various data protection laws that impact the medical and insurance industries:

US healthcare and insurance laws/regulations

HIPAA

HIPPA details data privacy and security requirements for safeguarding protected health information (PHI), which is any health information that can be used to identify an individual. When it comes to data protection, HIPAA compliance requirements are found in the Privacy Rule and the Security Rule.

The Privacy Rule identifies when and how authorized individuals can access Protected Health Information (PHI) and puts limits on the use and disclosure of individually identifiable health information.

This rule also grants patients the right to obtain copies of their medical records and request corrections (if needed) to their files. Upon receiving the request, a covered entity (such as a healthcare provider or health insurance company) has 30 days to respond. Failure to respond in a timely manner violates the Privacy Rule’s right of access standard, leading to enforcement actions and monetary fines.

The Security Rule defines and regulates the standards and procedures for the protection of electronic protected health information (ePHI). The rule identifies administrative, physical, and technical safeguards for ensuring the confidentiality, integrity, and security of ePHI.

HIPAA compliance for data storage depends on understanding what policies, mechanisms, and procedures must be implemented to achieve the following:

  • Identify potential vulnerabilities that could impact the integrity of ePHI.

  • Implement measures to prevent unauthorized PHI access.

  • Develop controls to maintain data security for PHI that is sent on an electronic network.

The Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act (GLBA) is a federal law that requires financial institutions to explain how they share and protect their customers’ and consumers’ private information. Also known as the Financial Services Modernization Act, the GLBA is designed to prevent unauthorized use, collection, and disclosure of non-public personal information (NPI).

The scope of the GLBA is broader than many realize. The term financial institution applies to any company that offers financial products or services, including loans, investment advice, and insurance. As such, health insurance companies must comply with both HIPAA and GLBA regulations.

If your company qualifies as a financial institution, you must take steps to protect customer and consumer NPI. This includes any personal information received by your organization that is not publicly available, such as:

  • Social security numbers

  • Credit and income histories

  • Bank account numbers

  • Names, addresses, and phone numbers

There are three specific rules for GLBA compliance that pertain to the financial/insurance industries: the Financial Privacy Rule, the Safeguards Rule, and the Pretexting Rule.

The Financial Privacy Rule

The Financial Privacy Rule focuses on disclosure practices, such as providing customers with written notices regarding their privacy practices and policies. This privacy notice must be provided at the time the customer relationship is initiated and annually thereafter.

Privacy notices must explain the following:

  • What information is collected about the consumer.

  • What information is shared with third parties.

  • Company policies related to data confidentiality and security.

  • The customer’s right to opt-out of having their information disclosed to third parties.

The Safeguards rule

The Safeguards Rule mandates protections for information security. To comply with the rule, you must develop a written information security plan that explains how you protect customer data.

A comprehensive information security plan includes the following safeguards:

  • The designation of a single individual who is responsible for implementing and overseeing the information security program.

  • The requirement of a written risk assessment that addresses specified criteria, such as access controls, data inventory, encryption, and incident response.

  • The periodic assessment of your service providers to ensure their safeguards are adequate.

The Pretexting rule

The Pretexting Rule prohibits access to private information under false pretenses. Pretexting occurs when an attacker convinces their victim to divulge information or give up access to a service or system.

A form of social engineering, pretexting depends on using a made-up story that makes the attacker seem like they have the right to access the information.

Compliance with the Pretexting Rule requires that you have mechanisms in place to detect and mitigate unauthorized access to personal, non-public engineering information.

The Payment Card Industry Data Security Standard (PCI DSS)

The PCI DSS seeks to ensure that all companies that accept, process, store, or transmit credit card information keep their data secure.

There are six control objectives and 12 requirements for PCI DSS compliance, but we will focus on the ones that are specific to data protection: Network and system security, cardholder data protection, and access control measures.

Network and system security

  • Using and maintaining firewalls will help block and prevent unauthorized access to your systems and network. A firewall monitors and restricts incoming and outgoing network traffic using your defined rules and requirements. For example, your organization may have firewalls installed at your network perimeter to prevent external threats and within the network to protect against insider threats.

  • To be effective, your passwords should be long, complex, and unique. Avoid common, easy to guess passwords and use a mix of letters, numbers, and symbols. For example, 123456 is commonly used and easily cracked, but a password such as 550-350=TwoHundred is much stronger. Be sure to reset default passwords on your devices and applications, enable session timeouts, and encrypt passwords during transmission and storage.

Cardholder data protection

  • Protecting cardholder data requires that you encrypt the data and protect it with encryption keys. Primary account numbers (PANs) must be stored in an unreadable form, ensuring that data cannot be read and used by a would-be attacker.

  • In addition to encrypting stored data, you also need to encrypt data in transit across public networks. You must ensure that your wireless networks follow industry best practices for data encryption, authentication, and transmission.

Access control measures

General state healthcare and insurance laws/regulations

Many states have their own rules for data privacy, some of which are even more rigorous than HIPAA requirements.

For instance, the California Confidentiality of Medical Information Act (CMIA) requires that medical and insurance companies obtain written authorization from the patient to disclose medical information.

If an individual’s PHI is compromised, the CMIA makes it possible to file a lawsuit against the person or entity and potentially recover compensatory and punitive damages.

The New York Department of Financial Services Cybersecurity Regulation (NYDFS Cybersecurity Regulation) applies to banks, insurance companies, and all other financial service institutions.

Under the NYDFS Cybersecurity Regulation, you must have a cybersecurity program in place that addresses information security, access controls, and provisions for regular risk assessments.

The role of encryption in HIPAA compliance

Encryption keeps information safe from unauthorized access and use by potentially malicious third parties. The Department of Health and Human Services (HSS) identifies encryption as the best practice to safeguard data from being compromised.

HIPAA data protection requires information to be encrypted both in transit and at rest. Data that is considered at rest is inactive and can be stored in a digital medium such as an organization’s server hard drive. Data in transit is actively transferring from a sender to a receiver at a specified destination (such as sending consumer information via email).

The importance of secure data storage

Ensuring that data is secured properly is paramount to compliance with applicable data laws and regulations. However, insecure data storage is more common than you may realize.

Examples of insecure storage include the following:

  • Storing unencrypted sensitive data.

  • Storing sensitive data with weak encryption algorithms.

  • Storing sensitive data in a shared location.

  • Using vulnerable components, such as libraries or frameworks.

The healthcare and insurance industries are at an increased risk of cybersecurity attacks because of the volume of sensitive data they collect.

For instance, the finance/insurance industry experienced 721 data breach incidents in 2021, and 467 of those incidents confirmed data disclosure. In the same year, the healthcare industry reported 712 data breaches, impacting hundreds of thousands of individuals.

If you fail to properly abide by laws and regulations for securing sensitive data, there can be legal, financial, and professional consequences.

How WinZip Enterprise helps you meet data protection requirements

WinZip® Enterprise uses Advanced Encryption Standard (AES) encryption, a bank and military-grade encryption service that is compliant with all major standards, including FIPS 140-2.

The National Institute of Standards and Technology (NIST) encourages the use of AES encryption to meet HIPAA requirements. AES encryption is known for its ability to provide long-lasting protection against brute force attacks, which is why it is the most widely used file encryption solution.

When data is stored or transported on removable media, such as a USB drive, the device must be properly protected against unauthorized access. WinZip SafeMedia™ empowers your IT admins to customize and uphold security protocols and standards that keep data on removable media secure.

WinZip Enterprise also protects against data breaches through centralized IT control. This ensures that users adhere to your password policies, encryption standards, and access controls to prevent data loss.

Learn more about how WinZip Enterprise help your organization stay HIPAA compliant.

How to encrypt a file on a Mac

Although Mac computers generally have a reputation for being more secure than PCs, this is a myth: these devices are also susceptible to cyberattacks. For example, Kaspersky Lab estimates that 700,000 Mac users were affected by the Flashback Trojan virus by 2014. The virus, which exploited a gap in programming of the Java application, turned Mac computers into “zombie computers” and allowed hackers to gain personal user data.

Researchers have also successfully bypassed one of Apple’s key security features, Gatekeeper, in order to steal user information and install malware. Gatekeeper functions as a security feature for the macOS operating system that verifies applications before running them—in theory helping to deter malware from running on a device.

Parallels® reports that 55% of businesses use (or allow the use) of Mac devices. Businesses must therefore consider how to properly secure these devices and their files.

A key component of cybersecurity is the encryption of files and devices. Encryption helps companies maintain data integrity by making it difficult for hackers to access and read sensitive data.

In this article, you will learn why encryption is an essential security tool for businesses, as well as how to encrypt a file on a Mac computer to protect sensitive company information.

What is encryption?

To understand encryption, it’s first necessary to understand cryptography, which is the science of encrypting and decrypting information.

Encryption is the process of hiding digital information via cryptography. Units of information (called plaintext) are scrambled using an algorithm to encrypt it, at which point it’s referred to as cipherciphertext

Cipher text cannot be read or altered—which is the point. Encryption is intended to make information unreadable to unauthorized users for purposes of confidentiality, integrity, authentication, and non-repudiation of data.

Encryption works by creating random strings of data, called bits, which are used to encrypt and decrypt information in and out of ciphertext. These bits serve as the key to locking and unlocking the data.

The Advanced Encryption Standard (AES) is the most widely used encryption algorithm. Developed by the National Institute of Standards and Technology (NIST), AES uses a cryptographic algorithm developed by the Federal Information Processing Standards (FIPS), which is known as the security standard for transmitting sensitive information.

AES utilizes long blocks of cryptographic code in lengths of 128, 192, or 256 bits. With 256 bits, there are 2256 possible combinations to hack the code. It is therefore virtually impenetrable.

To read encrypted data, unauthorized users must guess which code was used for encryption and what keys were used as variables. The higher the bit value, the lesser the likelihood that brute force attacks could guess the code and unlock the data.

The dangers of doing business without encryption

Since AES is virtually impenetrable, it is used by numerous entities that work with sensitive information, including banks, financial institutions, insurance companies, healthcare companies, and government agencies.

The storage, use, and transfer of sensitive data is heavily regulated in many of these industries. For example, in the insurance industry, using unencrypted security codes is a noncompliance issue with the PCI Security Standards Council (PCI DSS), which covers all entities involved in secure payments and transactions.

As encryption keeps important, confidential information away from unauthorized users, it is one of the most effective ways to reduce the cost of a data leak (also called a data breach).

Data leaks cost companies in a myriad of ways. Consider the following statistics:

Data encryption ensures that malicious actors can’t decipher what they’ve accessed. Without encryption, you could potentially expose sensitive information.

In 2020, for example, an unencrypted database with 8 million UK shopping records was mistakenly exposed on search engines. Anyone could find and use the data without a password or any authentication measures.

Should such a data breach occur in your business, your customer’s data could fall into the hands of attackers and result in a costly scenario that tarnishes your reputation and leads you to lose customers.

Since cyberattacks can have such a costly impact, many companies use cybersecurity insurance coverage, which protects users and businesses from the costs of cyberattacks. This market is expected to grow rapidly in the coming years, from 8 billion US dollars in 2020 to 20 billion US dollars in 2025.

Unencrypted data, however, is typically excluded from cybersecurity insurance coverage. Yet unencrypted data remains one of the top four cybersecurity vulnerabilities in the financial services industry. (Malware, unsafe third-party services, and phishing threats are other dangers to data safety.)

Data should be encrypted even when being sent on private networks. In the defense and government industries, for example, communications are encrypted (and therefore protected from unauthorized interception). However, unencrypted communications could be intercepted by anyone that has access to the network.

Even when networks are secure, stolen servers and lost devices put data at risk. For example, a Colorado hospital had unencrypted copies of patient records on an external hard drive. The Colorado Health Department requested copies of multiple records and asked for these to be supplied on an external device.

In contradiction to the health department’s policy, the device was not properly encrypted, and the person responsible for the device lost it. Since the misplaced device was not encrypted, protected health information could potentially be accessed by unauthorized individuals.

Industry-specific regulations

In November 2019, an unencrypted laptop and flash drive were stolen from The University of Rochester Medical Center (URMC). As part of a settlement, URMC paid $3 million to the Office for Civil Rights (OCR) due to potential violations of the Health Insurance Portability and Accountability Act (HIPAA) privacy requirements.

HIPAA details the requirements for storing and sharing protected health information and electronically protected health information (e-PHI), and is just one of many regulatory bodies that certain businesses must comply with. Depending on the industry, enterprises may need to follow specific regulations related to data safety and storage.

Encryption helps institutions meet regulatory requirements, which will vary from industry to industry. Consider the following regulatory and compliance-related entities that have specific encryption-related requirements:

  • The PCI Security Standards Council (PCI DSS), which covers all entities involved in secure payments and transactions.

  • The General Data Protection Regulation (GDPR), which involves EU data protection and privacy for users within the EU and covers everything from data retention policies to information sharing. The GDPR applies to any business with customers or users in the EU.

The benefits of encrypting files on a Mac

If the files on your company’s Mac are not encrypted, they pose serious security threats to your organization. Without encryption, third parties could simply remove the drive, attach it to another computer, and upload the drive’s contents to that computer’s operating system.

Encrypting files keeps them safe whether they are on a USB drive, shared via email, or sent to the cloud. Once encrypted, bad actors can’t gain access to your information without your login credentials.

By keeping your device and your files safe, you help your business avoid the costs related to data breaches. These costs can include legal ramifications (an Equifax 2017 data breach, for example, cost the enterprise $700 million in payouts to its US customers.)

These costs can even include damage to your business’s reputation. One Forbes study found that 46% of businesses experience reputational damage to their brand after a data breach.

File safety therefore not only helps your business with compliance, but also helps it avoid costly setbacks from data breaches.

How to encrypt a file using WinZip for Mac

Mac computers come with built-in security measures. For example, computers with Mac OS X 10.3 or later come equipped with FileVault, which is a built-in encryption program on Mac computers. FileVault encrypts all data on your startup disk.

However, since Mac computers are not immune to cyberattacks, encrypting files on Mac devices is not only a data privacy best practice, but it can also be a requirement for your business or industry.

With WinZip® for Mac, you can encrypt files and folders and then control access to who can view these files. By applying powerful AES encryption,

An added benefit of WinZip for Mac is that it reduces file size through compression. This enables you to transfer data more quickly and frees up space on your Mac, portable storage device, or cloud.

You can encrypt a file on a Mac with WinZip by following these steps:

  1. Open WinZip.

  2. Click Encrypt in the Actions pane on your right side.

  3. Drag and drop your files to the NewZip.zip center pane.

  4. Enter a password when the dialog box appears.

  5. Click OK.

  6. Click the Options tab in the Actions pane and choose Encryption Settings.

  7. Set the level of encryption and click Save.

Explore how WinZip can help encrypt your company’s digital assets.

How to compress ISO files

How to Compress ISO Files

The rapid and lasting increase in remote work due to the COVID-19 pandemic has impacted how certain technologies are used in the workplace. Businesses now have the need for systems that enable secure communication, data access, and file sharing and storage for employees working in the office, at home, or a combination of the two.

As the need for these technologies grows, so does cybersecurity concerns. Remote work environments blur the line between workers’ personal and professional lives.

This can introduce cybersecurity vulnerabilities, such as using personal devices to access work applications, connecting to corporate networks with insecure devices, and letting unauthorized individuals (e.g., family members) use employee work devices.

File transfers are often the weakest security point for cyberattacks. It is therefore vital for companies to share files securely. One method of file sharing and storage is ISO files, which are disk image formats based on the ISO 9660 standard.

ISO 9660 is a generic file system that supports operating systems such as Windows and Mac OS. It was created by the International Organization for Standardization (ISO), which is an international entity that creates technical, industrial, and commercial regulations.

In this article, you’ll learn what an ISO file is, how it can be used to store business data, and how to compress ISO files and extract their content.

What are ISO files?

An ISO file is a software copy of a physical optical disk (e.g., a CD, DVD, or Blu-ray). It is also referred to as an ISO image or disk image.

An ISO file contains not just the files and folders of a CD or DVD (e.g., the disk’s images or songs) but also all of the disk’s file system information, such as directories and file attributes. ISO files archive all of this information into a single file while keeping the same folder and file hierarchy as the original content.

ISO files store raw data in a binary format (a numeric system using ones and zeros). They do not have a file system that will instruct the computer on how to access the files and folders stored on the ISO file. This means that, in order for a computer to read an ISO file, the file must first be mounted by the operating system or a disk utility program.

Mounting is the software process that makes the ISO’s folders and files readable by a computer by treating the ISO file as if it were a physical disk.

How are ISO files used in business?

To understand today’s uses of ISO files, it is important to understand the relationship between ISO files and optical disks such as CDs.

Originally, CDs were often used to store audio data or to distribute software data. Users who purchased Microsoft Office, for example, would purchase a physical CD that contained the information needed to download the software onto their computer’s hardware.

Today, most audio files are stored on cloud systems––and most software systems are available via an online download. The need for CDs has declined drastically.

This decline coincided with technology and design-related reasons for phasing out optical drives from laptops. Devices can be smaller, lighter, and more affordable if they’re built without optical drives. Optical drives also require a lot of power to operate. This affects device battery life.

Optical drives can also create limits to computer performance. In order to accommodate an optical drive, the device’s motherboard must be smaller. The smaller the motherboard, the more limited the device’s performance.

As a result, modern computers don’t have optical drives. Instead, companies can turn to ISO files to distribute data that once lived on optical disks.

Organizations can use ISO follows to accomplish the following:

  • Distribute large file sets. With an ISO file, you can transfer a large file set, such as an entire software program or operating system. For example, Microsoft Office and the Windows operating system are available as ISO files. These files can be emailed or shared via cloud services, enabling companies to distribute large software files rather than use physical disks that can be lost or damaged.
  • Replicate optical disks. Creating an ISO file of a disk results in a digital backup copy of that disk and all of its information. This makes it easier to install software on computers and other devices that do not have an optical disk drive.
  • Store data in a functional way. Creating virtual backups of optical disk data helps maintain the 3-2-1 strategy of data storage. This strategy involves creating one primary backup and two copies of the data. When using ISO files, these copies may include more optical disks and an ISO image.
  • Share data safely. To safely transfer files, businesses turn to secure file compression with encryption, which protects data confidentiality by translating data into another form (a code). Encryption can occur at a system or device-wide level or at a file level. Encrypting data at a file level ensures ISO files are shared securely.

Advantages of compressing ISO files

Since ISO files are uncompressed, they can take up a significant amount of storage space on your computer or your organization’s cloud storage system. They may also take longer to share or download.

Compressing the files can help speed up transfer time. In addition, if you compress files while also safely encrypting their data through programs such as WinZip Enterprise, you can protect your files against data corruption and loss.

A compressed file is an archive that contains one or more files that have been reduced in size, which makes them easier to transfer or store. Files are compressed in one of two ways: lossless compression or lossy compression.

  • Lossless compression involves compressing data by reducing file sizes without removing content or information. Lossless compression works by removing redundancies (the same data pieces held in multiple places within the storage environment, such as your computer or an optical disk).
  • Lossy compression involves data compression that loses some information. In most cases, this may not be noticeable at first.

However, if the same file is compressed again and again, the loss of quality could become noticeable. Although lossy compression allows for a higher rate of data compression, data cannot be recovered or reconstructed in the exact format as before compression.

Lossy format may degrade the ISO when you try to decompress it. Therefore, when working with ISOs, you should use the lossless compression method.

Extracting and zipping ISO Files using WinZip Enterprise

Since ISO files can be fairly large, it may be in your business’s best interest to zip them before storing or sharing them. This will increase transfer speeds and decrease storage used.

With WinZip® Enterprise, you can access, zip, and extract ISO files without using a virtual disk.

Zipping an ISO file with WinZip Enterprise

To zip an ISO file using WinZip Enterprise, follow these steps:

  1. Right-click on the ISO file.
  2. Click “Send to” and choose “Compressed (zipped) folder.”
  3. Open the Start menu. On the right-hand side of the window, click “Computer.”
  4. Locate the ISO file you wish to zip.
  5. Right-click on this ISO file, then click “Send to.”
  6. Choose “Compressed (zipped) folder.” Note: since ISO files are often several hundred megabytes, this process may take a few minutes.
  7. Once the zipped ISO file has been compressed, enter a name for the file.

Extracting an ISO File with WinZip Enterprise

WinZip Enterprise extracts the ISO content and places it on the user’s hard drive. It enables you to extract ISO files on Windows 7, Windows 8, and Windows 10.

The ISO extraction process will create copies of all the installation files in a folder on your hard drive. You can then browse through these files just as you would any other folder located on your computer.

To extract an ISO file using WinZip Enterprise, follow these steps:

  1. Locate the ISO file you want to extract. Download this file to your computer, and then locate it in your “Downloads” folder (or wherever else you store downloaded files on your computer).
  2. Launch WinZip Enterprise. To open the compressed file, you must first launch WinZip, and then click on “File > Open.”
  3. Select files. WinZip Enterprise allows you to select the files or directories you wish to extract, or select all files. To select specific files or directories, hold down the Control key, then click on the files you wish to extract.
  4. Extract ISO files. From the drop-down list, select a destination folder to place your unpacked files.

From storing and zipping to extracting ISO files, WinZip Enterprise provides the tools needed to utilize ISO files for secure data sharing and storage.

Discover how WinZip Enterprise provides an easy way for organizations to compress files.

Learn more about WinZip Enterprise today!

Get a Quote

Connect With Us