The Encryption Deadline
A small credit union stores customer records on a server that is backed up nightly to an external drive kept in the same room. A regulator requires encryption of data at rest within 90 days. The IT officer proposes full-disk encryption on the server. The manager points out that the backup drive is unencrypted, staff share one administrator password, and the server room is a converted storeroom with a standard lock. The credit union has no dedicated security staff, a limited budget, and 4,000 customer records. A vendor offers a cloud backup service with encryption but the contract is unclear about who holds the keys.
1. Prioritise the risks and explain why full-disk encryption alone would not satisfy the regulator's intent.
Read the worked answer
Ranked risks:
- Unencrypted backup in the same room - the highest risk, because a single theft or fire event compromises both the live data and its copy. Encryption of the server leaves the easiest copy exposed.
- Shared administrator password - destroys accountability and makes any access log meaningless; insider or accidental misuse cannot be traced.
- Physical insecurity of the room - a standard lock on a storeroom is a low barrier.
- Unclear key custody in the cloud option - a contract risk that could transfer control of data protection to a third party.
Full-disk encryption protects data only when the machine is off and the key is not available. With a shared password and an unencrypted offsite-in-name-only backup, an attacker who takes the drive or logs in with the shared credential defeats it. The regulator's intent is confidentiality of customer data under foreseeable loss scenarios, so encryption must cover every copy and be paired with access control.
2. Recommend a 90-day plan that is feasible for a small organisation, stating what you would defer.
Read the worked answer
Days 1–30: Encrypt the backup drive and move it off-site or to a locked separate location; replace the shared administrator password with named accounts and multi-factor authentication; document who holds each key. Days 31–60: Apply full-disk encryption to the server with key escrow recorded in a sealed procedure; restrict physical access to the room (stronger lock, access log); test a restore from the encrypted backup, since an untested backup is not a backup. Days 61–90: Review the cloud contract for key ownership and data-location terms; if acceptable, migrate backups and retire the local drive. Brief staff on the new login rules.
Defer: a full security operations programme, penetration testing, and endpoint encryption for every workstation - valuable but not achievable in 90 days with no security staff.
Judgement: fix the exposures that a single event could exploit, prove recovery works, and only then expand. A plan that promises everything in 90 days would likely deliver nothing verifiable.