Encryption Prerequisites

• Save and close all files and programs.
• It is advisable to undertake the encryption process when you have finished work for the day, so the process has sufficient time to complete
• Should you require assistance at any stage open a New Call in SiteHelpDesk.  In the Summary Field enter FileVault, in the Description field enter the Make, Model and Inventory Number of the device you are having difficulties with and include a description of the issue.  Also include your Faculty/Directorate, Division and Department.

Back Up and Transfer Files

It is highly recommended that you have a backup of your files, prior to enabling FileVault.

Backup what files are required to an external hard drive, USB pen drive or Onedrive.

Once encryption has been successful, delete all copied data from the backup.

Encryption Process

Encryption is simple to implement and easy to use, with little or no inconvenience to the end-user. The instructions below will take you through the general encryption process; you must read the instructions carefully and complete all the steps in order to ensure that data is not put at risk.

Encrypting a computer protects it if it is stolen, and gives peace of mind if it is lost.

• FileVault sets your login password as the encryption pass phrase. Only enabled users are able to start or unlock the encrypted drive. FileVault is enabled via System Preferences -> Security & Privacy -> FileVault -> Lock -> Turn on FileVault
• It is recommend that computers be powered off rather than left in "sleep" or “hibernation” mode when you don't have it with you.

Notes

• FileVault will encrypt your hard-disk drive in approximately one to three hours, depending on its size, but may take up to 24 hours.
• If you so wish you can continue to use your computer during the encryption process.
• Once encryption has completed create a New Call in SiteHelpDesk.  In the Summary Field enter FileVault, in the Description field enter the Make, Model and Inventory Number of the device you have encrypted.  Also include your Faculty/Directorate, Division and Department.
• Separately email a copy of the FileVault Recovery Key to b.mckinney@qub.ac.uk quoting the SiteHelpDesk call reference number

Encryption Prerequisites

• Save and close all files and programs.
• Ensure you have a USB Pen/Flash Drive available before you start the encryption process, as this will be required to store the computers recovery key.
• It is advisable to undertake the encryption process when you have finished work for the day, so the process has sufficient time to complete.
• Not all screenshots/images will match exactly what you see on your computer due to the different versions of Windows Operating Systems used in Queen’s, do not be alarmed by this. 
• Should you require assistance at any stage open a New Call in SiteHelpDesk.  In the Summary Field enter BDE, in the Description field enter the Make, Model and Inventory Number of the device you are having difficulties with and include a description of the issue.  Also include your Faculty/Directorate, Division and Department.
• Please read this document through in it’s entirely so you understand what is required.

Back Up and Transfer Files

It is highly recommended that you have a backup of your files, prior to enabling BitLocker Drive Encryption (BDE).

Backup what files are required to an external hard drive, USB pen drive or Onedrive.

Once encryption has been successful, delete all copied data from the backup.

Encryption Process

Encryption is simple to implement and easy to use, with little or no inconvenience to the end-user. The Windows Encryption instructions will take you through the general encryption process; you must read the instructions carefully and complete all the steps in order to ensure that data is not put at risk.

Encrypting a computer protects it if it is stolen, and gives peace of mind if it is lost.

Notes

• BitLocker will encrypt your hard-disk drive in approximately one to three hours, depending on its size, but may take up to 24 hours.
• If you so wish you can continue to use your computer during the encryption process.
• Once encryption has completed create a New Call in SiteHelpDesk.  In the Summary Field enter BDE, in the Description field enter the Make, Model and Inventory Number of the device you have encrypted.  Also include your Faculty/Directorate, Division and Department.
• Separately email a copy of the Recovery Key to b.mckinney@qub.ac.uk quoting the SiteHelpDesk call reference number.

Setting a passcode/phrase or biometric verification will automatically enable FileVault device encryption on iOS devices (iPhone, iPad). 

Encrypting Android® devices

Android versions 4.0 and above allow encryption of the device through the security option in system settings. Always set a passcode on your device and ensure that any removable memory e.g. Micro SD card is encrypted. Consult your device handbook for further advice.

Microsoft Devices - BitlockerToGo is the recommended USB storage encryption – you do not need to turn on Bitlocker on your computer for this to work.

1. Insert the USB storage device and right click on the assigned drive letter
2. Select “turn on Bitlocker”
3. Enter a password which conforms to the QUB password policy and confirm
4. Save the recovery key to a safe place on your desktop or laptop
5. Encrypt the drive

You will need to enter the password each time you mount the drive in a computer. If you forget the password you will need to use the recovery key to restore the data. DO NOT LOSE BOTH.

Apple Devices - Use the Disk Utility application to format the USB storage with AES-256 encryption or for storage already in use simply right click on the drive and select 'encrypt'.

USB Hardware based encrypted storage - In some cases it may be easier to use USB storage which has built-in full disk encryption. Use a device which has 256 bit hardware based AES encryption – these can be purchased from the Internet at relatively low cost e.g. Kingston, Integral, and SanDisk.

Encrypting email attachments - Never put sensitive information in the body of an email message.

To encrypt Microsoft Office® and Adobe® attachments e.g. Word, Excel, pdf use the password protect option in the document. Use a minimum of 12 characters in the password to ensure adequate protection. Do not send the password in the email – where possible send the password by another method e.g. SMS Text. Business areas emailing sensitive data on a regular basis should consider using commercial zip/encrypt applications like WinZip®, 7Zip®.