Protect Your Business Data if a Laptop or PC Is Lost or Stolen

Introduction

Most businesses protect their computers with passwords, antivirus software and other security measures. But what happens if someone gets physical possession of the computer itself?

If a laptop is lost or stolen, a Windows password alone does not necessarily protect the information stored on its drive. Someone with the right knowledge could potentially access the drive without signing into Windows.

This is where BitLocker can help.

BitLocker is a drive encryption feature available with supported editions of Windows. It protects the information stored on a computer so that, if the device or its drive falls into the wrong hands, the data cannot simply be accessed.

What is BitLocker?

BitLocker encrypts the information stored on a Windows drive.

Encryption can sound complicated, but the principle is quite simple. Imagine putting all the information on your computer into a locked safe. While you are using the computer normally, Windows handles unlocking that safe for you. If someone steals the computer or removes its drive, however, the information remains locked.

Without the appropriate credentials or recovery key, the encrypted information should be unreadable.

Windows also has a related feature called Device Encryption, which may be enabled automatically on some compatible computers. Exactly what is available depends on the version of Windows, the hardware and how the computer has been configured.

The important thing is not to assume that a computer is encrypted simply because it is relatively new.

Isn't My Windows Password Enough?

A strong Windows password is important, but a password and drive encryption protect against different things.

Your Windows password is designed to prevent someone from signing into your user account normally.

BitLocker protects the data stored on the drive itself.

Without drive encryption, someone with physical access to a computer may be able to bypass the normal Windows sign-in process. For example, they could remove the storage drive and connect it to another computer to try to access the files.

When the drive is properly encrypted with BitLocker, removing it from the original computer does not remove the protection. The information remains encrypted.

Why Does BitLocker Matter to Businesses?

Consider what would happen if one of your business laptops disappeared tomorrow.

It might contain customer information, documents, saved emails, financial records, quotations, spreadsheets or other confidential business information.

Even if important documents are stored in Microsoft 365, OneDrive or SharePoint, there may still be locally synchronised or cached information on the computer.

Laptops are particularly vulnerable because they regularly leave the office. They can be left on trains, forgotten in hotels, stolen from vehicles or simply misplaced.

BitLocker helps reduce the risk that losing the physical device also means exposing the information stored on it.

Desktop computers can benefit from encryption too, particularly where they contain confidential or commercially sensitive information.

How Can I Check Whether BitLocker Is Enabled?

It is worth checking rather than assuming your computer is protected.

On supported versions of Windows, you can search for Manage BitLocker from the Start menu. This will show the BitLocker status of the drives in your computer.

Depending on your version and configuration of Windows, you may instead see Device Encryption within Windows Settings.

If you manage several business computers, checking them individually is not necessarily the best approach. Encryption status can be monitored and managed centrally in properly configured business environments.

How Should BitLocker Be Enabled?

Before enabling BitLocker, there is one thing you should consider first:

Where will the recovery key be stored?

When BitLocker is enabled, Windows can create a recovery key. This is an extremely important part of the encryption process and should not be treated as an afterthought.

Once you have confirmed that the recovery key will be stored safely, BitLocker can be enabled through Windows on a compatible computer.

For businesses with multiple computers, it is better to have a consistent approach to encryption and recovery key storage rather than leaving each employee to make their own arrangements.

What Is a BitLocker Recovery Key?

A BitLocker recovery key is a unique 48-digit number that can be used to unlock an encrypted drive if Windows cannot unlock it in the usual way.

Most of the time, you will never need to enter it.

There are situations, however, where Windows may ask for the recovery key. These can include certain hardware changes, firmware or BIOS updates, changes involving the computer's TPM security hardware, or other changes that Windows considers significant from a security perspective.

If that happens, having access to the recovery key becomes essential.

Where Should You Store Your BitLocker Recovery Key?

The recovery key should be stored somewhere secure and separate from the computer it protects.

Depending on how your computers are configured, suitable options can include storing recovery information within your organisation's Microsoft Entra ID environment, associating it with the appropriate Microsoft account, or maintaining another securely controlled copy.

For business-managed devices, centrally storing recovery keys is particularly useful. It means an authorised administrator can retrieve the appropriate key when required without relying on an individual employee having saved it somewhere.

Whatever method you use, there is one rule worth remembering:

Do not keep the only copy of your BitLocker recovery key on the computer that it unlocks.

If the computer cannot start normally and that is the only place the key is stored, it will not be much help.



Recovery keys should also be treated as sensitive information. Avoid keeping them in unsecured spreadsheets, text documents or other locations that can be accessed by people who do not need them.

What Happens if I Lose the BitLocker Recovery Key?

BitLocker is designed to prevent people from bypassing its encryption.

That also means there isn't a convenient back door if you lose access.

If Windows requires the BitLocker recovery key and you have no other valid method of unlocking the drive, the information stored on it may become inaccessible.

This is why recovery key management is just as important as enabling BitLocker in the first place.

Before encrypting business computers, make sure there is a reliable process for storing and retrieving the recovery keys.

Does BitLocker Replace Antivirus or Cyber Security Software?

No.

BitLocker protects against a particular type of risk: someone gaining physical access to the data stored on a computer.

It does not protect you from phishing emails, malicious websites, compromised passwords, malware or many of the other threats businesses face.

Likewise, antivirus or endpoint protection does not replace drive encryption.

Different security measures protect against different risks. A sensible business security setup should include measures such as:

• Drive encryption
• Endpoint protection
• Regular Windows and software updates
• Multi-factor authentication
• Strong account security
• Reliable backups
• Appropriate access controls

Together, these provide much stronger protection than relying on a single security feature.

Should You Enable BitLocker on Business Computers?

For compatible business computers, drive encryption is an important security measure.

It is particularly valuable for laptops because they are more likely to be taken away from the workplace, lost or stolen. However, desktops containing business information can benefit from encryption too.

The important part is to make sure BitLocker is configured correctly and that the associated recovery keys are securely stored and can actually be retrieved when required.

Simply switching encryption on without considering recovery is not enough.

A Quick BitLocker Checklist for Businesses

If you are responsible for computers within a business, ask yourself:

• Is drive encryption enabled on our computers?
• Do we know where every BitLocker recovery key is stored?
• Can an authorised person retrieve those keys if necessary?
• Are recovery keys protected from unauthorised access?
• Do new computers have encryption checked when they are set up?
• Is encryption considered when computers are replaced or retired?

If you cannot confidently answer these questions, it may be worth reviewing how your devices are protected.

Protecting Your Business Computers

BitLocker is not a complete cyber security solution, but it addresses an important risk that can easily be overlooked.

A laptop can be replaced. The business information stored on it may be considerably more valuable.

At CED Technology, we help businesses across Cheshire protect and manage their computers with practical IT support and cyber security solutions. This includes helping businesses make sure their devices are properly configured, monitored and protected.

If you are unsure whether your business computers are encrypted, or you would like help improving the security of your IT systems, contact CED Technology to find out how we can help.