Encryption: only works if the device is locked and keys are safe

Device encryption scrambles the data on your laptop or phone so that it is unreadable without the correct decryption key. If someone steals your device but it is locked, they cannot access your files, emails, or passwords. However, if the device is unlocked or the recovery key is stored on a sticky note attached to the laptop, encryption offers no protection at all. Think of encryption as a strong lock on a safe: it only works if you actually close the safe door and hide the key somewhere else.

A common exam trick is to present a scenario where a device is encrypted but left unlocked, or where the recovery key is saved in the same bag as the device. In both cases, the data is not protected. Another trap: encryption does not protect against malware or online attacks; it only guards data at rest. To test your understanding, ask yourself: 'If the device is powered off or the screen is locked, is the data safe?' If the answer is no, encryption is not working properly.

To remember the key point, use the mnemonic 'Lock and Hide': lock the device and hide the recovery key separately. A quick self-check: imagine you leave your encrypted laptop on a train. If the thief cannot read your files because the device is locked and the key is at home, encryption has done its job. If the thief can access anything, encryption has failed.