Flash Drives: New Technology Always Means New Risks Reducing the Risks Sonny Discini
Data theft is only one side of the coin. The other is data loss. Vendors have begun responding to this problem by manufacturing flash drives with built-in security features. There are a number of open source encryption packages that can be freely used to encrypt flash drive data in an effort to mitigate the aforementioned risks.
Since these devices are very compact, people tend to lose them much easier than larger removable media. This means that the potential for the loss of large amounts of data greatly increases when users are issued flash drives. Personally, I have come across 3 or 4 flash devices wedged in the seats of mass transit trains. One of the devices contained all of the owner's personal and financial information (QuickBooks, credit card numbers, etc.). Of course, the drive was returned to them with an important lesson learned. Fortunately, it did not cost them the pains of what an identity theft victim normally goes through.
Is there anything that can be done to reduce the risks?
Well yes, there are some common sense approaches to reducing the risks associated with these fabulous new toys. Since USB flash drives are extremely cheap, they will end up in the hands of many users and certainly will continue to be the removable medium of choice for the traveling professional. Start with a small training class that outlines the risks that the flash drives pose. You'll find that many users are initially more concerned with the novelty factor than its high potential for misuse. This is an opportunity to change that mindset.
Another audience to educate is your security personnel. Would your security personnel know what a flash disk looks like? This often-ignored group is a critical ingredient in your overall security plan. This is a very tricky solution because you have to take into account personal rights issues when training security guards on the proper method of searching for and handling these devices. The best thing to do is work jointly with HR and legal to devise effective guidelines to ensure that security personnel follow proper procedures should they encounter a USB flash drive during the course of their duties.
I've said it before and I'll say it again, enforce desktop policies. Don't allow users access to information that is not essential to their duties. If you can take it a step farther, disable USB or any other ports that aren't needed. Sure, end users will complain at first, but this is much easier to digest than a full-blown security event.
One last, but very important point. Be sure that your anti-virus solution is configured to provide real-time scans of removable media when present. Currently, several big name AV vendors do not do this by default.
USB flash drives are wonderful and, with some due diligence, can prove to be an invaluable tool in your business. Like any new technology, if you weigh all of the risks and enforce the appropriate controls, you should be able to enjoy the benefits without becoming an unfortunate statistic.
