USB flash drive security

Also known as secure thumb drives, secure memory sticks, secure pen drives, secure jump drives, secure flash drives, secure USB keys, etc., secure USB drives are used to protect the data stored on them from leaking to unauthorized users.

USB Flash Drive products have been on the market since 2000, and are increasing in use exponentially.^[1] As both consumers and businesses have increased demand for these drives, manufacturers are producing faster devices with greater data storage.

An increasing number of portable devices are used in business, such as laptops, notebooks, universal serial bus (USB) flash drives, personal digital assistants (PDAs), advanced mobile phones and other mobile devices.

Companies in particular are at risk when sensitive data are stored on unsecured USB flash drives by employees, who use the devices to transport data outside the office. The consequences of losing drives loaded with such information can be significant, and include the loss of customer data, financial information, business plans and other confidential information, with the associated risk of reputation damage.

Major dangers of USB drives

The uncontrolled use of USB drives is a major danger since it represents a significant threat to information security and confidentiality.

Therefore the following should be taken into consideration for securing USB drives assets:

• Storage: USB flash drives are usually put in bags, backpacks, laptop cases, jackets, trouser pockets or are left at unattended workstations.
• Usage: tracking corporate data stored on personal flash drives is a significant challenge; the drives are small, common, and constantly moving. Many enterprises have strict management policies toward USB drives, and some companies ban them outright to minimize risk.

The average cost of a data breach from any source (not necessarily a flash drive) ranges from less than USD 100 000 to about USD 2.5 million.^[1]

A Sandisk survey ^[2] characterized the data corporate end users most frequently copy:

1. customer data (25 %)
2. financial information (17 %)
3. business plans (15 %)
4. employee data (13 %)
5. marketing plans (13 %)
6. intellectual property (6 %)
7. source code (6 %)

Examples of security breaches resulting from USB drives include:

• In the UK:
  • HM Revenue & Customs lost personal details of 6500 private pension holders

• In the United States:
  • a USB drive was stolen with names, grades and social security numbers of 6 500 former students
  • USB flash drives with US Army classified military information were up for sale at a bazaar outside Bagram, Afghanistan^[3]

Solutions

Since the security of the physical drive cannot be guaranteed without compromising the benefits of portability, security measures are primarily devoted to making the data on a compromised drive inaccessible. One common approach is to encrypt the data for storage, although other methods are possible.

Software

Software solutions such as FreeOTFE and TrueCrypt allow the contents of a USB drive to be encrypted automatically and transparently. This software can be carried on the same USB drive, and run without having to install it on a host computer. Such software solutions may be used with any USB drive - turning cheap, commonly available USB drives into secure storage systems. Also, Windows 7 Enterprise and Ultimate Editions and Windows Server 2008 R2 provide USB drive encryption using BitLocker to Go.

Additional software on company computers may help track and minimize risk by recording the interactions between any USB drive and the computer and storing them in a centralized database.

Hardware

Some USB drives offer embedded hardware encryption, although these do cost significantly more. Microchips within the USB drive carry out automatic transparent encryption.

Hardware systems may offer additional features, such as the ability to automatically overwrite the contents of the drive if the wrong password is entered more than a certain number of times. This type of functionality cannot be provided by a software system since the encrypted data can simply be copied from the drive. However, this form of hardware security can result in data loss if activated accidentally by legitimate users, and strong encryption algorithms essentially make such functionality redundant.

As the encryption keys used in hardware encryption are typically never stored in the computer's memory, technically hardware solutions are less subject to "cold boot" attacks than software-based systems. In reality however, "cold boot" attacks pose little (if any) threat, assuming basic, rudimentary, security precautions are taken with software-based systems^[4].

Management

In a commercial environment where most secure USB drives will be used ^[1], a central management system may provide IT organizations with an additional level of IT asset control. This may include initial user deployment and ongoing management, password recovery, data backup, and termination of any issued secure USB drive. Such management systems are available as Software as a Service (note that in strict network environments where internet connectivity is limited or prohibited such a solution will be futile) or behind-the-firewall solutions.

See also

• Health Insurance Portability and Accountability Act - encryption is needed in order to move confidential data
• Cruzer Enterprise
• Data remanence
• IronKey

References

This article includes a list of references or external links, but its sources remain unclear because it has insufficient inline citations. Please help to improve this article by introducing more precise citations where appropriate. (September 2009)

1. ^ ^{a b c} ENISA, June 2006.
2. ^ SanDisk Survey, April 2008.
3. ^ ‘Afghan market sells US military flash drives’, Paul Watson, Los Angeles Times, 18 April 2006
4. ^ http://www.freeotfe.org/docs/Main/FAQ.htm#de

External links

• ‘Analysis of USB flash drives in a virtual environment’, Derek Bem and Ewa Huebner, Small Scale Digital Device Forensics Journal, Vol. 1, No 1, June 2007.
• ‘Data breaches are “everyday incidents”’, Matt Chapman, vnunet.com, 15 Nov 2007
• Dataquest insight: USB flash drive market trends, worldwide, 2001–2010, Joseph Unsworth, Gartner, 20 November 2006.
• 'Computerworld Review: 7 Secure USB Drives, Bill O'Brien, Rich Ericson and Lucas Mearian, March 2008