linkedin  Google+  email-3  twitter  facebook

Beware the humble USB drive

Find me on:

USB_drive_in_pocketIn recent posts, we’ve looked at what a transition to the cloud would mean for your day-to-day operations, and we’ve surveyed the current landscape of mobile printing.

In both, we briefly touched on security, but there is something more to add when it comes to security of your network in addition to cloud – portable storage drives, and in particular the ‘unassuming’ USB drive.

USB Drives

USB drives have been around for nearly a decade and a half now, and despite the rise of cloud computing, they’re still a popular and effective method of data storage. There are a number of reasons for their sustained popularity: they’re portable, easy to use, and increasingly cost-effective.

Even USB drives, though, are not without risk. They’re vulnerable on two fronts: data leaks and malicious software (malware and viruses).

Data leaks occur precisely because of USB drives’ portability and ease of use. For starters, they’re easily lost. If a flash drive is lost, of course, so is the data on the drive if it’s not backed up to an external location. Worse, confidential data can be easily accessed by anyone who finds the drive.

But there’s another risk: viruses. Viruses and malware aren’t often associated with USB drives, but they’re often spread through the use of flash drives. Perhaps the most infamous example is the Stuxnet worm, which hides itself inside a network, then modifies the network’s code from the inside. More often than not, the worm enters the network through USB drives.

One of our own clients has witnessed the catastrophic results of USB threats first-hand. Having experienced data loss due to a USB infection, the company implemented a “once burnt, twice shy” approach to USB security. First, they set up an email alert system, which sent an email to a manager when anyone plugged any USB device into a computer on the network. They even went so far as to physically lock each USB port in the entire office. They weren’t going to be burnt again.

At BMS, we implement Anti-Virus solutions and Policy configuration on our customers networks to block access to USB devices for users or groups of users. This gives our customers that extra peace of mind with a security option that will greatly reduce the risk of USB storage devices.

Cloud vs USB

There is a balance to be had - a happy medium with regard to data security. Eliminating the use of USB drives entirely will eliminate the threat. But in the process it also eliminates the advantages of USB technology.

Instead of using USB drives the customer we mentioned above had to find an alternative for transferring and storing their files. They opted to use the cloud, installing stringent security measures to protect their network against threats. One such measure was a safety net of sorts: any executable file that was downloaded (from Dropbox, say) could not be opened, eliminating the threat of malicious software being installed to the network, at least through those means.

Even that method isn’t foolproof, though: if the Dropbox application was updated, it wrote itself over the old version, wiping out the rule, and thus the safety net.

While not a red flag as such, when it comes to cloud storage, the number of services that are now available is something that by default has generated new risk. While the number of options to choose from are of huge benefit to businesses in general, it does unfortunately increase the risk of a data breach – it is becoming increasingly easy to move data from a network so that it can be accessed elsewhere.

So here we see the two extremes: on one side, threats from USB drives. On the other, threats from the cloud. But simply not using these technologies isn’t an ideal solution. Treating each threat with comprehensive, common-sense security measures, you can find a balance between usefulness and network health.

Wrap-up

It’s impossible to guard against every single threat that exists, or that will exist in the future. You can never really stop a virus that hasn’t been developed yet, after all. But a common sense approach to security measures means you can have the best of both worlds: new technologies that optimize efficiency and productivity without leaving you vulnerable to security threats.

The best approach requires an understanding both of your business’s needs and the ever-evolving threats your network faces. If you have any questions or would like to discuss network security for your business, contact our helpdesk on 02 4254 5444 or email us.

Subscribe to our blog to receive regular articles