Security Risks of Portable Storage Devices
Posted by Taylor Seymour on Wed, Oct 15, 2008 @ 02:07 PM
Most companies place a significant investment in securing
network data/ information. IT staffs are
created and service providers are hired with the goal
of keeping business data
functional and accessible by the right personnel. IT professionals do a thorough job creating
firewalls and blocking potentially harmful internet sites. However, extensive damage can be created
internally, from an employee with a USB or MP3 storage device. These overlooked devices pose a variety of
security risks.
The Risks
Viruses
Small portable storage products can bypass perimeter
defenses like firewalls and introduce malware such as Trojans or viruses onto
company networks. An employee can easily
take their work home, update their work on their virus-ridden computer and
return the corrupt files to the company network. Or, an employee can introduce thousands of
their downloaded MP3 files, most likely a few corrupt files, to the stable
company network. These new viruses can
cause chaos in the network and destroy many irreplaceable files.
Data Theft
At 1/Mb per second, a user can copy a 120Mb file to a flash
drive in 2 minutes. Chances are you’ve
stepped away from your desktop for more than 2 minutes. While you’re at the
water-cooler a disgruntled employee can hoard valuable company information. Despite their relatively small size, USB
sticks can hold a large amount of information.
Some USB sticks can hold up to 65 GB of information. To put that in perspective, a 40 GB storage
unit can hold over 10,000 moderately sized MP3 files. Sales forecasts, corporate financials,
customer information can easily be stolen by any employee with a USB
stick.
Data Loss
At about the size of your thumb, USB sticks allow you to
bring your data anywhere. However, at
about the size of your thumb, USB sticks can just as easily be lost or
misplaced. Valuable company information
can be lost in between car seats or gone with yesterday’s laundry. These
storage devices can also fall into the hands of any random person. Critical company information may be revealed
to the public or lost forever all because of a disorganized employee.
While it is difficult to completely restrict portable
storage devices from the workplace, it is important to be aware of their
potential threats. According to GFI
Software, an international developer of network security, 65% of companies
underestimate the security risks posed by the use of USB sticks, flash drives,
iPods and PDAs on company networks. Many
companies have limited access of portable storage devices or encrypted valuable
information. This is a necessary first
step toward protecting the company and its critical data.