InformationWeek highlights a new study showing that malware on USB sticks is wreaking havoc on information security.  The new survey by the Ponemon Institute found:

In the past two years, 70% of businesses have traced the loss of sensitive or confidential information to USB flash memory sticks. While such losses can obviously occur when the devices get lost or stolen, 55% of those incidents are likely related to malware-infected devices that introduced malicious code onto corporate networks.

Most of the respondents do not have any form of endpoint security in place, or don’t enforce their own USB security policies.  Cost may be an important factor as “75% of respondents said they wouldn’t pay a premium to ensure that USB drives are safe and secure.”

Setting aside the fact that this is short-sighted given the cost of a data breach, you don’t need to break the bank to secure your USB drives.  The Kanguru Defender Basic features automatically enforced military-grade encryption, plus an onboard anti-virus scanner to prevent malicious code from entering your network.  Best of all, it’s available at a mainstream price.

Data Security

The Boston Herald has details on a bank executive who resigned and then left with thousands of documents belonging to his former employer, Boston Private Bank & Trust Co.

In a suit filed in U.S. District Court on Monday, Boston Private Bank & Trust accuses former lending executive Todd Rassiger of stealing proprietary information that benefits his new employer, First Republic Bank.

The 24-page lawsuit alleges that before his resignation from Boston Private Bank & Trust Co., Rassiger attached personal USB flash drives to his bank-issued computer and downloaded more than 1,500 documents, many of which included highly confidential and proprietary information.

These days, companies need to be concerned with both external cyberattacks as well as the threat posed by insiders who have access to sensitive data.  Our recent post highlights the need for endpoint security, which can block personal flash drives and keep an audit log of which files are downloaded. 

We also highly recommend remote management capabilities for all portable devices like smartphones and storage devices.  Kanguru’s Remote Management Console can be used to instantly revoke device access from employees who are leaving the organization.  Their company-issued USB drive will be remotely disabled or deleted the next time it’s plugged in.

Data Security, Financial, Portable Storage

Dark Reading highlights the growing number of cyber-attacks against law firms.  The law firms themselves may not always be the primary target in these attacks.  Rather, the thieves are often going after all the data pertaining to the firm’s corporate clients.  A law firm may collect massive amounts of data during the e-discovery process and the data is not always well protected.

Firms sometimes use thumb drives to gather this information. “I attended a program on e-discovery where someone from a law firm was talking about … how [people] were collecting information on thumb drives and then taking it back to the law firm. It was very insecure … a very informal kind of ad hoc process, with really no security built in,” Thomson says.

Kanguru has first-hand experience securing flash drives for legal firms.  Our encrypted devices and remote management software ensure that all data stored on thumb drives is locked down automatically, both within the firm’s network and out at client sites.  In addition, Kanguru’s USB Device Control software prevents users from bringing in unsecure flash drives and using them on the network.  Built-in Anti-virus scanners protect each thumb drive in real-time so that no trojans or other malware can infiltrate the firm’s database.

Find out more at: https://www.kanguru.com/index.php/flash-management/krmc

Data Security

11 Things You Can Do With Kanguru Defender Elite Encrypted Flash Drives

1. Communicate security policy changes and updates directly to the drive and enforce changes as necessary via remote management.
2. Audit drive usage to ensure policy updates.
3. Create lists (whitelist/blacklist) of approved IP ranges so that drives are only used in trusted locations.
4. Track device usage and location via IP addresses.
5. Set a master password for administrator access.
6. Immunize any PC or Laptop with Defender Elite’s onboard Anti-Virus.
7. Disable and/or delete devices that have been lost or stolen.
8. Meet regulatory requirements through the use of a verifiable security audit trail.
9. Track device activity on each workstation/computer using Kanguru USB Device Control.
10. Revoke drive access to former employees still in possession of their drives.  (Particularly useful if their drive contains proprietary company info.)
11. Sleep well knowing that 100% of your data is secure!

Data Security

In early 2009 the National Archives announced that it had lost a 1TB portable hard drive containing sensitive information from the Clinton Administration.  Since none of the data was encrypted, the social security numbers and other personal data could easily be used to commit fraud.  NARA had no remote management capabilities for the device, so there was really no way for them to track down the drive short of offering a substantial reward.  Now they have announced exactly that - Federal Office Offers $50,000 Reward for Missing External Drive.

Upgrading hard drives and flash drives to encypted models with remote management capabilities would have cost less than $50,000 plus credit monitoring costs.  Public and private companies can face even bigger costs than NARA when it comes to a data breach.

Data Security, Government, Portable Storage

A recent NY Times story on the Google - China confrontation mentions an increasingly common attack using USB flash drives to load malware.

Often, malware infections are a result of high-tech twists on old-fashioned cons. One scam, for example, involves small U.S.B. flash drives, left in a company parking lot, adorned with the company logo. Curious employees pick them up, put them in their computers and open what looks like an innocuous document. In fact, once run, it is software that collects passwords and other confidential information on a user’s computer and sends it to the attackers.

USB malware is a serious problem and Kanguru highly recommends using endpoint security to defend against these types of attacks.  Portable flash drives may cause security concerns, but blocking them altogether can reduce worker productivity and cause major inconveniences.  Endpoint security is an easy way to allow limited flash drive usage and still keep out unauthorized devices.  That is why Kanguru has built USB Device Control directly into its Remote Management Console.  Now organizations can remotely manage their secure devices and lockdown all others from one integrated console.

Data Security, Malware, Portable Storage

Employees are willing to steal data from their employers and for the most part there is nothing being done to stop them.  Two separate studies published this week show that insiders are walking off with customer lists, plans and proposals, and sensitive product information.

Dark Reading has more details -

Almost half of the respondents (48 percent) admitted if they were fired tomorrow they would take company information with them, Cyber-Ark says. Thirty-nine percent of people would download company/competitive information if they got wind that their job were at risk. A quarter of workers said the recession has made them feel less loyal toward their employers.

As we have noted before, much of the insider theft (42% in one survey) is committed with the help of USB flash drives.  In response, Kanguru is developing management tools to give companies more control over their USB thumbdrive fleet.  With KRMC, administrators currently have the power to remotely disable or delete employee flash drives when the individual is leaving the company.  Next week Kanguru will be announcing a powerful new add-on module specifically designed to keep unauthorized flash drives out and prevent data leakage via USB devices.

Data Security, Portable Storage

Despite having readily available solutions, our public institutions continue to expose personal data by losing unprotected USB flash drives.

This week the culprit is Roane State Community College, who let an employee copy names and social security numbers to an unencrypted 4GB USB stick.  The drive was promptly stolen from an unlocked car and the College will be paying for credit monitoring for 15,977 current and former students and employees.

Data Security, Portable Storage

Via ComputerWorld, the FBI is investigating mysterious laptops that were sent to several US Governors’ offices.  It seems nobody ordered the computers, and officials are concerned that this might be an attempt to get malware inside the network security perimeter.

USB flash drives and memory cards are also useful for this type of attack due to the natural inclination to plug it in after you find it.

Criminals have tried to put malware on USB devices and then left them outside company offices, hoping someone would plug them into a computer and inadvertently install malicious software on the network. Many Windows systems are configured to automatically run software included on CDs and USB devices using a Windows feature called AutoRun.

The key to preventing these attacks is to have automated USB security policies in place.  Users should be restricted to only company-issued devices that have built-in hardware security features.  All other devices should be blocked from company networks using group policy or endpoint security, which can be implemented with Kanguru Remote Management Console.

Data Security, Malware, Portable Storage

Via Federal Computer Week, the US DOE inspector general recently performed an IT security audit and found that “the department hadn’t ensured that sensitive data stored on mobile devices, sent in e-mail messages, or sent to off-site backup storage is sufficiently protected by encryption, as appropriate.”

The DOE partially agreed with the findings but added:

…taking adequate steps to ensure that there is no sensitive information on laptops or mobile devices should be sufficient without requiring encryption of all data on all devices.

This seems to rely a great deal on user behavior and will be vulnerable to malicious actions or just poor judgment by employees.

Data Security, Government, Portable Storage