It might be on a flash drive owned by a government employee and it probably isn’t encrypted.

KATU has the story of a lost flash drive containing social security numbers for about 300 Oregon Dept of Corrections employees.  It’s not clear whether the Dept had a security policy in place regarding portable storage.  These incidents are preventable with the right combination of technology and security policies.

Data Security, Portable Storage

UPI is reporting on a story from South Korea’s Yonhap News Agency, which has all the ingredients of a great mystery plot:  Secret battle plans, a missing USB flash drive and a potential cover-up.

“The military unit, the DSC and ministry of defense were all informed of the case but never took action,” a source said in the Yonhap report. “It (the drive) contains confidential information on national security, but nobody knows where it is.”

The story lacks detail, but it’s not a stretch to believe that a large organization has know idea where it’s IT assets are.  This is a common problem.

Kanguru’s Remote Management Console solves this issue for USB flash drives.  Administrators can view exactly when and where each device is being used.  The moment that a drive is reported missing, an automatic delete or disable command can be issued from the console.

Data Security, Government, Portable Storage

Defense Systems has a great explanation of the Stuxnet worm that is targeting industrial machines and may have been an attack against Iran’s nuclear facilities.  Kevin Coleman writes that the “Stuxnet worm was highly sophisticated – perhaps the most sophisticated attack that is known to the public thus far, leading some in the field to proclaim the piece of code the best malware ever.”

A commenter on the article asks why critical machines would be connected to the public internet and made vulnerable to such attacks.  Dark Reading points out that even if the machines are isolated, they can be breached using USB sticks:

PLCs and control systems had been considered relatively insulated from the outside world and attack because they aren’t typically Internet-connected. But Stuxnet drove home the worst-kept secret that these systems still are connected to Windows or other machines that can get infected — in this case, by a USB stick — and therefore aren’t as protected as they had seemed.

An easy solution would be to use Endpoint Security or Group Policy to block USB sticks unless they have built-in anti-virus protection like the Kanguru Defender Elite.

Malware

IT Governance Blog has an update on the latest incident involving an NHS Trust, and a possible solution to the problem of unsecured USB sticks.

Healthcare, Portable Storage

A USB stick found outside a Manchester Police station was recently handed over to the news media.  eWeek has a summary of the story and the Daily Star has a picture of the device, which contained information on counter-terrorism tactics and a list of police personnel.  The device was not encrypted and the person who found the stick was able to plug it in and view its contents.

The incident highlights two major security concerns.  The first is that users often fail to protect sensitive information if there is not an enforcement mechanism like self-encrypting hardware.  The second is that people who find flash drives on the ground instinctively plug them in without considering the risk of malware.  Studies have found this to be an easy attack vector for gaining access to corporate networks.

Data Security, Portable Storage

11 Things You Can Do With Kanguru Defender Elite Encrypted Flash Drives

1. Communicate security policy changes and updates directly to the drive and enforce changes as necessary via remote management.
2. Audit drive usage to ensure policy updates.
3. Create lists (whitelist/blacklist) of approved IP ranges so that drives are only used in trusted locations.
4. Track device usage and location via IP addresses.
5. Set a master password for administrator access.
6. Immunize any PC or Laptop with Defender Elite’s onboard Anti-Virus.
7. Disable and/or delete devices that have been lost or stolen.
8. Meet regulatory requirements through the use of a verifiable security audit trail.
9. Track device activity on each workstation/computer using Kanguru USB Device Control.
10. Revoke drive access to former employees still in possession of their drives.  (Particularly useful if their drive contains proprietary company info.)
11. Sleep well knowing that 100% of your data is secure!

Data Security

A recent NY Times story on the Google – China confrontation mentions an increasingly common attack using USB flash drives to load malware.

Often, malware infections are a result of high-tech twists on old-fashioned cons. One scam, for example, involves small U.S.B. flash drives, left in a company parking lot, adorned with the company logo. Curious employees pick them up, put them in their computers and open what looks like an innocuous document. In fact, once run, it is software that collects passwords and other confidential information on a user’s computer and sends it to the attackers.

USB malware is a serious problem and Kanguru highly recommends using endpoint security to defend against these types of attacks.  Portable flash drives may cause security concerns, but blocking them altogether can reduce worker productivity and cause major inconveniences.  Endpoint security is an easy way to allow limited flash drive usage and still keep out unauthorized devices.  That is why Kanguru has built USB Device Control directly into its Remote Management Console.  Now organizations can remotely manage their secure devices and lockdown all others from one integrated console.

Data Security, Malware, Portable Storage

Employees are willing to steal data from their employers and for the most part there is nothing being done to stop them.  Two separate studies published this week show that insiders are walking off with customer lists, plans and proposals, and sensitive product information.

Dark Reading has more details -

Almost half of the respondents (48 percent) admitted if they were fired tomorrow they would take company information with them, Cyber-Ark says. Thirty-nine percent of people would download company/competitive information if they got wind that their job were at risk. A quarter of workers said the recession has made them feel less loyal toward their employers.

As we have noted before, much of the insider theft (42% in one survey) is committed with the help of USB flash drives.  In response, Kanguru is developing management tools to give companies more control over their USB thumbdrive fleet.  With KRMC, administrators currently have the power to remotely disable or delete employee flash drives when the individual is leaving the company.  Next week Kanguru will be announcing a powerful new add-on module specifically designed to keep unauthorized flash drives out and prevent data leakage via USB devices.

Data Security, Portable Storage

Dr. John Halamka, CIO of CareGroup Health System, shares his privacy and security lessons learned.  Dr. Halamka serves as Vice-Chairman of the federal Health Information Technology Standards Committee.

The workgroup’s recommendations include:

All data at rest on mobile devices must be encrypted. Encrypting all databases and storage systems within an organization’s data center would create a burden. But ensuring that devices such as laptops and USB drives, which can be stolen, encrypt patient-identified data makes sense and is part of new regulations such as Massachusetts’ data protection law.

See the full article for Dr. Halamka’s top five security lessons.

Data Security, Healthcare, Portable Storage

At The CTO Forum, Vishal Dhupar of Symantec discusses strategies for securing data at rest.  One of the key points is that data throughout the organization should be classified based on risk and protected accordingly.  Things to consider include regulations, industry standards, business risk, and intellectual property protection requirements.

Regulatory compliance requirements and the threat of having to publicly disclose data breaches have a growing number of IT executives taking a serious look at their security strategies even at the storage level. After all, data loss is big news and it can quickly undermine customer confidence, jeopardize company brand and reputation, and result in significant financial losses. Data privacy has become a critical issue across the world.

Data Security