Preventing A Major Attack
Encrypted USB Storage drives help minimize cyber security risks
- By Ruben Lugo
- January 01, 2018
It is probably safe to say USB thumb drives are as ubiquitous on a
college campus as tablets, laptops and textbooks. Not only are
students and faculty using them, so are staff MEMBERS in admissions,
financial aid, accounting, the health center, the security
office and virtually every other department connected to the institution.
If – when – data stored on these drives ends up in the wrong
hands, public trust can be lost, students and faculty are put at risk, and
the school can find itself in the middle of a major PR headache.
Many USB thumb drives being used on campuses today could be
generously classified as BYOD (bring your own device) that are probably
unencrypted, recently purchased at the checkout counter of a
local retail store and more than likely inexpensive. Worst of all, BYODs
can be infected with malware and viruses that can adversely affect the
entire college network.
But wait, there’s more depressing news. Every year, an alarming 20
million unprotected USB drives are lost, stolen, misplaced or forgotten
about. Is it any wonder security risks associated with the use of unencrypted,
removable USB storage devices are a major concern?
Despite these risks, USB thumb drives – as well as other removable
storage – have the undeniable utility of being small, portable and relatively
inexpensive. They are extremely useful for data transfers between
computers, including operating system patches and antivirus updates.
Secure, encrypted USB flash drives are an essential pillar of a comprehensive
data-loss prevention (DLP) strategy. The most effective are
drives where the security is implemented in the device’s hardware in
order to combat ever-evolving threats.
A patent-protected hardware-centric/software-free encryption
approach to data security is the best defense against data loss, as it
eliminates the most commonly used attack routes. This same software-
free method also provides complete cross-platform compatibility
with any OS or embedded equipment possessing a USB port and
file storage system.
NEW EU REGULATION IMPACTS U.S. COLLEGE CAMPUSES
After a two-year phase-in period, 2018 marks the complete implementation
and strict enforcement of a new European Union regulation that aims to strengthen data protection rights for individuals within the
EU. Named the General Data Protection Regulation (EU GDPR), it
replaces a 1995 directive and aims to future-proof data protection in
the EU and to non-EU organizations that process data of EU residents.
It may not be apparent at first mention as to why or how this affects
American colleges, universities and any institution of higher learning.
But consider European students coming to America to study, research
projects between American institutions and their counterparts in
Europe, and any other exchange of data or information between students,
faculties and schools in the two sectors. From 2018 forward,
they will need to use state-of-the-art security to protect personal data.
In case of a data breach, schools will face fines of up to 4 percent of
their annual global revenue or $21,952 million and must inform their
national supervisory authority.
The average cost of a data breach has increased by 23 percent since
2013. The average cost of a data breach for large organizations in the
EU is 3.7 million Euros and $7 million in the U.S. Education is one of
the three highest cost sectors.
Here are five steps colleges can take to protect themselves and
become GDPR compliant:
- Understand the new regulation and what it means.
- Understand who uses and has access to data.
- Define strategy for data on the move.
- Consider hardware encryption and endpoint-management options.
- Ensure students, faculty and staff are aware of the GDPR and bestpractice
data protection policies.
Students, faculty and administrative staff carrying data out of the
classroom or office increase the risk of data being compromised. This
leaves the institution open to hefty fines, recovery costs and a potential
public relations disaster. Remember, this applies to data you not only
need to protect but want to protect.
Encryption is the best way to be safe. A device such as the Kingston
encrypted USB or its high-end IronKey encrypted USB 3.0 flash drive
minimizes the risks of moving data on USB drives and ensures critical
and sensitive data is protected.
WHY ENCRYPTION IS IMPORTANT
If a USB is lost or stolen and the data on it is encrypted then this is a
security breach, not a data breach, and may not have to be reported.
Kingston encrypted and its IronKey encrypted USB 3.0 flash drives
help meet stringent requirements (including the new EU GDPR) for
data security while allowing students and school departments to do
their assignments or jobs more efficiently. With its completely selfcontained
authentication and encryption processes, all critical security
parameters take place within the drive itself and are never shared with
its USB host. Kingston’s unique approach to ultimate data security is
centered on absolute independence from all software and the operating
In addition to advanced security features such as anti-virus protection
and remote management capabilities, Kingston offers a secure
customization program that provides users, companies or schools the
ability to uniquely identify the encrypted drives with popular options
such as serial numbering, dual passwords and custom logos.
Data stored on a Kingston or an IronKey encrypted USB drive is
always protected from unauthorized access. What happens on an
encrypted drive, stays on an encrypted drive.
IMPACT OF ENCRYPTED DEVICES
In closing, here are two examples of the importance of using encrypted
Protecting royalty. Recently, an unencrypted USB drive with confidential/
restricted files was found at Heathrow Airport in London.
Among its 76 folders and 174 documents was information regarding
details of measures used to protect the Queen, the types of ID needed
to access restricted areas, a timetable of security patrols and maps pinpointing
CCTV cameras. One document highlighted recent terror
attacks and talked about the type of threats the airport could face.
Securing data. Researchers from Google, the University of Illinois
Urbana-Champaign and the University of Michigan spread 297 unencrypted
USB drives unattended around the Urbana-Champaign campus.
Finders opened one or more files on 135 of the 297 flash drives (45
percent) and 290 of the drives (98 percent) were removed from their
drop locations. Drives were plugged into finders’ computers within a
median time of 6.9 hours, the first within six minutes of being found.
The researchers suspect that users initially acted altruistically to try
and find the drives’ owners, but their curiosity soon took over, as they
proceeded to open other files, including one labeled “vacation photos.”
Whatever their reason for opening the files, the study points out that
individuals coming across an unattended USB
drive will open it. If the drive is unencrypted, like
those used in the study, the loser of the drive risks
having all manner of valuable data exposed, stolen
or lost for good.
This article originally appeared in the January 2018 issue of CSLS.