USB flash drive security concerns include not only obvious data losses and data leaks but also other more complicated issues. These include malware (BadUSB) and generic USB concerns like USB killer. USB flash drive products have been on the market since 2000, and their use is increasing exponentially. In addition to usage as data mass memory they are often used to transfer data between computers. Companies in particular are at risk when sensitive data are stored on unsecured USB flash drives by employees who use the devices to transport data outside the office. The consequences of losing drives loaded with such information can be significant, including the loss of customer data, financial information, business plans and other confidential information, with the associated risk of reputation damage.
Major dangers of USB drives USB flash drives pose two major challenges to information system security: data leakage owing to their small size and ubiquity and system compromise through infections from computer viruses, malware and spyware.
Data leakage The large storage capacity of USB flash drives relative to their small size and low cost means that using them for data storage without adequate operational and logical controls may pose a serious threat to information availability, confidentiality, and integrity. The following factors should be taken into consideration for securing important assets:
Storage: USB flash drives are hard to track physically, being stored in bags, backpacks, laptop cases, jackets, trouser pockets or left at unattended workstations. Usage: Tracking corporate data stored on personal flash drives is a significant challenge; the drives are small, common, and constantly moving. While many enterprises have strict management policies toward USB drives and some companies ban them outright to minimize risk, others seem unaware of the risks these devices pose to system security. The average cost of a data breach from any source (not necessarily a flash drive) ranges from less than $100,000 to about $2.5 million. A SanDisk survey characterized the data corporate end users most frequently copy:
Customer data (25%) Financial information (17%) Business plans (15%) Employee data (13%) Marketing plans (13%) Intellectual property (6%) Source code (6%) Examples of security breaches resulting from USB drives include:
In the UK: HM Revenue & Customs lost personal details of 6,500 private pension holders In the United States: a USB drive was stolen with names, grades, and social security numbers of 6,500 former students USB flash drives with US Army classified military information were up for sale at a bazaar outside Bagram, Afghanistan.
Malware infections
In the early days of computer viruses, malware, and spyware, the primary means of transmission and infection was the floppy disk. Today, USB flash drives perform the same data and software storage and transfer role as the floppy disk, often used to transfer files between computers which may be on different networks, in different offices, or owned by different people. This has made USB flash drives a leading form of information system infection. When a piece of malware gets onto a USB flash drive, it may infect the devices into which that drive is subsequently plugged. The prevalence of malware infection by means of USB flash drive was documented in a 2011 Microsoft study analyzing data from more than 600 million systems worldwide in the first half of 2011. The study found that 26 percent of all malware infections of Windows system were due to USB flash drives exploiting the AutoRun feature in Microsoft Windows. That finding was in line with other statistics, such as the monthly reporting of most commonly detected malware by antivirus company ESET, which lists abuse of autorun.inf as first among the top ten threats in 2011. The Windows autorun.inf file contains information on programs meant to run automatically when removable media (often USB flash drives and similar devices) are accessed by a Windows PC user. The default Autorun setting in Windows versions prior to Windows 7 will automatically run a program listed in the autorun.inf file when you access many kinds of removable media. Many types of malware copy themselves to removable storage devices: while this is not always the program's primary distribution mechanism, malware authors often build in additional infection techniques. Examples of malware spread by USB flash drives include:
The Duqu collection of computer malware. The Flame modular computer malware. The Stuxnet malicious computer worm.
Solutions Since the security of the physical drive cannot be guaranteed without compromising the benefits of portability, security measures are primarily devoted to making the data on a compromised drive inaccessible to unauthorized users and unauthorized processes, such as may be executed by malware. One common approach is to encrypt the data for storage and routinely scan USB flash drives for computer viruses, malware and spyware with an antivirus program, although other methods are possible.
Software encryption Software solutions such as BitLocker, DiskCryptor and the popular VeraCrypt allow the contents of a USB drive to be encrypted automatically and transparently. Also, Windows 7 Enterprise, Windows 7 Ultimate and Windows Server 2008 R2 provide USB drive encryption using BitLocker to Go. The Apple Computer Mac OS X operating system has provided software for disc data encryption since Mac OS X Panther was issued in 2003 (see also: Disk Utility). Additional software can be installed on an external USB drive to prevent access to files in case the drive becomes lost or stolen. Installing software on company computers may help track and minimize risk by recording the interactions between any USB drive and the computer and storing them in a centralized database.
… excerpt ends here. Continue reading the full article.
