USB Devices!
I've been stating and teaching this for years. Why do organizations continue to allow USB / data access on their corporate computers and systems?
Loss of IP/data and malware breaches will surely result and the stats don't lie.
In the past few years, many organizations are attempting to track down the loss of sensitive/confidential information due to the usage of USB drives and other mass storage media. Cyber-security breaches and data theft are making more and more IT leaders paranoid about security than ever before.
Why are USB devices dangerous?
- USB devices can hold a lot of information. For example, a 128 GB USB flash drive can store 60,000 photos, 20,000 songs, 100+ videos, and more. Just imagine how many protected corporate files could fit on one drive. Also, the storage capacity of USB devices is only going to increase.
- USB devices are super portable. Some USB storage devices are the size of a small coin. This makes them very difficult to visually detect when plugged into an open port.
- USB devices are cheap and easy to find. If you’re in the market for a USB storage device, there are some online for under $1.00 USD. Or if you don’t want to purchase one, just go to an expo. Plenty of companies are handing out branded USB flash drives these days. In short, nearly everyone has a USB storage device of some kind.
- Data doesn't always delete from a USB drive. In one study, it was determined that 85% of secondhand USB devices had recoverable information including personal identity information and confidential corporate information easily.
- USB devices can directly carry malware. Inserting a device and executing or copying files could expose your network to unexpected malware.
What can an internal data breach result in? The loss or theft of sensitive information is not limited to the realm of emails and contacts, but it can also extend to more sensitive information such as:
- Loss of copy-righted information
- Intellectual property data
- Deviation from compliance regulations
- Access codes and secure login credentials
So, in short - if you're responsible for data integrity, security or the technology of your organization, you may want to consider blocking USB ports using tools like LanDesk, etc.