Despite the continuous efforts being put forth to advance cyber security, threats to information security systems are still out there. There are also plenty of potential attackers looking to exploit them. Yet much of what is being done to bolster network security is focused on the exact point of attack. Attackers, however, are getting ever more savvy in their efforts to work around security measures. For instance, many have begun abandoning direct attacks on a network, and instead focusing on gaining access through that network’s users.
One such way that attackers are using network user ignorance to launch their attacks is through USB drives. Whether your organization refers to them as a data stick, a flash or thumb drive, these tiny little data storage devices are no doubt currently being used within your ranks. Yet their use is not without reason; these drives are a convenient way to backup data off of a network drive, and to allow you access to vital business data when you’re unable to connect to your network. Some organizations have found them to also be very effective presentation tools, allowing conference or meeting attendees to study up on topics before, during, and after presentations.
The security risks associated with USB drives cannot be overlooked. The design of the drives themselves makes them vulnerable. Those devices that have reprogrammable firmware can be manipulated and even reprogrammed to perform a number of nefarious functions, such as:
- Steal saved content
- Upload with malware to spread to the computer
- Redirect traffic by changing the domain name system setting
Changes at the firmware level currently can’t be detected by malware or antivirus tests. While using an infected USB drive on a home computer can cripple that particular machine, that damage is localized. However, a virus spread to a business network through an external drive can self-replicate and spread throughout the system.
Irresponsible USB Drive Use
The aforementioned risks are inherent with the devices themselves. The irresponsible use of these drives also poses a very serious risk. Most users will plug their drives into any station at any location without giving any thought to the security of that device. Plus, every year potentially hundreds of thousands of these devices are lost by misplacing them in public places, or forgetting to remove them from pants pockets.
Far too many people think of USB drives as being secure, and thus have no problem storing valuable personal and business information on them. Yet most don’t come with encryption programs, meaning that anyone who finds a lost drive can easily access its content without it having to be decoded.
So, what can be done to eliminate the risks posed by the errant use of USB drives? Developers are beginning to incorporate advanced security measures into such hardware, yet such features will often raise the price of the equipment. For many, that removes one of the main benefits that these drives offer: an inexpensive way to store and share data with large groups. Ultimately, the best way to mitigate the security risks associated with this hardware is to be wise in its use.
Fortunately, thanks to our many years of experience in auditing organizational security controls, I.S. Partners, LLC has come to learn which policies and practices to enact so that network users can avoid the potential for security issues. We can help educate you and your workforce on safe and responsible USB drive use, and allow you the opportunity to avoid this risk before it even has the chance to become an issue.