The State of USB Drive Security

A recent study, conducted for Kingston by the security research firm Ponemon Institute, found that over 71% of respondents do not consider the protection of sensitive information collected and stored on USB drives as a high priority. Hit the link for the complete report.

Kingston Digital, Inc., the Flash memory affiliate of Kingston Technology Company, Inc., the independent world leader in memory products, today announced the results of a study conducted by the Ponemon Institute looking at USB prevalence and risk in organizations. The study found that inexpensive consumer USB Flash drives are ubiquitous in all manner of enterprise and government environments ― typically with very little oversight or controls, even in the face of frequent and high profile incidents of sensitive data loss. The Ponemon Institute is an independent group that conducts studies on critical issues affecting the management and security of sensitive information about people and organizations.

Click to expand...

I don't secure mine, but then there is nothing sensitive on mine either. I only use usb drives for general it tools, photos and music and other general crap.

I wish more makers would put a GDMF write-protect switch on more drives. I have a 8GB thumbdrive w/write-protect switch for virus removal and new builds. Nice not having to worry about the infected system infecting my thumbdrive. Just nearly impossible to find them at a reasonable price anymore. As for secure info, don't keep anything like that on a thumbdrive.

'Ponemon Institute' --Anyone else read this as Pokemon at first?

so can anyone recommend usb flash drive security for drives without the physical switch? i see a few when i look around but im hoping some of you on [H] has insight to recommended software

For security, I use bitlocker, truecrypt, or drives with hardware based encryption. For the other question about read only ish drives, one of the best solutions currently there is using SD cards which still have the switch with a usb adapter.

thing about sd card/sd adapters, its up to the user to protect the drive still... the switch simply sends a signal to the computer to tell it to treat the said flash disk as readonly. with software that doesnt play by the rules, you can still write on those SD/microSD cards.

while i can see why most people dont "put sensitive information on portable drives", sometimes the point of a portable drive IS to be able to carry sensitive/up-to-date information with you and not leave copies lying around. i want to protect my information (when working with possibly infective computers) and protect my data from people who might go klepto with my drive or i misplace it. admittingly, i've lost few 8gb microsd drives because they're so damn small. love the portability but it comes at a cost.

Joe S said:

'Ponemon Institute' --Anyone else read this as Pokemon at first?

Click to expand...

yea

I use Sandisk USB drives which come with a U3 encryption option. It's reassuring when carrying around invoices and client details. Works nice and easy - enabled from the U3 menu, then a simple password each time I plug the drive in.

I am fairly sure U3 can be installed on other USB drives- which I guess Kingston are advertising here. If not, TrueCrypt should be as easy to use once setup.

+1 to the return of the hardware switch.

ir0nw0lf said:

I wish more makers would put a GDMF write-protect switch on more drives. I have a 8GB thumbdrive w/write-protect switch for virus removal and new builds. Nice not having to worry about the infected system infecting my thumbdrive. Just nearly impossible to find them at a reasonable price anymore. As for secure info, don't keep anything like that on a thumbdrive.

Click to expand...

I was exactly where you are, and was happy to find flash drives that have them on newegg. They're made by Kanguru: http://www.newegg.com/Product/Produ...kanguru&name=USB Flash Drives&Order=BESTMATCH

I have the 8GB FlashBlu that sells for $27, though they sell a bunch of other sizes. I dunno what the color differences mean though (they used to have yellow too, if I remember correctly). It's a bit pricey, and only USB 2.0 but I didn't think it was too much to ask for.

I really like mine though. Seems very solidly built, for what it's worth, and performs pretty well.

ir0nw0lf said:

I wish more makers would put a GDMF write-protect switch on more drives. I have a 8GB thumbdrive w/write-protect switch for virus removal and new builds. Nice not having to worry about the infected system infecting my thumbdrive. Just nearly impossible to find them at a reasonable price anymore. As for secure info, don't keep anything like that on a thumbdrive.

Click to expand...

It's been ages since I've found thumbdrives at the store with a write protect switch and now all of the ones I've got are too small for me to be able to fit all of my utilities onto them. Fortunately, a fellow below linked the Kanguru and I'm sure as hell gonna be grabbing one of those now.

Unfortunately... I learned the hard way about this method:

darkpaw said:

For security, I use bitlocker, truecrypt, or drives with hardware based encryption. For the other question about read only ish drives, one of the best solutions currently there is using SD cards which still have the switch with a usb adapter.

Click to expand...

SD Cards have the write protect switch which is only a dumb moving plastic slider (just like floppy disks) that is not connected to anything. This means the card can still be written to if the reader doesn't respect or have any sensing methods for what position the write protect tab is in.

I used to have my malware removal kit on an SD card with the write protect tab switched on in an SD to USB card reader that turned it into an oversized thumbdrive.

On a particularly bad case, all of my shit on that card was lost. Tab made no difference.

Bonus: There's really no way in knowing whether or not the write protect tab will help you until after you buy the damned readers. I try as many as I can and I've still yet to find one that actually prevented me from writing to my test card (which has no slider tab, so it should be permanently locked into read only mode)...

SD Card write protect tab? Don't rely on it.

The write protection has to be physical AND affects how the hardware separate from everything else will perform, otherwise it is useless. So it's back to using USB Thumbdrives with controller level aware write protect switches built in.