Using and Promoting Encrypted USB Flash Drives in Your Organization

Tips to help your organization keep confidential information confidential and comply with regulations such as the EU’s GDPR and New York’s NYDFS.

Build an Encrypted USB Plan: Protect & Comply

• The best time to develop an encrypted USB plan is before you need to prove you had one– incorporate encrypted USB Flash drives and policies into your organization’s overall security strategy.
• Institute an encrypted USB or external drive best practices with the issue of an employee badge and/or company laptop as standard practice of policy and orientation.
• Have a contingency plan in place for recovering lost drives.

If you don’t have a plan in place for encrypted USBs or external drives and guidelines for their usage, you have nothing to build on and your organization is at risk at every level– including failure to comply with regulations. Data loss and data breaches have only grown more expensive for companies as threat actors’ efforts have grown more sophisticated. A cybersecurity study in 2021 found that the average cost of a data breach globally was US$4.24 million. That was a 10% increase over the cost in 2020. Avoid facing these costs by devising and sticking to a practical plan for data security, one which avoids BadUSB attacks by using only approved, encrypted USBs or external drives.

Train and Educate

Establish a training program that educates employees on acceptable and unacceptable use of USB Flash and external drives and Bring Your Own Device (BYOD) policies.

• Walk users through actual breach incidents and other negative consequences that occur when using non-encrypted USBs and external drives.
• Get HR and senior management involved to support your data security initiatives. All new and current employees should be trained as part of the company orientation and ongoing training for policy standards.
• Create a trade-in program. Engage employees by having them trade their personal USBs or those that they use for business or as storage devices that were acquired at trade shows etc. for company-authorized USB and external drives.

If you don’t train and educate end users on the risks, you don’t have a tightly sealed data leak prevention strategy, and you’ll leave yourself prone to breaches. A Ponemon USB security study found that 72% of employees use free Flash drives from conferences, trade shows, business meetings, etc.– even in organizations offering ‘approved’ USB options.

Establish and Enforce Policies

Institute policies for the proper use of electronic portable storage media, including USB Flash drives. Start by:

• Identifying those individuals and groups needing access to and/or download sensitive and confidential data on encrypted USB and external drives and set a policy that allows them access.
• Documenting policies for IT teams and end users.
• Mandating that all employees attend training and sign an agreement post-training so they understand the acceptable use policies and the implications of not following guidelines.

If you don’t have the right policies in place for all to follow, USB and external drives can potentially be the downfall of your data security strategy. Setting a policy is the first step, and a highly important one. The Ponemon study also found that nearly 50% of organizations confirmed that they had lost devices carrying sensitive or confidential information in the 24 months prior to being surveyed.