Using and promoting encrypted USB flash drives in your organisation

Tips to help your organisation keep confidential information confidential and comply with regulations such as the EU’s GDPR and New York’s NYDFS.

Build an encrypted USB plan: protect and comply

• The best time to develop an encrypted USB plan is before you need to prove you had one – incorporate encrypted USB Flash drives and policies into your organisation’s overall security strategy.
• Institute best practices for encrypted USBs or external drives as standard when you issue an employee badge and/or company laptop.
• Have a contingency plan in place for recovering lost drives.

If you don’t have a plan in place for encrypted USBs or external drives and guidelines for their usage, you have nothing to build on and your organisation is at risk at every level – including a failure to comply with regulations. Data loss and data breaches have only grown more expensive for companies as threat actors’ efforts have grown more sophisticated. A cybersecurity study in 2021 found that the average cost of a data breach globally was US$4.24 million. That was a 10% increase over the cost in 2020. Avoid facing these costs by devising and sticking to a practical plan for data security, one which avoids [BadUSB] attacks by using only approved, encrypted USBs or external drives.

Train and educate

Establish a training programme that educates employees on acceptable and unacceptable use of USB flash and external drives and Bring Your Own Device (BYOD) policies.

• Walk users through actual breach incidents and other negative consequences that occur when using non-encrypted USBs and external drives.
• Get HR and senior management involved to support your data security initiatives. All new and current employees should be trained as part of the company orientation and receive ongoing training on policy standards.
• Create a trade-in programme. Engage employees by providing company-authorised USBs and external drives in exchange for personal USBs or USBs acquired at trade shows, etc that they use for business or as storage devices.

If you don’t train and educate end users on the risks, you don’t have a tightly sealed data leak prevention strategy, and you’ll leave yourself prone to breaches. A Ponemon USB security study found that 72% of employees use free flash drives from conferences, trade shows, business meetings, etc. – even in organisations offering ‘approved’ USB options.

Establish and enforce policies

Institute policies for the proper use of electronic portable storage media, including USB Flash drives. Start by:

• Identifying those individuals and groups that need access to and/or download sensitive and confidential data on encrypted USB and external drives and set a policy that allows them access.
• Documenting policies for IT teams and end users.
• Mandating that all employees attend training and sign an agreement post-training to confirm that they understand the acceptable use policies and the implications of not following guidelines.

If you don’t have the right policies in place for all to follow, USB and external drives can potentially be the downfall of your data security strategy. Setting a policy is the first step, and a highly important one. The Ponemon study also found that nearly 50% of organisations confirmed that they had lost devices carrying sensitive or confidential information in the 24 months prior to being surveyed.