A Hybrid Work Environment
Bring your own portable storage device to work? Not today
- By Richard Kanadjian
- Oct 01, 2021
As companies begin to repopulate their offices with
workers who have spent the last 12-15 months toiling
from their overcrowded kitchen tables and other
non-traditional work settings, now faced with a
potentially catastrophic problem.
Defined as any digital device, bring your own device (BYOD),
owned by the employee and not be approved by the employer for
use on the job. Such devices include cameras, wireless devices,
tablets, laptops and USB flash drives.
While these devices are often essential to productivity and seem
completely innocuous, they actually pose many serious cybersecurity
risks and can single-handedly negate millions of dollars a company
has spent on infrastructure security, not to mention myriad
problems associated with the loss of vital company data.
Many post-pandemic returning workers are going back to a hybrid
schedule. The plan might be a few days a week in the office,
a few days back at the kitchen table. There is a very real risk that
private company data is accompanying them to and fro, and stored
on some manner of the memory device will become compromised,
lost or stolen, resulting in a cybersecurity mess for the company.
A USB drive is one of the most popular BYODs. Known as
removable media, flash drives, thumb drives, among other terms,
and capacities up to 2TB. They have tremendous portability, and
exceptionally easy ability to be connected to various networks,
USB drives have proven their value as file-sharing and mobility
tools and backup drives.
Unfortunately, they are also very susceptible to being lost,
breached, and misappropriated. That leads to the possibility of
critical, classified, sensitive data landing in the wrong hands.
Making matters worse, many times, the USB drive used by the
employee is either bought by the employee or received as some type
of perk or gift, virtually assuring they are not up to a company’s
standards, making them even more likely to pose a security risk.
While the BYOD concept offers varied pluses, there are also
many special problems associated with it. Since USB drives are a
favorite means for these hybrid workers to store and/or move files
from work to home and vice versa, let’s take a look at how the
risk associated with their use can be mitigated.
There are four ways a hybrid worker using a USB drive poses
a security threat.
- The employee accidentally loses a drive.
- An employee’s USB drive is stolen.
- The trusted hybrid employee stores confidential company data
on a USB drive and makes it available outside the company.
- A hybrid employee finds an infected USB drive and unwittingly
plugs it in, whether out of curiosity or in a misguided attempt
to find the owner.
So what is the magic word to ensure data stored on a hybrid
worker’s – or any worker’s – USB drive stays secured? Encryption.
Encrypted USB drives use the strictest security regulations to
protect sensitive data and protocols, and have helped businesses,
large and small transport data when it needs to move beyond the
company’s firewall securely and confidently.
Encrypted flash drives are an essential pillar of a company’s
comprehensive data loss prevention (DLP) strategy. It is imperative
that companies insist their employees use only encrypted
USB drives, which combine the productivity advantages of allowing
USB access while protecting the information on the drive.
Encrypted USB drives are powerful tools in eliminating security
gaps and provide another layer of security in and outside the
firewall by offering:
- FIPS Certification
- Latest encryption technology
- Anti-malware/virus protection
- Complex password protection
- Ability to be managed remotely
- Tamper-evident technology
- Wide-capacity range
Of the encrypted USB flash drives, the most effective are those
where implemented security is in the device’s hardware.
A USB drive with hardware-based encryption is an excellent,
non-complicated, simple solution to protecting data from breaches
while also meeting evolving governmental regulations. Priced
between $40 and $600, depending on capacity, such devices meet
tough security standards and offer the ultimate security in data
protection to confidently manage threats and reduce risks.
Hardware-based encrypted USB drives are self-contained and
do not require a software element on the host computer. No software
vulnerability eliminates the possibility of brute-force, sniffing
and memory hash attacks.
They also have unaltered digitally signed firmware, as well as a
physical layer of protection. Some of these drives come in epoxydipped/
filled cases that prevent access to the physical memory. In
contrast, a USB drive with software encryption uses software that
runs on the host computer and is vulnerable to attacks.
The top-of-the-line hardware-based encrypted USB drives
use AES 256-bit encryption in XTS mode. This ensures anyone
who finds such a drive cannot access the information, as the drive
wipes itself clean after 10 attempts at guessing the password.
A patent-protected, hardware-centric/software-free encryption
approach to data security is the best defense against data
loss, as it eliminates the most commonly used attack routes. Furthermore,
this same software-free method also provides complete
cross-platform compatibility with any OS or embedded equipment
possessing a USB port and file storage system.
Finally, it is also vital for companies to have policies and
practices in place that deal with protecting data beyond encryption.
Workers must know and follow these policies and practices
to avoid loss of data, compromised data, or malicious virus and
malware attacks.
Training and educated on the company’s policies and practices
regarding the use of USB drives is key to returning hybrid workers.
Lack of training means you do not have a tightly sealed data
loss-prevention strategy, and you are more prone breach, hacking
and all of those other wonderful malicious things that can happen.
Several years ago, a USB security study found that 72 percent
of employees use free drives from conferences and tradeshows
or business meetings, even in organizations that offer ‘approved’
USB solutions.1 How safe are those drives? Establishing a training
program that educates employees on acceptable and unacceptable
use of USB flash drives and BYODs is crucial for returning
hybrid workers.
Don not ignore the serious risks of unencrypted BYOD USB
drives. Take a proactive approach by implementing a best-practices
standard and policy, and providing employees with company-
approved encrypted USB flash drives for use in the workplace.
Paying a little more up-front for encrypted drives will cost exponentially
less than risking a potential data breach and potential
fines for mishandling private customer data.
This article originally appeared in the September / October 2021 issue of Security Today.