Encryption and Compliance

Top 5 regulatory trends in relating to USB drives

Throughout time, securing the data in our communications with others has always been a major concern. Perhaps the prehistoric men or woman, were the only civilization in history that didn’t have to worry about someone getting their hands on someone else’s messages.

Short of an adversary breaking into his abode and walking off with a wall or blatantly standing in the middle of the room, chiseling out a rough reproduction of the hieroglyphs scrawled on the wall, Mr. Caveman’s – or Mrs. Caveman’s – written thoughts were pretty safe from enemy eyes.

Fast forward – okay, warp-speed forward – to today. We live in an era in which protecting our data has never been more important. From bad actors to forgetful or disgruntled employees, enemy nations or just plain opportunists, data today is potentially under attack, whether in an office, at home, or at an airport, or virtually thousands of other locations.

Five major trends are occurring in the realm of data security today:

  1. Regulatory and compliance requirements will increase
  2. Consequences from unencrypted drive loss will continue to rise
  3. Hardware encryption is the best way to meet compliance requirements
  4. Software encryption does not meet compliance requirements
  5. Bad USBs will continue to be a problem

Regulatory and compliance requirements will increase. Shortly after the dawning of the digital age, data security became the purview of IT departments. However, due to endless consumer data breaches, governments worldwide stepped in and imposed an ever-growing array of requirements on businesses to encrypt and protect personally identifiable data.

Through things such as HIPAA in health care, GDPR in Europe, and CCPA in California, encryption of protected data classes was mandated. 

IT departments have struggled to keep up with security and its rising costs. During the ongoing COVID pandemic, their budgets struggle to keep up with data encryption but also on additional hardware and firewall investments.

Consequences from unencrypted-drive loss will continue to rise. The number of employees and consumers taking their data with them has grown exponentially over the past decade or so. Such individuals have several options of how to move their data, including:

Cloud services. They are flexible and are accessible any device hooked up to the Internet. However, using such services removes control of the data from the user/company.
Unencrypted USB drives. The risk of data exposure through loss of the drive can be significant. Stories abound of lost USB drives found anywhere and everywhere.
Hardware-encrypted USB drives. These drives are more expensive than standard USB drives, but have custom architectures, which incorporate an onboard encryption controller and access control. The encrypted data uses the strongest AES-256-bit encryption in XTS mode and other safeguards to mitigate physical and firmware-based attacks.
Standard USB drives with software encryption. The easiest way to keep data in a user’s possession and control is to put it on a portable USB drive. However, while software encryption such as BitLocker is “free,” there is a significant risk in using it. While it seems less expensive than other means, it can be very risky, and in the end is much more expensive.

Hardware Encryption is the Best Way to Meet Compliance Requirements
That is a bold statement. So, why do I think that, let alone say it?
Four reasons:

  1. Hardware encrypted USB drives have encryption that is always active. There is no way for users to turn it off, reset password criteria (minimum length, complexity, etc.) and disable the automatic password retries. (Hardware encryption limits password retries. In some case, up to 10 times, then locks away the data forcing a reformat.
  2. Hardware-encrypted drives use premium encryption controllers and incorporates many security features. When the firmware is loaded onto hardware-encrypted drives at the factory, they are loaded and digitally signed. When these encrypted USBs are active, the encryption controller checks the integrity of the firmware through the digital signature and only loads it if it passes.
  3. Hardware encrypted USB drives can have custom Product IDs (PIDs) set up for a specific company. These premium drives can have a digital identifier programmed into them. If a drive is active into the company’s inner or outer firewall, the drive identifies it as company issued.
  4. Hardware-encrypted drives save money quickly. The reduction and elimination of risks make the payback cycle very short.

Software Encryption Does Not Meet Compliance Requirements. Software encryption is removable encryption. Users can easily remove the software encryption feature from their USB drives. Why would they? Because they can, and because they want to access the files without using a password or simply forgot the password and need to use the USB drive.

For compliance purposes, the ease of removing data encryption means that the drive is now unencrypted. Therefore, data copied on the device once the encryption is removed is likely unsecured and potentially out of compliance, which can risk a violation of regulations from HIPAA, GDPR, CCPA and the like. That can lead to thousands of dollars in expenses, in addition to potential fines, customer and other lawsuits, not to mention the embarrassment from data exposure.

BadUSB Will Continue to Be a Problem
BadUSB is a class of malware that bad actors have used to breach a company’s firewall and introduce malware into a company’s cyber-defensives through USB storage devices. Unfortunately, experts say it is here to stay. 

When a USB drive is attached to a computer, the chipset controller of the computer starts a handshake with the USB drive controller via firmware. Every USB drive has firmware that runs when the drive is activated in a USB socket.

Some malcontents of the world have learned that they can introduce malware through this handshake by replacing the firmware that runs on the USB drive controller with another, more malicious firmware that injects malware into the target computer system as it communicates with the USB drive.

Simply put, we need to do everything possible to ensure that critical data – define that, as you will – is securely stored/transported. Making all these trends worth taking into consideration when thinking about security best practices.

This article originally appeared in the November / December 2021 issue of Security Today.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3