USB drives pose insider threat

Many worms have done an end run around a corporate network's perimeter security by hitching a ride on a laptop brought home by a worker. USB smart drives present a similar problem for companies and should be managed in a similar way, said Kate Purmal, CEO of U3, a maker of the U3 smart drive platform.

"The right solution for this is the management system used by the company to control the endpoints should also manage the USB ports," Purmal said. "The company should have security at each endpoint that prevents a vanilla device from off the street being plugged into the computer."

Purmal stressed that corporate security managers should not focus on a single scenario, but also consider other issues, such as protecting information on USB drives lost by employees and preventing viruses from being transported from a worker's home computer into the office on USB drives. Companies considering allowing USB drives should create policies that mandate encryption, allow centralised management of the USB ports on every computer, protect desktops with anti-virus and anti-spyware tools, and potentially adopt technology to erase data on USB drives that have been lost or stolen.

Specific industries, such as finance and healthcare, may also need to account for what data was copied to a particular USB drive, AdvancedForce's Chernavsky said.

"If you give someone permission to use a thumb drive, you need to be able to track what data they move to it," he said.

Moreover, the policies and audit functionality need to stand up to even a savvy user sitting at the keyboard, said Dor Skuler, vice president of business development for device-security software maker Safend.

"You want to make sure that the policies cannot be uninstalled," Skuler said.

However, as the attack on the credit union shows, a malicious insider is not necessary if a Trojan horse can be delivered inside the company by an unwitting employee.

Even the most trustworthy employees could fall prey to tactics such as those employed by Secure Network Technologies. A USB drive has allure for some people, not only because the data stored on the drive might pique a person's curiosity, but also because the memory can be reused.

Those twin lures of curiosity and utility, in the end, make USB drives a powerful Trojan horse, Secure Network Technologies' Stasiukonis said.

"Social engineering is always the easiest way to compromise a network, because people are typically very friendly and trusting," he said.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus