USB Flash Drive - Security Threats

Security Threats

Flash drives may present a significant security challenge for some organizations. Their small size and ease of use allows unsupervised visitors or employees to store and smuggle out confidential data with little chance of detection. Both corporate and public computers are vulnerable to attackers connecting a flash drive to a free USB port and using malicious software such as keyboard loggers or packet sniffers.

For computers set up to be bootable from a USB drive, it is possible to use a flash drive containing a bootable portable operating system to access the files of the computer, even if the computer is password protected. The password can then be changed, or it may be possible to crack the password with a password cracking program and gain full control over the computer. Encrypting files provides considerable protection against this type of attack.

USB flash drives may also be used deliberately or unwittingly to transfer malware and autorun worms onto a network.

Some organizations forbid the use of flash drives, and some computers are configured to disable the mounting of USB mass storage devices by users other than administrators; others use third-party software to control USB usage. The use of software allows the administrator to not only provide a USB lock but also control the use of CD-RW, SD cards and other memory devices. This enables companies with policies forbidding the use of USB flash drives in the workplace to enforce these policies. In a lower-tech security solution, some organizations disconnect USB ports inside the computer or fill the USB sockets with epoxy.

Some of the security measures taken to prevent confidential data from being taken have presented some side effects such as curtailing user privileges of recharging mobile devices off the USB ports on the systems.