Usb Sticks With Employees - A Threat To Information Security

By Author: Contact Press
Total Articles: 7
Comment this article

The technological revolution has also posed new challenges in ensuring information security. The same products, which have been developed to increase convenience and increase productivity, can be misused by individuals. Employee initiated security breach is a major challenge faced by organizations. It is often difficult to detect employee initiated theft or security breach as they may be carried out in the course of their daily routine. Conducting vulnerability assessment tests and ethical hacking practices can help organizations in identifying vulnerabilities and suspicious activities.

USB sticks designed primarily to store useful information can be misused by employees to store privileged business and customer information. Storage of privileged information may be done with a malicious intention by a disgruntled employee or due to lack of awareness. A recent survey report by Credent Technologies indicates that majority of the employees in its survey carry USB sticks to Office.

Users generally ...
... use unencrypted USB devices, which if accessed by an outsider can reveal confidential business information. Again, these devices are left unsecured in table racks or left attached to USB ports on computers and laptops.

Recently, Avast Virus Labs revealed that one in eight malware attacks are launched via a USB device. The auto run feature offered by Microsoft Windows, automatically gets executed when a USB device is inserted into USB port. As such, files containing virus may also get executed, thereby compromising information security. Disabling auto run feature can prevent automatic execution of malicious files.

Many Multi-national organizations allow flexible working hours and facility to work from home to coordinate with offices in different time zones. As such, some employees may be use USB devices to store data and reports. However, loss of USB devices or their use on unsecured networks may result in compromise of crucial business information.
Information Security professionals must create awareness among employees on the risks of inappropriate use of USB devices. Organizations may also place restrictions on the use of USB devices. Any inappropriate practice by employees can also be detected by installing monitoring devices.