USB flash drives spreading like mushrooms

The long view of security strategies for your network.

In recent articles, I’ve looked at how USB flash drives with biometric authentication and access controls can be helpful in a range of applications. But what if you are not keen on having anyone use these portable devices without authorization? How can you control USB ports on today’s computers?

The problem is exacerbated by the increasing variety of form factors for USB flash drives. Not only are they available in inch-long versions that are easy to conceal in any pocket, purse or wallet, but also there are forms that are not even recognizable as storage devices unless one knows what to look for.

Consider for example the “USB MP3 Player Watch” with 256M bytes of storage (see http://tinyurl.com/5xtxb for details) that one of my readers pointed out to me recently (thanks, James!). This device looks like an analog watch but comes with cables for USB I/O (and earphones too). Any bets your security guards are going to be able to spot this as a mass-storage device equivalent to a stack 177 high of 3.5-inch floppy diskettes?

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

In recent articles, I’ve looked at how USB flash drives with biometric authentication and access controls can be helpful in a range of applications. But what if you are not keen on having anyone use these portable devices without authorization? How can you control USB ports on today’s computers?

The problem is exacerbated by the increasing variety of form factors for USB flash drives. Not only are they available in inch-long versions that are easy to conceal in any pocket, purse or wallet, but also there are forms that are not even recognizable as storage devices unless one knows what to look for.

Consider for example the “USB MP3 Player Watch” with 256M bytes of storage (see http://tinyurl.com/5xtxb for details) that one of my readers pointed out to me recently (thanks, James!). This device looks like an analog watch but comes with cables for USB I/O (and earphones too). Any bets your security guards are going to be able to spot this as a mass-storage device equivalent to a stack 177 high of 3.5-inch floppy diskettes?

Then there is the newest gift for the geeks in your life, the SwissMemory USB Memory & Knife:
http://tinyurl.com/4c5g8

You can buy this gadget, including a blade, scissors, file with screwdriver tip, pen and USB memory, in 64M, 128M, 256M, or 512M-byte capacities. And here I thought my Swiss Army knife with a set of screwdriver heads was the neatest geek tool I’d ever seen.

The USB Pen (not a “PenDrive”) is a pen that uses standard ink refills but also includes 128M bytes of USB flash memory: http://tinyurl.com/6z6js

I suppose next we’ll be hearing about USB earrings, USB nose-studs, USB tie clips - no, no, please don’t send me URLs for all of these. I’m just making a point: they’re going to be ubiquitous, and they’re going to go unnoticed.

In my next article, I’ll look at some ways of controlling these fungating storage devices.

Read more about security in Network World's Security section.

M. E. Kabay, PhD, CISSP-ISSMP, specializes in security and operations management consulting services and teaching. He is Chief Technical Officer of Adaptive Cyber Security Instruments, Inc. and Associate Professor of Information Assurance in the School of Business and Management at Norwich University. Visit his Web site for white papers and course materials.