* Security consultant gives his recommendation for securing USB drives
Several weeks ago I wrote about an endpoint security solution in this newsletter. Sean Steele of infoLock Technologies sent me an e-mail to tell me about his company’s evaluation of such products, and I want to share his perspectives with you.
Sean and his business partner started infoLock a few years ago to provide information security consulting services and solutions. Since then, the company has found a niche in managing insider threats. As Sean pointed out to me, many companies secure themselves from external threats, but leave themselves exposed to employees physically removing sensitive data from the network on devices whose usage can’t be audited or tracked – effectively giving employees “keys to the castle.”
His customers were asking him to recommend a solution to control data on portable devices like USB thumb drives, iPods and digital cameras, as well as managing Bluetooth, Wi-Fi, infrared access, CD/DVD drives, PCMCIA cards, and flash memory sticks (like SD and MMC). InfoLock put four or five major players in a test lab “bake-off,” eventually choosing Disknet Pro from Reflex Magnetics as their winner. Here’s why.
Sean says his clients don’t want to completely prevent their employees from using portable storage devices like USB thumb drives. After all, there are legitimate reasons for transporting large amounts of data that way. However, infoLock’s clients do want to make sure that malware isn’t sneaking in through the security perimeter on these devices, and that outbound data is always strongly encrypted. Through their product testing, the guys from infoLock concluded that Disknet Pro offers the features that clients are asking for.
Disknet Pro is a client-server software solution designed to help organizations manage and secure removable media storage devices and endpoint workstations. It uses an agent on the desktop that is controlled by a central server on the network. The administrator sets how – or even if – devices, ports, and peripherals can be used. Administrators can set the following modes for workstations under management:
* No access
* Read only access
* Full access (with encryption and/or offline access)
An administrator can specify which devices are allowed in the network. For instance, infoLock is helping a large Blue Cross Blue Shield Association (BCBSA) member organization deploy to more than 12,000 workstations across multiple states and network locations. The BCBSA organization bought company-branded USB thumb drives that had been digitally tagged and authorized for use by Disknet Pro. As a result, employees can only use an approved thumb drive in their computers’ USB ports.
Such digital tagging can identify specific devices by the serial number, so that an employee can only use his device in his own PC. Devices can be white-listed or black-listed as needed. So, for instance, you can prevent employees from plugging their iPods into company-owned computers.
What if you need to plug a portable device into an off-network computer to, say, deliver a sensitive presentation to a customer? Disknet Pro can encrypt the contents of the device using the Advanced Encryption Standard (AES). If the device is lost or stolen, the data is inaccessible to anyone who picks it up. Meanwhile, the authorized user can take that device and plug it into another PC. The software on the thumb drive prompts the user for a password before unlocking the encrypted file for temporary use – no software gets installed on the destination PC.
Sean says that when you plug in an approved device, the PC’s existing antivirus software is activated to scan for viruses and other dangerous files. In addition, an administrator can force content checks for “dangerous” files, such as executables or those infected with malware.
Reflex Magnetics has built enough security features into Disknet Pro that the solution is being used by banks and financial institutions worldwide; military organizations in the U.S. and Europe; NATO; the United Nations; legal firms; and healthcare providers. Disknet Pro has been around since 1991, when it was first developed to protect against boot sector viruses on floppy drives.
The client software is distributed silently using Active Directory Group Policy, or standard software distribution solutions like Tivoli and Altiris. There is also a Deployment Server available from Reflex Magnetics. Since the software is managed centrally, audits and real-time alerts can notify administrators of suspicious activities on endpoints. (Reflex Magnetics tells one story about an IT professional that would bring video games to work on his thumb drive. He wasted hours each day playing games, until Disknet Pro revealed how he was misusing company resources.)
So if you’re looking for a way to control those little devices that are a big weak spot in enterprise security, talk to Sean about his research and experience with endpoint management solutions.
