UK: IT Security Update - Threat Of The USB Memory Devices

Many businesses are failing to address or even consider the implications of the growing availability and use of removable memory devices within their organisation.  This is despite increased awareness of the damage that can be caused by malware on the device or the removal or copying of sensitive material.

Many popular devices available today contain high capacities of memory (able to store many thousands of documents) and can easily connected to a computer via the USB ports.  Devices such as Memory Sticks plug directly into a computer’s USB port and many computers helpfully hold the driver information necessary to quickly recognise the device and make the transfer of data readily available.  Other examples of devices designed to hold great quantities of data and which are recognised by computers are MP3 players such as iPods, digital cameras, mobile telephones and CDs.  These devices are commonly brought into almost businesses premises on a daily basis whether in the possession of employees, customers and suppliers. 

Notwithstanding this there are very few businesses which incorporate safeguards to check what devices are coming in and going out and, more importantly what is stored on them and if they are connected to the business’s network.  This lax security and the failure to even consider the issue means that a business can be threatened by the removal of sensitive data or the introduction of malware or unlawful content.

Some organisations such as the MoD have banned staff from bringing iPods onto Ministry premises but the vast majority of organisations and businesses have no policies in place to prevent employees using any memory devices.  This seems at odds with the high number of businesses that have experienced some form of network disruption or electronic crime.

Some threats, such as the introduction of malware, are more obvious and there is the clear concern that firewalls and anti-malware defences are bypassed.  This threat is increased by the fact that one device may be used on a number of computers.  Other threats range from the downloading of pirate files onto a work PC, such as MP3 files copied from a home CD, to the introduction of pornography - as the business could become liable for any offences committed and be involved in subsequent litigation.  Software could also be installed on a work PC without the appropriate licence, creating a liability for the business or which could conflict with existing software causing network problems. 

With the great capacity for data storage on modern devices the greatest threat may be posed by what is removed from the business.  A business’s accounts, customer database or new product details can be easily removed without the knowledge of the business.  The copying to the memory device could take seconds in view of the high transfer rates modern devices support and can be conducted in the privacy of an office or meeting room by anyone with sufficient level access, or on a work PC left on without the user present. 

Businesses can take steps to protect themselves.  USB ports can be disabled, software can be installed to generate alerts when USB devices are attached and computers can be turned off or users logged off when away from the computer in question. 

Businesses should also consider introducing a policy on the use of memory devices.  This has to be weighed against the great benefits these devices, when used properly, can bring to a business in the form of the easy storage, retrival and transport of data.  The fact that a Memory Stick can easily be carried in a pocket can mean the device is less likely to be a target of theft than, for example, a laptop computer.  Even if stolen or lost, the data can be encrypted and carried in that form, to lessen the damage.  However, it is important that businesses are aware of what data is leaving their premises and ultimately, their control.

Rob Lucas specialises in the complex laws surrounding the latest advances in information technology. He has advised household name companies and governmental bodies on the implications presented by these advances, giving both technical and practical guidance.

This expanding practice serves predominantly West Yorkshire clients across a broad spectrum of company commercial work, as well as litigation, property and private client services.

The firm has continued to develop and attract lawyers from established commercial firms to add further strength and depth.

Types of work undertaken: Company and commercial work includes all aspects of company law including management buy-outs, mergers and acquisitions and commercial agreements. Commercial litigation expertise has also expanded, covering all types of contracts and disputes. The firm handles complex building and construction disputes for clients nationally.

The firm has considerable experience in employment law, dealing with contracts of employment and their termination, unfair dismissal, redundancy, discrimination, and harassment.

The firm’s commercial property department continues to grow, covering site acquisitions and disposals, schemes of development, planning aspects and commercial development. House and business sales and purchases and leases and tenancy agreements are dealt with.

The addition of the sports team has opened up new markets and the department is advising professional sportsmen and women in relation to their personal legal affairs, whether in relation to estate planning, property or family matters.

The private client department handles work for high-net-worth individuals, including estate and tax planning, probate, wills and trusts.

Last Cawthra Feather intends to maintain its strategy of expansion in the company and commercial fields. It also expects to develop new areas of expertise through its policy of bringing in outside talent to complement established strengths.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.