Portable USB devices: the risks

One of an IT manager's biggest fears is the steady proliferation in types of portable storage, ranging from Apple iPhones and iPods to flash memory devices. "People can use these to download any number of corporate secrets or sensitive information and move it off-site, which is not where IT wants that information to be," Holbrook says.

"In the past three weeks alone, I've heard six different conversations about the risks of flash drives and portable storage devices," says Mark Rhodes-Ousley, an information security architect and author of Network Security: The Complete Reference (McGraw-Hill Osborne Media, 2003).

While it would be easy enough to lock down the USB ports on employee PCs, many security managers say this is not a recommended approach. "If people want to subvert the process, they're going to find a way to get around any barriers you put in place," Miller says. "And where do you draw the line? If you restrict USB ports and [cell] phones coming into the office that may have data storage ports, then you have to look at restricting infrared ports on devices and CD burners, and the list goes on and on."

It's better, he says, to handle the matter by educating people on how to treat the storage of sensitive information. "Most of the incidents that occur are unintentional [rather than] malicious, so that's where education comes in, as to proper handling and why it's important," Miller says.

Machado says he isn't a fan of blocking USB ports at WebEx, mainly because such a strategy would quickly devolve into users asking IT for exceptions to the rule and IT having to manage those exceptions. "Everyone has an exception that they think is important, which takes up more of IT's time than is necessary," he says.

What would be optimal, he adds, is to have a tool that sends an to people who are trying to copy files to USB drives or other unencrypted storage media, advising them that they're going against corporate policy. "Then they know they're empowered to make the decision but that it's going to be tracked and monitored," he says.

On the other hand, DeKalb's Finney says she is interested in blocking technologies and is looking into the Vericept tool's ability to either block certain types of data from being transferred to an external storage device or alert her when someone tries to plug anything into a PC that's not native to that computer. Ideally, she'd like a tool that would also remind employees that corporate policy forbids sensitive data to be stored on external devices.

Meanwhile, Michigan's Grand Valley State University and other colleges and universities where professors and students have lost flash drives with sensitive data are looking into standardizing on password- and encryption-protected USB drives to protect them in the future.