Slashdot Mirror
When Data Goes Missing Will You Even Know?
Lam1969 writes "Jack Gold says IT shops may have a huge problem on their hands, and probably don't know even know about it. The problem is USB flash drives, which he predicts will probably reach 10 GB in capacity in three years, and the lack of policies to guide use of them by employees. From the article: 'With more and more employees using flash drives, smart phones with Secure Digital memory cards, portable hard drives, etc., the likelihood of companies actually knowing about all instances of data loss is declining rapidly. And as a result, the possibility of companies breaking laws, whether for data-loss disclosure or regulatory compliance, is growing dramatically.' Gold predicts 'at least one publicized major case of unencrypted data loss from a portable device' in the next year, which will result in many companies banning these kinds of devices."
From the slashdot post:
While there is truth to this, it is not a new truth and it is not the complete truth. It's one more mechanism for "losing" data but it's not the first and it won't be the last.It's an effective mechanism for moving large volumes of data, but it's not the only mechanism.
Corporate espionage and theft has and will continue to exist. USB drives are just one more aspect. While there may be some "exposure" and scandal soon about some USB drive falling into the wrong hands I doubt it will surpass any of the recent scandals (lost tapes and customer data).
Unfortunately, I'm guessing the article is correct in its prediction: "It is highly likely that within the next year, we will see at least one publicized major case of unencrypted data loss from a portable device. Afterward, a lot of companies will ban such devices". That would be a knee jerk reaction and counter productive but I'm already seeing it on so many other levels, e.g.,
among many others. I still think the greatest exposures are social engineering... and the paranoia around security policies don't address that. Sigh
(And, besides, isn't the RIAA is working on a solution to apply DRM to USB drives too? ) ;-)
To think that malicious employees waited until flash drives to steal data! Dear god, what about paper printouts, hard drives, e-mail, and (dare I say it?) floppy disks?!?
EVERYDAY IS CATURDAY
Dang, that reminds me, I need to figure out where my USB flash drive is....
The log files don't lie!
Of course if you can't find them, then it doesn't matter, does it? Does WinXX create a log file of USB insertion - damned if I know!
Been there, done that, paid for the T-shirt
and didn't get it
"I had to invade the owner's privacy to see what I could discover from the content of the files."
Wouldn't this be accessing files that you were not granted access to? Isn't this a crime in several US states, and is it really a good idea to admit to it in a column with your picture and name at the top?
Just curious if the 'Good Samaritan' is putting himself at risk (and if it was curiosity or a desire to return the property that was the motivation).
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
Gold predicts 'at least one publicized major case of unencrypted data loss from a portable device' in the next year, which will result in many companies banning these kinds of devices."
Which will solve exactly nothing. What are you going to do, search everyone as they enter and leave the building? If you want to limit data theft, limit access to huge amount of data in the first place. That eliminates the risk to any new technology to get the data offsite.
AccountKiller
Geez. It isn't lost, it is copied. Maybe you don't want it copied, great, but it is not lost, not misplaced, not missing. Some people will quibble about it being stolen or pirated, but it is not lost.
Infuriate left and right
I know of several companies which have filled in all the USB/firewire ports on most of the computers with epoxy. Only people who actually have a real need for devices using those ports have working USB/firewire (there are no floppies or CD/DVD burners in 'regular' staff machines either)
The company that I work for recently had a laptop stolen. It had personnel information for a large large number of employees (greater than ten thousand) and may or may not have been properly protected. I think that qualifies as pretty serious data loss, and it didn't need a flash drive to happen.
Will it be more prevalent? Maybe. But it already happens. Now, the question is, is there a program that can encrypt/decrypt an entire (relatively) small drive with some sort of key system or something? I think that will be the most logical step to protect small drives like these.
It's been present ever since Windows 2000 - if a company is worried about data loss via USB drives and the like, it's possible to disable access to USB drives using regular Windows security templates.
What the article probably meant to say is that sloppy security practices, combined with increasing personal storage, increases the risk of unknown data loss.
You can lock down a Windows box just fine against casual and accidental leaks if you know what you're doing, and you have a corporate policy to enforce. You can even prevent deliberate attempts at data theft, if you really want to be a hardass.
-EvilMagnus
Does the author think "data loss" is a synonym for "unauthorized copying"? These companies had better hire some data recovery experts!
REM Old programmers don't die. They just GOSUB without RETURN.
Giving employees laptops is very normal now considering it helps them to work from home / while in travel.
Can't they move huge amounts of data with these things?
What else can you ban? Enforcing policy != banning stuff.
It isn't the theft of data that TFA is really concerend about.
The real threat comes from actual LOST data. With portable storage media getting bigger and bigger, more and more data can be put on it. Including massive amounts of spread sheets and even databases. (I worked for one company that insisted on keeping a sensitive database on USB keys, to be sneaker-netted around to whoever needed it).
Top that off with more and more USB keys floating around the office. Sure, right now, not every employee has one. Or, at best, every employee has just one. But it is becoming more and more prevellant to have "unowned" keys. In other words, a company buys a crapload, and people just grab whichever key is available at the moment to use.
Soon, people will treat USB keys like they treat floppy disks; there'll be a big pile of them, and employees will just grab one as they need it.
Because of this causal attitude towards USB keys, it'll become near impossible to track all the data. Employee X copies Spread Sheet A onto a key, takes it home to work on it, brings it back, and tosses the key back in the pile. You now have an unaccounted for instance of that data. Each time an employee does that, you have more and more instances of data that are unaccounted for.
There's no guarentee that the employee will blank out the key. There's no way of tracking which data is on which key. So an employee might check out a key that has data on it that isn't theirs. There might be hundred of files on the key. Who knows. They don't. They won't care, either. They'll just copy thier files over, work on them, copy them back.
So, each key has tons of data on it. If someone were to ask the CFO "Show me all copies of Sensitive Spread Sheet 5", they couldn't.
Now, one employee checks out a key. They treat it just as casually as they would a floppy disk. They lose it somewhere. (Falls out of their pocket, gets left on the bus, etc). Now, a floppy disk might have just a tiny amount of information on it. A few documents. A couple spreadsheets. A USB key could have an entire database! Someone picks it up, and suddenly has the bank information for all the company's employees...
That's the big issue there. Not that employees will sneak data away on USB keys (though that is a concern, too), but that employees will be too casual with large amounts of data and quite literally LOSE it.
UTF-8: There and Back Again
I have far more concern about data theft and misuse, by corporations, than I do about data being "lost".
The article seems to be another component in the wave of misdirection of attention away from corporate misdeeds and crimes towards an unfortunate, short-sighted, and inapropriate focus on what appears to be minor transgressions of a few individuals.
When a few credit-card billing agencies, colleges, and others routinely lose millions of records at a pop, I am comparatively unconcerned about Joe or Sally copying a CIF. And those "few", above? They're only the publicised ones, Chtulu knows how many cases are kept quiet.
I suspect however that the irreversible damage has been done hwoever, that the association has been made in the minds of the public and law-makers, and soon enough the use of such drives will be made illegal. And when USB flash drives are criminalised, only criminals, no, wait, I mean, you can have USB flash drive when you pry it from my cold, dead...
Of course getting the users to actually use encryption is another story...
TrueCrypt works pretty good for these situations and it comes with an open source license. The forums contain a lot of tips and tricks for using the application in odd ball situations.
Not affiliated at all, just a satisfied user.
Bad boys rape our young girls but Violet gives willingly.
I remember a similar article here discussing the usage of portable gadgets at workplace, like iPod, camera cell phones, etc and many stated that their workplace does not allow such gadgets in "certain" areas, and they had to actually check them out before entering the premises..
IMNAProfessional IT guy but ... My prediction is more and more companies will physically segregate their networks, from the interweb and from their internal systems. Of course the Peter Principle implies that a lot of stupid stuff will happen before during and after.
Physics is like sex: sure, it may give some practical results, but that's not why we do it.
Well, the whole topic is. "People can steal data with USB drives!" News? Ten years ago I was stealing data with floppies. Copied a whole mailing list. (Didn't use the parts I wasn't supposed to, it just simplified things to have the whole thing.) Most "secret" data is basically text, you can fit hundreds of pages onto a floppy.
Anyway, it's impossible to prevent people bringing in floppies, let alone USB dongles. If it bothers you, just open the cases and disconnect any USB sockets. (Use AT keyboards and mice, still easy to get.)
And in Soviet Russia...
When you go missing, will your data even know?
When it comes to valuable databases and such, it's best to keep them on a remote-access-only server, and only allow the data to be accessed in controlled ways. Then, typically, it's trivial to disable mass-export for everyone except those who might need it (usually just sysadmins). While, technically, this doesn't stop someone from going through by hand and recording everything, this does make it much more time-consuming and more obvious in logs.
Auditing of a filesystem is the best way to go here, IMHO. Drives are getting bigger, so capacity for log storage grows too. Currently you can set most filesystems that have granular security to audit file access, writing, creation and deletion. Perhaps there is some way to adit target actions ("copied to removable drive X", "opened by Microsoft Word") that will be developed eventually. Personally, I log access to important files as a matter of habit (mostly with NTFS). I've also found that the bigwig execs love it when you tell them you can see who tried to look in their directory.
US Democracy:The best person for the job (among These pre-selected choices...)
we're all planning to have RFID embedded in every device by 2010 anyway, right? The 'end of theft' should include thumb drives as well.
No one is gonna stop us from taking pictures of our computer screens with little East German cameras! Old school style!
I read an interesting article that pointed out that data secrecy isn't really worth all that much. It might have been Paul Graham or Joel Spolsky -- not sure. Basically, startups are always running around having people sign NDAs left and right -- but, honestly, their idea is probably nothing that crucial -- that'll buy them some market lead, but it's not going to make them stunningly rich. What matters is whether or not they can manage to compete after their competitors introduce competing products.
I'm sure that we can all thing of worst-case scenarios that are pretty scary, but honestly, does your company pay you to engage in data espionage against other companies? How likely do you think it is that your counterparts at another company are being paid to engage in data espionage?
Any program relying on (nontrivial) preemptive multithreading will be buggy.
TFA is about losing or misplacing data because the USB drive it's stored on gets lost, not users stealing data as half the commenters (who obviously didn't RTFA) are talking about.
Duct tape is like the Force. It has a light side, a dark side, and it holds the universe together.
Let's ban the automobile, 9 out of 10 bank robbers use them to escape from the scene of the crime.
Mea navis aericumbens anguillis abundat
From reading the comments, it's obvious that most of the posters haven't RTFAed. But what's new - this is Slashdot after all...
So to clue you all in:
The article is not about people stealing sensitive data from their workplace using their USB drives. The article is about people losing data, because they've lost the USB drive they had it stored on.
Duct tape is like the Force. It has a light side, a dark side, and it holds the universe together.
No, Nope, Nada.
The U.S. Military has pretty direct rules for dealing with these things, don't bring them. While I would never want to see that enforced everywhere the simple fact of the matter is, that is the only foolproof policy (and even it isn't perfect). Unless companies are willing to be draconian, and can find people who'll a) put up with that and b) obey, then they will lose some data.
While I fully expect some companies to try it I expect that some of them (the smaller, nimbler more sensible ones) will discover what many have about filtering e-mail/web access in the office. In general it costs more than it saves in sick days and general wasted money.
It's been a while since I've peeked into a white man's ANUS... Can't you disable diarrhea in the ANUS setup? Or is that dependant on the particular ANUS? Then you can just set an assplug to prevent access to the ANUS sphincter menus.
Is the issue called trust. Specifically, towards people on the inside of your organization.
It all boils down to "Do you trust your employees"?
There are businesses that do, and there are those that don't.
Those that do work on the assumption an employee will not do anything to harm the business intentionally - take a file he is exposed to during work and transfer it somewhere outside the organization.
Hence, it will not take all measures required to prevent him from doing so.
A business that does worry about such things will - What you carry will be checked at the door. Your PC will be locked (the case, physically locked). No Floppy, CD-R, USB, no means to connect media you bring from home. Internet access will be so restricted you wouldn't even be able to encapsulate an SSH tunnel over DNS packets you kindly ask your DNS server/proxy to send for you. And so forth.
Pointing at a business where everyone has web access and a dell sitting on his desk with 2 USB ports looking at him and saying "Hey, this guy can copy a confidential word document on the USB key" is hardly news, doesn't bother anyone in the first type of organization, and usually a non-issue in the second (which would have taken excessive measures to prevent exactly this kind of thing).
Nothing to see here, move along.
-
Companies will simply have to adopt extremely stringent policies for sensitive information. Now granted that employees can and will be careless regardless of policy, a strict policy of limited and catalogued copying of sensitive material (much like the government handles classified material) and severe enforcement of said policy would greatly reduce the risk to the company. While its certainly much more dangerous with huge amounts of data, proper policy and education can manage the risk.
There's no guarentee that the employee will blank out the key.
1) Make it Company Policy. Enforce it by randon checks.
2) Make whoever is responsible for the 'pile of USB keys' (I.T., or the supply clerk, or whoever) wipe the incoming keys before making them available.
Didn't RTFA, I assume?
The article's about people having critical and/or sensitive files on their USB drive, and then losing it. As such, the files are lost as well. TFA is not about copying/stolen/pirated files.
Duct tape is like the Force. It has a light side, a dark side, and it holds the universe together.
Hmm, interesting. I've always used my USB flash drive for sharing and copying music from major record labels; maybe I should pick up another one.
keywords: P2P music napster free music
Your ideas make sense
Where I work:
They are removing cd drives and floppies from the leased PCs.
No cameras are permitted on site
No cameras in phones permitted.
Users are users, not admins, generally. No access to bios menus.
You can still email small files out, but those are traceable.
Not allowed to use personal email (eg gmail) at work.
They haven't figured out memory sticks yet
Biggest problem I see is the theft of laptops from cars.
Look, I don't like DRM as much as the next geek. I wish I could put my legally purchased music onto a USB drive/MP3 player and listen to it without restrictions.
But that isn't the point here. In this situation you have a corporation which owns the data and has a vested interest in controlling exactly which devices and equipment the files can be viewed/played/copied/edited/etc on. DRM is the appropriate solution.
Also, the network is everything, there are not so much totally isolated computers with critical data, and most networks have some or several points of touch with internet, encripted traffic and then hard to trace what is happening with the information.
As a company I think it would be no less then a wise investment to have a manufacturer make up a whack of keys that are write once - read once. The data can be verrfied (read) once within the same time frame as the write via onboard logic. After the next read logic kills the memory to garbage and start again.
As well you could hardwire each employees biometric sig/reader into each key and have a couple boxes made up that only they can use. Let them use them as needed and let them know that each one is pooched once coppied or opened. Have a read/write lock to prevent a mis-hap. Mass produced each may cost as much as $40 each for "small" quantities but as a VP would you rather your employees that have to transport data use this or something else?
A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
emphsize the importance of backup through normal or artificial means and outlaw "extraneous storage." Once they lose a file in "my documents" that hasn't been remapped to their H: drive. Kaboom, they are an unfit employee. If they use flash drives / other removable storage, woe be it unto them if you have reasoanble auditing in place.
what happens? Some dumb bastard stores 1.2 GB of christain rock (no shit) mp3s on his personal H: drive. When those disappear you cannot imagine the silence at the helpdesk end of the phone.
Then your mouse and keyboard wouldn't work ;)
seriously tho most new computers only have usb.
Looks like someone doesn't know what to do to keep from having to update copyright. Hint: it's 2006.
There's always the old fashioned way of stealing data, too. Printing it out.
I used up all my sick days, so I'm calling in dead.
...that we don't have any policy ? The same police that covered floppy disks, magnetic tape, rewiteable CD's and punched cards or paper tape do also cover ANY other removable media.
This is not a new problem the only difference is the capacity of the media.
Funny, a few hours ago my Fiance called me upset cuz she broke the USB drive i gave her for her b-day while she was vaccuming. Brushrollers caught the strap and yanked it right out, destroyed the usb port and smashing the drive itself. I guess it took out the vaccum to and that managed to set off the smoke alarm. Wish i coulda seen that, it sounded spectacular...
"Sic Semper Tyrannosaurus Rex."
For the first problem (Data loss due to lost or corrupted disks), which seems to occupy the majority of the article, the solution is easy. Back up your data from your portable storage as soon as you can easily access the mainframe. How long does a differential/incremental backup take? 10 seconds? 2 minutes? A piece of data existing in the portable disk, the mainframe, and the backup tapes, is much harder to be lost.
For the second problem (Data theft due to lost disks), encryption works well. To discourage data theft due to lost disks, a simple, easy-to-use on-the-fly encryption on the portable storage device can help tremendously. The solution has to be simple because if it is a few mouse clicks too many, employees will try to circumvent the hassle.
Data goes "missing" when it gets deleted. What we're talking about here is when it gets copied, right? Captain obvious says hello!
It would most likely require some specialized software on the client PC. For one thing, the FAT, last modified times, etc. would have to be in an area set as "safe".
.jpg file, the second you opened that folder, Windows would read it to make a thumbnail (and it would be deleted instantly). That would make it a write once, read never device.
Also, windows likes to build thumbnails, summaries, etc. for files it sees. This is done by reading the file in question (or at least parts) - if you had, for example, a
Not particularly useful without the software to back it up.
The amount of critical data in a company is often very limited and can be kept under control. If more energy is put into research and less into legal battles any data loss will soon be rendered useless.
Of course - this does not apply to all data.
Movie and music copying is a more direct impact where the data is the product. However - it all comes down to the issue of additional value. If downloadable files exists but lacks certain features, like the sound in mono, missing scenes etc. and a more full-featured version is available with full surround audio, better picture quality addition etc. will be paid for by the part of the audience that really want that.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The Dutch 'Secret' Service (AIVD) recenlty lost a memorystick containing 'secret' documents:
in Dutch: http://www.webwereld.nl/articles/39418l ioNotizieOggi/1,3243,2@1332658,00.html )
from an Italian newspaper: ( http://www.intesatrade.it/IntesaTrade/News/Dettag
The real threat comes from actual LOST data. With portable storage media getting bigger and bigger, more and more data can be put on it. Including massive amounts of spread sheets and even databases. (I worked for one company that insisted on keeping a sensitive database on USB keys, to be sneaker-netted around to whoever needed it).
Was it their ONLY copy? Because if it was, they were dumber than a ton of bricks, end of story. And it was no fault of the media itself (flash or otherwise), it was human stupidity. Always make a backup. I think it's in the Bible too (well it ought to be). Digital information goes both ways: it's very easy to duplicate, but it's equally easy to lose. Not taking advantage of the first to cover the second is just plain moronic.
i ate crayons when i was a kid and now i have two braincells and the blue ones taste nicer
For shame...
Only last week it was in the news here in Holland that the Dutch Military Intelligence Service (MIVD) officially reported that a USB stick with classified information was missing. Makes you wonder if they've even encrypted the data...
And when I posted this as an Ask Slashdot, I was told not to worry about it.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
...have been around for a while now. What has happened is their took their smallish loot, and invested in "legitimate" companies and corporations. See, this goes way back. Those "bad guy run" places, now headed by "respectable" businessmen in dark suits, bought up other corporations,and now we have some really, very very large corporations, still run by "the bad guys". Along the way they had some spare change so they bought "governments". And then you have "blends" where bad guy "government" group a.b.c forms what is called a "front company", where they can go do bad guy stuff, and even if caught, nothing happens! They dissolve, and form another front company!
When they want your stuff, if it is valuable enough, they just buy your company. If they can't get it, they'll buy some piece of the "law" to destroy you. Or, they are "the law", or a reasonable facsimile thereof.
See how that all works out nice and neat? They don't have to bother with penny ante little stuff like a smuggled USB drive. And what they do is keep you fixated on the little USB drive, so you don't look up and see the LARGE badguys. You might even be working for one, and not know it! Or, you might suspect, but need the job, so you go "oh well, I need the job". Or, you might suspect, but to say anything is "dangerous", because you have seen what happens to others who saw. so you be quiet, and keep your job.
It works for them, so I imagine it will continue, and the bad guy companies will get much larger, until they are larger than even their governments they own now, and will become what are called "global" in scope.
Your workplace is either a secure location, in which case this has already been addressed, like every technology before it, or it isn't a secure location, in which case a little USB Flash drive is only one of many ways for data to leak offsite.
I work for an evil Wall Street financial services firm. They disable the USB ports with group policy. Oh, it's a great place to work.
Maybe have the logic onboard for the biometrics, powered by the port and have X reads per scan(requires the users finger to be in constant contact for large files) this would ensure the user definately knew what happened to the data/disc/key ;)
As a policy using the onboard UC you could deny access to any data on request or completely terminate the circuts(james bond stuff) or even just shutdown the interface.
No Software, enhanced accountability, USB comptibility.
A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
This seems to me like just another ridiculous hype to boost new "security" products. Lets face it: There may be a small additional threat to security by USB-devices, but it s marginal at best. If you re concerned about security it all comes down to a good policy, a strict enforcement of the need to know-principle (hey, you do NOT need to buy any additional products, you CAN do it by means of any recent operating system) and last but definitely not the least a good treatment of employees. Treating employees like rubbish -common in almost any company nowadays- is a surefire way to endanger your operation, no matter how many shiny security-products you bought. Extensive use of technology in this case will never work because fixing a human problem by technical means NEVER does.
Just think about the distribution of information, get a good and reasonable security-policy -one which is accepted, understood AND supported by your employees- into action, follow some basic guidelines regarding security-infrastructure (firewalls, network segmentation, segregation of duties, and a buttload of antivirus/antispyware), start treating your employees like human beings instead of suspicious animals and you ll be reasonably safe.
Nowadays it is almost impossible to avoid people from copying company data, also because it is becoming a spread practice to bring some work at home.
Not to mention the vast usage of laptops, especially among ICT workers.
Removable media with high capacity is only the "latest" technology to do this.
In the past we have used printers, floppy disks, email and web disks in order to bring data and documents home (or wherever else).
You can lock floppy drives, USB ports, bluetooth features and so on. You can filter web accesses and other publishing media and protocols.
But what about email and printers?
Are you really planning to make work harder and slower?
And I'm pretty sure that in some cases, especially in small companies, the private copy saved the day in more than one case!
Maybe Computers will never be as intelligent as Humans.
For sure they won't ever become so stupid. [VR-1988]
Am I the only one here think thinks it might be kind of cool to work in a paranoid place requires you to check cell phones at the door? Now if only they could eliminate my pesky desk phone and email (um, in the name of security leaks, of course) I might actually have time to productive!
Would anybody beleive me if I made the case that status meetings and rambling, pointless telecons with 3rd parties are risky security leaks too?
I carry a 100gb external USB drive and three memory sticks everywhere I go. They contain multiple diff backups, HD ghosts, etc. I'm a novelist and programmer, and my data is my livelihood.
If I had a job where they banned me from carrying my own backups around I'd have to resign, because I'm not about to leave them in my car and I'm not going to open a safety deposit box for daily switchover visits.
Surely it's up to the company to manage their hardware so that employees can't simply copy data to removable devices?
Hal Spacejock: Science Fiction with Nuts
It's been present ever since Windows 2000 - if a company is worried about data loss via USB drives and the like, it's possible to disable access to USB drives using regular Windows security templates.
Wouldn't it be simpler to deny write access to the source media so that nobody can deprive the owner of the data? Disabling USB would only inhibit copying but what we are talking about here is theft.
Time is what keeps everything from happening all at once.
The higher level supervising program went to consult one of its own look-up tables to find out what the low level supervising program was meant to be supervising.
It couldn't find the look-up table.
Odd.
It looked again. All it got was an error message. It tried to look up the error message in its error message look-up table and couldn't find that either. It allowed a couple of nanoseconds to go by while it went through all this again. Then it woke up its sector function supervisor.
The sector function supervisor hit immediate problems. It called its supervising agent which hit problems too. Within a few millionths of a second virtual circuits that had lain dormant, some for years, some for centuries, were flaring into life throughout the ship. Something, somewhere, had gone terribly wrong, but none of the supervising programs could tell what it was. At every level, vital instructions were missing, and the instructions about what to do in the event of discovering that vital instructions were missing, were also missing.
The article title ("data missing") is a misnomer. What they should be concerned about is not actual loss (no copy left), but disclosure (copies left where there shouldn't be, such as in the hand of competitors, spammers, thieves, press ... or whoever else the lucky finder of a stray USB key may be)
I can't care if my data is stolen from:
- a floppy
- A4 / Letter paper
- USB drive
- phone
- CD
- DVD
- HD DVD / Blu Ray
- mobile HDD
- laptop
- backup tape rolls
So instead of just going after the easiest transfer method (USB sticks) and pretending we're doing something that matters, how about just dealing with the actual problem, that people walk around with copies of the data unencrypted?
Many of the modern USB devices support encryption of data. It's enough to be make a policy that you can't copy protected company data without encrypting it with a strong password.
Then losing the medium and someone will ill intents finding it means basically nil.
Yep. It's in Genesis. Something about a bloody great boat.
What worries me is how far the lesson has been taken. What happens if Him Upstairs has full backups? What if he decides he doesn't like the direction things are going and rolls back to an earlier saved state? How would we ever know if he did?
Real Daleks don't climb stairs - they level the building.
Many corporate companies that I have had dealings with have already made these sorts of issues clear in the employment contracts. Most internal systems have USB ports that are disabled and the operating systems are locked down so that files must be stored on a central file server rather than on the local hard drives making it more difficult for the average person to steal the data. However if any employee REALLY wants to get their hands on data they can in most cases with relative ease.
- Briefcases get lost all the time, and briefcases have been large enough to contain sensitive information for decades now. Keychains also get lost on occasion, and especially for small businesses that's often enough to get in the building at night or steal a company truck.
- Yellow Sticky Notes with your IP address and VPN password fit in your pocket just fine, and DSL means that people can suck up your data even faster than when we used to use Yellow Sticky Notes to carry modem phone numbers and dialup passwords.
- Documents that are actually important are usually 1-100 pages long. You can store them on mashed-up dead trees if you avoid spilling coffee on them. Them newfangled USB thingies hold a lot of data, but back when we carried 3.5" floppy disks 20 miles through the snow uphill both ways , Microsoft Office wasn't as bloated, so a zipfile of The Secret Plans still usually fit in your pocket. That's not the same as carrying out the whole blueprints for your next chip in your pocket, but mini-CDs do pretty well - they're certainly enough to carry the HR personnel database home.
- DVDs and CDROMs fit pretty neatly into briefcases, and most newer PCs have at least a CD burner, so you can still carry the chip blueprints home.
- Laptops are easy to carry, and go missing all the time. The San Francisco Police aren't very good at recovering them even when they've got them in their evidence room and the thief in custody; your mileage may vary
:-) And unlike keyrings and regular briefcases, laptops have obvious resale value so they're more attractive to thieves.
- RM-05 removable disk packs are a bit big to fit in your briefcase, but magtapes fit just fine, and before magtapes we had ASR-33 paper-tape, which works just fine for carrying the Numerical Control tape that tells the milling machine how to cut your submarine-propeller plans.
- Mainframes with Greenscreen 3270s are much less portable, but back when I worked for The Big Phone Company they were worried about people carrying computer printouts home, and they checked our briefcases on the way out the door of buildings that handled sensitive information.
But yes, within the next couple of years, somebody's going to have a USB keyring/wristwatch/Walkperson/iPod/Pseudopod/someBill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
What the article probably meant to say is that standard security practices, combined with increasing personal storage, increases the risk of unknown data loss.
There was a small typo in your post. Fixed.
May the Maths Be with you!
You can't open the boxes, lolz. I wouldn't use jb weld though, it really does have iron in it (crawls all over a magnet).
From TFA: As a result of this experience, I have put a small .txt file on my devices with my name and address, and I figure an address label on the outside can't hurt either.
I know someone placed fairly high up in the security department of a major international company, and this is exactly what their employees have strict orders NOT to do. They even go so far as to recommend you don't have any visible identification tags on your luggage.
Tags mean you can be identified, and if you carry around a flashdrive clearly marked with your name and company in for example an airport, the odds that someone will spot you are quite high. If this someone has been hired from a rival firm, odds are this someone will try to steal it.
This may sound like too much James Bond, but the fact is that corporate espionage is bigger than ever, and it becomes more and more important to protect every ounce of information you might have.
Also, no identification tags means all your pr0n can't be traced back to you.
This isn't the answer. There's still floppy disks (ugh!), CD drives (lots of PCs come with CD writers nowadays), printing of documents and {screendumping, emailing} of documents.
The real solution is to restrict documents on a permissions level. This makes restriction of USB drives irrelevant.
So companies will implement draconian restrictions that inconvenience all their users across the board whether they're handling confidential data or not, but will still ship unencrypted tapes via UPS. Brilliant.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
There will always be that kind of insecurity with any kind of device, whether it's a disk or a USB drive etc etc.
:)
But why not DRM all data?
If you think clearly about it, DRMing all data will prevent (as much as possible) the use of the data, but not the theft or loss of it.
Simple really..............
Don't be apathetic. Procrastinate!
For a company to function, many employees of the company have to have access to the company's data. All of them, if they are inclined to do so, can copy it. Heck, many of them can sabotage it, and destroy the company.
Guess what the company can do about it? It can stop treating the employees as shit. Especially stop pretending that the company is some amorphous entity that makes its owners/shareholders entitled to profit, and can impose idiotic demands and shitty conditions and pitiful pay on everyone else in it. Employees do their work, this is why they have access to company's things. Nothing, ever, happened in a company without some employees making it happen, so if any of you wonder, why people can destroy your precious company, keep it in minds -- THIS IS BECAUSE THOSE PEOPLE ARE THE COMPANY.
There is nothing wrong with avoiding overbroad access where it isn't necessary for things to work, however there is no way to make any company "secure" from the very people whose only responsibility is to keep things running. Don't piss them off, and remember that you didn't become Presidents, CEOs and VPs by understanding how to operate anything that makes your company what it is. Every time you eat your lunch, think how many people you have abused today, and what will happen if any of them will press a few buttons.
Contrary to the popular belief, there indeed is no God.
what the hell?
?giS
Huh!?
Three years ago I got an Archos Jukebox with a 10 gig hard drive. Plug it into a PC's USB port and you have a 10 gig portable hard drive. Of course that was battery powered. But then there are all those portable USB hard drives like the Freecom FHD series that are bus-powered just like a USB flash drive. They fit in a shirt pocket quite easily.
This is not a new problem. It has been around for a while.
And don't get me started on Iomega JAZ drives, CD writers and DVD writers.
"That's the big issue there. Not that employees will sneak data away on USB keys (though that is a concern, too), but that employees will be too casual with large amounts of data and quite literally LOSE it."
I don't see what the big deal is. Huge companies have had really really really important data stolen with no real effect or punishment. I mean things like social security numbers, credit cards, personal information, credit records etc. Do people even remember what happened with choicepoint? Does anybody even know who choicepoint is or what they do?
This is just bullshit. Nobody really cares all that much. There are no consequences to the corporation at all for losing data. Worst comes to worst somebody gets fired. Big whoop.
evil is as evil does
Information want's to be free!
I used to have a better sig but it broke.
> Gold predicts 'at least one publicized major case of unencrypted data loss from a portable device' in the next year, which will result in many companies banning these kinds of devices."
;-).
Unfortunatly I work for a company that would make such a stupid policy.
I wish companies would actually try and do something about the problem rather than banning things.
The way things are going we're gonna have to work naked leaving everything we have at security, because it's the only way we can be sure things aren't stolen.
Still we do have flash drive security here I guess. Only because we still use NT4 on the whole, mmmm nice USB support
+----------------- | What is the question!
It takes about 3 seconds to squirt enough airplane glue into a USB port to permanently disable it. End of problem.
There are two kinds of computer users: Those that have lost data and those that will. Any CEO knows that from first hand experience. Companies have dealt with information loss ever since the first person scratched something on a rock. The important thing to remember is that most data is useless anyway, so it doesn't matter if you lose it. Most stuff is saved because it is convenient, not because it is essential to save it.
Oh well, what the hell...
if you have a business need that's not being met by your IT dept, submit a business case and let your manager sort it out. easy. ban stuff on a business, case, reinstate it on one too.
so deny users access to usbstor.sys via an AD policy. USB peripherals will work fine, APART from USB bulk storage. sheesh, this isn't rocket science.
A company i worked for previously had us remove all the cd drives and floppy drives from all installed machines, this made a lot more work for all of us in the support team, but it certainly made the company secure. Combined with the fact the only WAN connection was for email and back office stuff (no interweb for the employees, such bliss!) meant that we were a reasonably secure shop. + THe fact we used ZenWorks Desktop to lock everyone in the company down to the Nth degree. Sure, someone could walk out of the office with a pile of paper stuffed down their pants, but it would have been quite obvious. AFAIR nothing got stolen from that office apart from pens and paperclips (which were kept under lock and key and needed authorisation to remove ;) )
Working for the (other) man
So, tell me, would you put anything essential on a floppy disk? Sure, you might transport it home or shuffle it over to another PC... But if there's only one copy of an absolutely crucial email document, are you going to put it on floppy? Without any backups?
Likening USB keys to floppy disks is actually not a horrible idea. Neither of them are terribly safe/secure media. I certainly wouldn't trust anything essential to either of them, regardless of capacity or portability. It's just plain common sense, and anyone who's losing vital data because of these things is sorely lacking in it.
We don't need new security practices. We don't need new policies. We don't need paranoia and reviews and whatever else. We just need common sense. It's a small, fragile device that can easily be lost, stolen, or destroyed...how about we don't put the only copy of our most vital assets on it.
Trying to "outlaw" and "enforce" usb devices is an option only for the dim whitted. I will probably use your suggestion.
I have heard all this before and business keeps on ticking....
1980's style - no floppy drives in computers
1970's - photo copiers lead to loss of sensitive data
1960's - Beware of employees with Kodak cameras
1950's - Don't through carbon paper into trash cans
That's as far back as I go...:)
Gizmos Gagets For Ninjas
We found this out the hard way last week. Four years ago I published my wife's cookery book, which included about 80 commissioned paintings. All the text was stored in subversion but the image data took up about 40GB in its various forms. It was all backed up and we had multiple copies on different disks, but having just sold the rights to the book I discovered that I had reused the 250GB disk that held the images, putting it into a Windows XP system my wife used for her printing business. We had changed our tape drives a couple of years ago and didn't have any of the old tapes -- we just didn't notice when we lost the files. Fortunately we were lucky: only 10% of the disk had been reused, so I made a low-level copy of the disk, used scandrive to find undamaged superblocks and then e2fsck recovered the about half the contents of the disk. As we had the files in multiple formats we actually ended up only losing three of the images, which was miraculous.
intriguing
?giS
Might I recommend Disk Net Pro:t pro/
http://www.reflex-magnetics.co.uk/products/diskne
No affiliation, we just did an eval of the product.
Using good, sensible policies with such a product would stop the sort of misplaced data that TFA is talking about. It does require a client side driver/software and reduces the portablity of your data but that's how it solves the problem.
By default it treats your users like the enemy, which I hate, but that's corporate policy around here already so what's one more layer?
I don't think, Therefore I'm not.
I teach at a college. In a world where we are getting sick of big brother, I'm getting sick of IT people filling that role. So what if the school won't know if I lost a bit of data on my usb drive. I can live with that. It's better than them centralizing all the drives so that if one networth thing goes wrong everybody can't work.
Because of this causal attitude towards USB keys, it'll become near impossible to track all the data. Employee X copies Spread Sheet A onto a key, takes it home to work on it, brings it back, and tosses the key back in the pile. You now have an unaccounted for instance of that data. Each time an employee does that, you have more and more instances of data that are unaccounted for.
Here at Chevron we wipe every hard drive we get rid of. I can remember a huge stack of hard drives back in 1999 and there was one person whose job it was to wipe all of them before getting rid of them.
Just do that with the USB keys. Make a process where the USB keys are returned to the supply clerk and have that supply clerk wipe them before giving them out again.
I think blank CDs are worse than USB keys for data loss. Burned CDs are not expected to be returned to a supply clerk. It is usually up to every individual to make sure they do not compromise critical and sensitive data. Not a very effective process relying on every employee to follow the process for data retention.
"Only one thing, is impossible for god: to find any sense in any copyright law on the planet." Mark Twain
Wouldn't it just be easier to disable the USB via the BIOS or open up the case and disable or remove the USB?
Seems like physically ruining a device with Epoxy is a lazy way to disable something.
He who knows best knows how little he knows. - Thomas Jefferson
Unless you live outside the US, or in Montana, that Carrera is wasted. Everywhere back East, the speed limit is 65 or less, where that beast isn't even trotting. Maybe in the West you get a 75 speed limit - a little better. But in Montana, if I've heard correctly, it's "Reasonable and Proper" again. Or maybe you live in Europe, and can open it up a bit on the Autobahn. But since you say "pub" I might presume you're in the UK? What are speed limits like, there?
Or is it carbon city for your engine's guts?
I just brought in a new flash drive, today. There's no policy against it. My plans for it? Primarily pdf's of various documents and manuals that I end up getting here and there on the net, in the course of doing my job. I also plan to put executable and data file for pwsafe (encrypted password storage/generation) on it. If I ever put sensitive data on, it will be in an encrypted container file, and the primary copy will be on backed-up media at work.
And oh yes, I have a job... and a wife... and kids... and a house... and 2 cars, though less exotic ones.
The living have better things to do than to continue hating the dead.
Sure, there have always been problems with copiers and cameras and the like. But how easy was it to walk off with, say, an entire customer or HR database from a Fortune 500 company using just photocopies or pictures? That would take a while. Walking off using an iPod could only take a work day (copying the data might take a little bit of time).
Not that disabling the port entirely is the solution, but the problem is definitely increased in magnitude these days.
I was following you throughout most of your post, but what I don't get is how USB keys change the situation from how it is with a big pile of floppy disks.
You say that the problem would occur when there's a big bin of USB keys, and employees just start using them and not wiping them afterwards. Well, there'd be that same problem with any other kind of rewritable media, including floppy disks. I don't think the situation is new or unique at all. The only thing that's changed is the capacity of the media, but with the corresponding increase in the size of files (write a 10p formatted document in Word, save a few versions, maybe do some track-changes, and look at how big it's gotten) I don't think that people are apt to have much more sensitive data on a USB key than they did 10 years ago on a 3.5" HD-DS floppy.
The problem here isn't technological, it's behavioral. If you can't trust your employees with sensitive data, then it doesn't matter what kind of media you use, you're going to have security problems. Likewise, if you do trust your employees with sensitive data, and provided they're trained in the right procedures, you shouldn't have problems. I.e., if you leave a bin of USB keys sitting around, people need to know not to throw a key back in the bin after they're done with it, without erasing it first. In my opinion, anyone with two brain cells to rub together ought to realize this without being told.
If you can't trust your employees to do something that elementary, then they probably can't be allowed any removable media at all -- whether floppies, USB keys, CD-R/Ws, iPods, or anything else. Probably they shouldn't even have pencils and notebooks, unless you're going to look through them as they enter and exit the building.
I've worked in positions where I've been exposed to a lot of sensitive information, and I've never been patted down at the door for USB keys or floppy disks, or had my iPod inspected. My issued computer had a CD-R/W drive, and there were stacks of blank CD-Rs in the supply room for making backups. There wasn't any attempt made to limit access to things like that, because to do so always has some impact in another area -- people do use USB keys and CD-Rs for useful stuff (taking a powerpoint presentation to a un-networked kiosk, for instance). However everyone was trained in how to deal with sensitive/confidential information. Everyone knew that if you disclosed or leaked info, that you'd be fired, and depending on the information might end up answering some really pointed questions in an uncomfortably well-lit room. In the time I was there, I never heard of an inadvertent loss or disclosure of confidential material, aside from one laptop that was stolen. (And in that case the employee wasn't to blame, he was mugged, or so I heard.)
These sort of kneejerk responses to information-security, like banning USB keys and whatnot, seem symptomatic of institutions that for some reason, have decided that their employees cannot be trusted. And if that's the case, they need to rethink their hiring, firing, and compensation processes, and figure out how to recruit people that are actually trustworthy and can deal with the responsibility of accessing the type of information that their job requires. If you can't trust someone to not copy the Confidential HR Spreadsheet to a USB key and not delete it, then they shouldn't be looking at that spreadsheet in the first place. (Because that's exactly the sort of person that's going to accidentally CC it to the whole company, or something else equally embarassing, given enough time.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
"And oh yes, I have a job... and a wife... and kids... and a house... and 2 cars, though less exotic ones."
;)
But what percentage of slashdot is all of that better than? That's the important thing
//OT.
:P
:P
Yup, that sounds about right. And I predict at least one playboy bunny in every household next year. About the same amount of people would realistically care about both those predictions. But I predict more people would be disappointed if my prediction would go the highway
I also predict at least one more prediction in the next dozen articles
I am putting myself to the fullest possible use, which is all I can think that any conscious entity can ever hope to do.
When Data Goes Missing Will You Even Know?
Usually the computer can locate him and beam him back. In case the computer can not find him, we use Spot (the cat).
[/joke]
Is the data protected from loss? Probably not, even though there are many devices now available that include encryption capability (which is rarely used). And what if a competitor picks it up?
So his concern is your company's dirty secrets (or legitimate secrets) leaking to the public, not the actual loss of data. Which is also pretty clear from the "Will you even know?" part of TFA's title.
This signature is not in the public domain.
The real problem here is not technology. People have been using cameras, copiers, photographic memories, for years. The problem is authentication and then access. Authentication verfies who you are. Once you have that, then there should be rules on whatyou can access. Access to critical or sensitive data should be restricted to those who need it. If you can't get to the data, you can't copy it. From there you need to hire people you trust. So pay them well and treat them well. If you can't do that, it does not matter what technology you have, it will be copied. Larger devices just mean that more data can be copied at a time.
Why do we say data is lost or has gone missing? Data is lost when your USB drive gets stolen, or when your hard drive dies. Data is missing when someone copies over data, deletes the source file, and wanders off with it.
Data isn't "missing" or "lost" if someone makes a copy of it.
-stormin
The Southern Baptist Convention has creationism. On Slashdot, we have porn.
Is it so difficult to disable the USB ports ?
Its a standard policy to disable floppy, CD-RW, USB, COM, LPT etc on a machine having sensitive information.
God created man in his own image, but somehow he evolved into a hairless monkey.
Deja vu...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
You can implement read-only usb drive access with a policy using either Group Policy Objects or the Windows System Policy Editor. The registry key is:
c ePolicies
HKLM\System\CurrentControlSet\Control\StorageDevi
Value is:
WriteProtect - REG_DWORD of 1 or 0 (1 = read-only)
I am going to update my policy template for the NT4 System Policy editor soon (in a few days) - You can download it at
http://www.pcc-services.com/custom_poliedit.html
When talking about copying data against the data owners permission... If it's corporate data, such as peoples social security or credit card info from corporate records, it's theft. When copying music, it's copyright infringment - not theft.
Maybe it's because we (including myself) view the RIAA / MPAA as thugs and therefore not deserving of the same protections.
Of course there is also a difference of published versus unpublished information, so it's not quite the same, but still...
Just making an observation (devil's advocate style).
The same issues were hashed around then and the floppy carriers won. The USB carriers might not be so lucky. If you are working in a Microsoft shop, your luck is already bad and you should expect more of the same.
Friends don't help friends install M$ junk.
Wearing usb drives on the lanyard that comes with it can be hazardous to your data.
I've actually lost 2 USB Drives during close encounters with Beer.
Score:
Beer - 2
Me - 0 (luser)
-----BEGIN PGP SIGNED MESSAGE-----
/mnt/usbdrive must be encrypted
;-)
9 uvLMmCyjRJNmzPW BjkMIfoUxoXWXU4 tcuDaquRL8KYRhB 8fDscdCJeLMw9ge IhOXmQqUGDbKNyP K7aw==
Hash: RIPEMD160
Lam1969 wrote:
> the possibility of companies breaking laws, whether for data-loss
> disclosure or regulatory compliance, is growing dramatically.
This is exactly the sort of scenario I had in mind when I designed
eCryptfs:
http://ecryptfs.sf.net/
Admins in the IT department can deploy an eCryptfs policy on employee
workstations that indicates, for instance, that any data written to
external storage devices is automatically and transparently encrypted
according to a certain cryptographic context. We are working on
implementing full policy support by the end of the summer, but in the
meantime, eCryptfs will at least provide mount-wide passphrase
protection today. For instance, eCryptfs will be able to be told, via
IT policy, that ``any data written to
with a public key with a certain ID, which is dynamically retrieved
from the corporate PKI at the time that the file is created.'' For a
preview of how we will go about doing this, check out the
``experimental'' branch from the CVS repository. In the meantime, if
you want something functional today with only mount-wide passphrase
support, get the ``testing'' branch. The tarball and the main branch
will work too, but the ``testing'' is where I keep what I consider to
be the most interesting version (it usually takes a week or so for
changes in ``testing'' to migrate to the main branch).
Oh, and it's Linux only. Of course.
Mike
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iQEVAwUBQ9YyvdtAhTFtyodpAQN44QgAlr2+8KF5kIu5b4b+E
NTZ3Mz/Sq06gCzC7KddWWO6J5ivlW59EOV0qxPaNEFGnAgatF
N7b5Un/g/Ag5Et2kLKze8X+b1eAJlbtcl6kJXkc5SF/GDxsU7
K4Nx7+3CelIUVJ9c2/QPbooxb0yOfQnvncfA75RqLG8GwemSG
K/Y3l1U6FANWrxeH/PCwgZ+4AoLjRBWQBPD3TefhIV05m4kiy
qqWEcD8T+M0bOOdkEB2ZiwgRPI1sqwR1wh0RxOTbWnDGuJMUE
=gtQd
-----END PGP SIGNATURE-----
An unjust law is no law at all. - St. Augustine
They didn't have USB thumb drives then, and I don't know whether they would count as "active" or "passive". I never saw what they did to ensure that the trash, both computers and media, was data wiped before leaving the building. Could have been interesting.
Between using a USB drive and a high-speed internet connection? Or ten years ago when file sizes were still reasonable, using a floppy?
because this isn't an IT problem. This is a personnel problem, and possibly a policy problem. This belongs on a management website, not an IT context.
There exists no way of exchanging information without making judgments. --Bene Gesserit Axiom
-Eric
SJW: Someone who has run out of real oppression, and has to fake it.
There are two different things mentioned in the article that I think make the article less than what it should have been.
The first one is data being compromised. There's a clear example when the author found a USB drive in an airport. (He could read it without problems). The second one is data loss, also mentioned. The author mixes both concepts when he compares the loss of a USB drive (assuming it's not backed up) with the loss of records by a big company (that would probably be compromise).
Even though they look like the same problem (if I put all my important data in a standard USB drive, if I lose it the data gets lost and compromised at the same time), they're not. These risks are mitigated with different methods. When you start taking steps against either data loss or compromise, it is shown that the author's definition of "data loss" is not that clear.
Imagine I had all my important data on a USB drive, encrypted (but without backups). If I lost said drive, I would be left without some important data, but it would have not been compromised.
The opposite would have happened if I had backups, but no encryption.
If both encryption and backups were available, if would be (under most circumstances) a non-issue (except for the loss of a USD 20 drive).
All of that assuming the drive owner is honest, and not using it to smuggle data out of a secured area.
The author seems to treat data as a physical object, which is not.
GPG 0x1B479C78
We had a client at one of my previous jobs who explicity banned USB jump drives from the workstations they would be using. So, after a few seconds of head scratching on how to do this I:
.inf file that Windows provides and,
* Disconnected the USB ports and,
* Disabled them in the OS and,
* Removed the USB flash device
* Padlocked the case shut.
It takes a few moments per machine and should be part of the standard build for any business that cares about their data.
There is always encryption programs that can be used if implimented properly. Truecrypt(http://www.truecrypt.org/) axcrypt, bitht from sourcefordge. Plus I am quite sure there are a few commercial alternatives that offer support as well. Point is, its not USB drives that are the problem, its the lack of a proper usage policy to control how they are used. Requiring all USB drives to be fully encrypted and/or haveing all data they contained backed up elseware would be a good start. Its all about policy and educating your employees on your companies acceptable use policy for such devices.
Because of this causal attitude towards USB keys, it'll become near impossible to track all the data. Employee X copies Spread Sheet A onto a key, takes it home to work on it, brings it back, and tosses the key back in the pile. You now have an unaccounted for instance of that data. Each time an employee does that, you have more and more instances of data that are unaccounted for.
The problem is that 99% of the data you speak of is either public knowledge or rather useless. Unless we are talking about the DoD projects, information sensitive to stock trading, or HIPAA restricted patient information then internal memos and performance reviews aren't exactly critical to loose or even fall into the wrong hands.
If you do have something with the aforemention security related issues then you need systems that prevent such data loss with encryption or other security schemes.
I'd say in what I do for a living, the majority of the information I assist with is actually useless Excel spreadsheets that only results in being put into powerpoints to prove to upper management they deserve not to be fired. It wouldn't kill anyone to loose that information.
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
If you want to turn off USB drive access on XP, this command will do it:
sc config usbstor start= disabled
To turn them back on, use this:
sc config usbstor start= demand
Be sure to include the space after the equal sign. You can get sc.exe from the Windows 2000 Resource Kit as well.
http://support.microsoft.com/?kbid=166819
which is why I always terminate the monitoring software before using mine =) I love local admin rights...
"Your mother's a bloody liar... That's what I liked about her." - Yellowbeard
I bet it's leased, or at minimum you make payments.
-- www.globaltics.net
Political discussion for a new world
My company's had a policy for almost a year on those: you can't use 'em. They've used the feature in XPSP2 to disable flash drives and that's that. Out of 13k users, there's a very slim minority that need flash drives, and they're given the ability via a GPO. It took about 15 minutes to figure out how to do, and 20 minutes to replicate across the whole domain. Done. Next earth-shaking disaster, please.
Which is more painful? Going to work or gouging your eye out with a spoon? Find out!
http://www.workorspoon.com
imagine it, a whole new vector for virii and trojanware.. drop USB keys on the bus- wherever..
with autorun.inf-- install whatever....
do you know how cheaply you can pick up 1000+ 16mb usb keys?
every day http://en.wikipedia.org/wiki/Special:Random
I don't believe a guy like that can write in a newspaper! Just shut it !
People have to read before writing! All IT security procedure adress this thing since before y2k !
Ceci n'est pas une Signature !
In the future if videographic (photographic+audio) memory becomes a "default install" in humans, what are organizations going to do?
;). And you must be quite a special case for all that effort eh?
Only hire humans without videographic memory? Such organizations will be at a greater disadvantage then.
Install DRM into such humans to prevent them using their memories in certain cases? Ugh. Solution seems a lot worse than the problem.
Anyway, the article is _crap_. There are quite different issues, by mixing them all together the author just confuses the matter. Maybe the author has an agenda and is just scaremongering people for some strategic/tactical purpose but perhaps I'm being too cynical (but hey he apparently is Principal Analyst with 35+ years experience blahblahblah).
In contrast, I'm just some slashdotter, but here's my 2 cents worth:
The issues are:
1) Data loss
Solution = backups, backups, backups.
2) Unauthorized access to data
Solution = Only allow trusted AND competent personnel access to critical data, and use encryption accordingly.
3) How do you know who can be trusted (and is competent[1])?
Solution = only time and proper testing/observation can tell.
If you still can't figure it out then perhaps you yourself aren't competent enough to run your organization. If someone can't be trusted with little you can't trust them with a lot.
Y'know even if someone nefarious sneaks into your organization behaving like a model member for 15 years, gradually gaining increasing amounts of trust, only to betray you in the last year, you'd have got 15 very good years from that person
4) "Will you even know?"
Solution = Watermark data, and maybe even generate fake databases.
Even better if you can give different employees different distinctive data. This way if data leaks, there's a chance you'd know that it's from your organization, and perhaps who it came from.
For example the To and CC fields in most SMTP based email don't count for anything, so you can actually send each group[2] a different email, and there are ways to mark the email without changing the meaning too much (or even at all). I'm not sure of any email client that does this, but it sure is possible. You may also use different key phrases when composing your messages.
[1] A person may have a higher than average level of integrity, but they could just be incompetent/weak in some areas, so you still can't trust them for some stuff.
For example, though your Aunt May might be a genuinely trustworthy person, she might be incapable of locking down her computer securely so that the messages you send to her will never be leaked, and she might be incompentent at judging her competence in such things. So it may be wise to just not send messages to her via her computer, and just pass information via other means.
[2] Say you start with 3 groups, and then you "rotate" people around through those groups. That way you might eventually find out who's the leaky untrustworthy/incompetent person. There are other ways too, go figure it out yourself.
the answer is...Version Control on independant machines, which is important, as MS Word has a form of VC but that's in the document on the machine. If you're data is that fscking important, make access to this data only through a Version Control system. Simple. Data will always be lost somewhere. People are, well, people. It's just how it is. Banning stuff is silly. You might as well learn to cope with it.
Patriotism is a virtue of the vicious
...mini-CDs do pretty well - they're certainly enough to carry the HR personnel database home.
And this would probably be even sneakier. Just slide it right into a card sleeve in your wallet.
Remember, it's all in fun until someone loses a finger!
There are plenty of other mechanisms to steal data. My phone is bluetooth enabled. I wonder if I wandered around if I might find something to connect to. Or if I put a Bluetooth USB key in the right machine, what might I find? I can add 512MB of microSD memory to this phone, and send Emails from it. It might take a little time, but I could probably get a LARGE amount of data in an average week.
Or what about wi-fi? How secure are most places who use that? Or how about more old fashioned ways like the people hacks or just printing the stuff out and putting it in your briefcase (or your socks)?
I think the bottom line is that employers should treat their employees decently and hire trustworthy people. I can think of all these malicious things to do, but I don't really have a desire to kill the goose who is laying my golden eggs so I can't see myself doing any of them. I'm also pretty happy with my employment overall. There's no bulletproof security, but treating people like crap goes a long way towards asking to be screwed back.
If a business division is working with especially sensitive data, perhaps they should not be working on PC's at all. That might be a job for a thin-client/dumb terminal with no drives or ports (other than ethernet, video, and ps-2 keyboard/mouse).
Sun has been pushing thin clients for years and some of their major selling points have been security both from the data sensitive aspect and security from the user-can't-break-it aspect.
Earth From Wikipedia, the free encyclopedia. Revision history Jump to: navigation, search (Latest | Earliest) View (previous 50) (next 50) (20 | 50 | 100 | 250 | 500). Legend: (cur) = difference with current version, (last) = difference with preceding version, m = minor edit * (cur) (last) 15:54, 24 January 2006 god01 (reverted vandalism from satan666) * (cur) (last) 15:53, 24 January 2006 satan666 (c'mon let's be mature) * (cur) (last) 09:36, 24 January 2006 god01 (rv edit by satan666) * (cur) (last) 09:33, 24 January 2006 satan666 (pestilence) * (cur) (last) 01:03, 24 January 2006 god01 m (Reverted edits by satan666 (talk) to last version by god01) * (cur) (last) 01:03, 24 January 2006 satan666 (famine)
Where I work we have no policy concerning flash drives. Many use their own personal drives because they have one attached to their keychain and it is easier than going to the boss and getting the company to buy one. Perhaps what is needed is a policy that mandates company-owned drives that are only used at work for company business and disallow the use of personal drives. We already disallow personally-owned computers at work so why do we allow personally-owned flash drives?
How about supporting not one read() but one session? I.e. lock after unplugging, not reading the data? Top it off with encryption (not neccessarily hardware assisted but it'd be nice for OS compatibility). Off to the patent office you go! :)
Still, it'd be a solution looking for a problem. You want to steal data, you will.
Pavlov. Does this name ring a bell?
Only a bureaucrat would think a policy would change anything. Most places they don't even get read. My employer has a mechanism to force us to read policies, through logged online training. Still does absolutely nothing to ensure compliance.
The issue is lack of policing, not lack of policies. And specifically whether and how to police.
My girlfriend and I were recently at a conference in Europe (she spoke, I puttered around the city for a week drawing cathedrals), where I got the chance to read some of the posters. One was particularly interesting, but I don't have the proceedings in hand so I can't find the title.
In any case, it was basically proposing the need for people that had access to large sensitive databases to be granted access to everything, but they had a daemon watching over them that detected aberrations in the pattern of access and notified a supervisor or locked them out of the database.
For example, you could have someone doing single-user lookups all day as they service customers, then their terminal starts generating lookups for huge ranges of people with full information. The daemon would recognize this and slow down their query rate, lock them out, or call a supervisor. This daemon also logged access, but it only logged what it termed to be unusual patterns of access. It also was able to watch who worked on a file or directory, and it had figured out something as unusual if a person accessed a file at a time outside the ordinary, or (especially cool) if someone accessed a file when other members of the team weren't logged in.
I have no idea how they trained something like this daemon, but it was a neat use of an expert system.
'Be always mindful, even when ditch-digging.' --D. T. Suzuki
If you have data that can not be compromised use a thin client or store your "data" on a remote share like SAMBA that people need to log into. Or you can have your admin go to each PC let say all 3000 of them and password protect the Bios and disable any USB devices and then listen to all the users whine and cry. I vote for a remote share or a thin client.
Tivoli (and other products) has mechanisms to enforce policies.
The hard part is making the policies... some PHB reads on glossy paper that if you buy this product or that product it will solve these problems. So he gets out the company check book, buys the product, tells dilbert to install it, and considers the issue resolved, without ever attempting to define what the issue was. We have lots of technology that can be made to enforce the policies. The tricky bit is defining what rules should be chiseled into the shifting sands. Heck, the few of us that read the article can't even form a concensus here about what the issue is, the original owner not having the data anymore or somebody else having. Storing master copies on a server rather than a watchfob would solve the former and strong encryption would go a long way to resolving the later.
The fundemental root of the problem is that the descision makers and policy setters frequently don't understand all of the ramifications of the issues.
"I don't see what the big deal is. Huge companies have had really really really important data stolen with no real effect or punishment."
YET. Considering things like Sarbane-Oxley and new rules for medical records losing or misplacing data matters. It costs money to comply with those rules. And if you lose data you shouldn't, it can cost more money. You also might say that some expensive rules come in to being BECAUSE other companies have mishandled data.
"In the time I was there, I never heard of an inadvertent loss or disclosure of confidential material, aside from one laptop that was stolen. (And in that case the employee wasn't to blame, he was mugged, or so I heard.)"
Actually you did hear about it. The laptop was stolen.
There are two issues here. First is the deliberate taking of information. Second is the inadvertant loss of info or the loss of the ability to track info. Either one can be very bad. The first is easier to deal with.
Lots of organizations have trouble tracking data which can be a serious issue. How many organizations can say with certainly that we have X copies of this in Y locations. Imagine a lawsuit....
It will only get worse when there are simpler ways to cart information around.
your keys did not 'go missing'; you lost them
One word, HIPPA.
This isn't the answer. There's still floppy disks (ugh!), CD drives (lots of PCs come with CD writers nowadays), printing of documents and {screendumping, emailing} of documents.
You're right, it's not. The original article raised the wrong problem - teh 3vil USB, instead of focusing on the actual problem - tracking and controlling access to important data.
The tools to do this have existed for a long time. But to deal with it you need to be aware of the problem (or at least to have done a risk-assessment of the problem), and have the necessary will (management backing, legal necessity, etc) to do something about it.
Or, to put it another way, "Not knowing what you're doing may cause you problems later on."
-EvilMagnus
Nope, still 75 on Interstate, 65-70 on state highways.
Unless your company is not a prison with letters and phone calls prohibited and all
employees are prisoners, it is impossible to prevent that data leaves Your company.
Examples:
- e-mail (encrypted, hidden in other "meaningless" data)
- paper sheets (carried away, not shreddered)
- disks, laptops, USB sticks
- peoples memory(!)
It is a mistake to believe that the amount of data (e.g. the 10GB mentioned in the article)
is equivalent to the importance of the data.
Leaking out a single number can be fatal for the whole company:
"What will be the price your company is going to tell the customer?"
"1.500.000"
The next day, the customer receives a similar offer stating 1.420.000 from a competitor.
About 10 Byte of data can change the direction of one and a half million dollars.
see also: http://www.heise.de/ct/english/99/04/174/
As others have pointed out it is not an issue of "usb drives." Before high capacity flash drives there were USB harddrives, ipods, DVD burners, CD-Burners, http file upload, e-mail, ftp, and does anyone remember floppies. Sure a floppy only holds 1.4MB, but have you tried zipping your oracle database? Those compress REALLY well.
If companies try to crack down on this too much it will cause problems with performing backups of data on PC's. Most companies have no, or bad plans for backing up data on PC's and laptops. If they spend too much time trying to keep information from walking out the door, they might find themselves the victim of data loss from harddrive failures.
Think Deeply.
Important Theological Questions That are Answered If We Think of God as a Computer Programmer.
.tar files is a major hassle, so if there is a request for you, God will just say that the tape has been lost.
Q: Does God control everything that happens in my life?
A: He could if he used the debugger, but it's tedious to step through all those variables.
Q: Why does God allow evil to happen?
A: God thought He eliminated evil in one of the earlier versions.
Q: Does God know everything?
A: He likes to think so, but He is often amazed to find out what goes on in the daemon scripts.
Q: What causes God to intervene in earthly affairs?
A: If a critical error occurs, the system pages Him automatically and He logs on from home to try to bring it up. Otherwise things can wait until tomorrow.
Q: Did God really create the world in seven days?
A: He did it in six days and nights while living on Jolt and candy bars. On the seventh day He went home and found out His girlfriend had left Him.
Q: How come the Age of Miracles Ended?
A: That was the development phase of the project; now we are in the maintenance phase.
Q: Will there be another Universe after the Big Bang?
A: A lot of people are drawing things on the white board, but personally, God doubts that it will ever be implemented.
Q: Who is Satan?
A: Satan is an MIS director who takes credit for more powers than he actually possesses, so non-technical people are scared of him. God thinks of him as irritating but irrelevant.
Q: What is the role of sinners?
A: Sinners are the people who find new and imaginative ways to mess up the system when God has made it idiot-proof.
Q: Where will I go after I die?
A: Onto a DAT tape.
Q: Will I be reincarnated?
A: Not unless there is a special need to recreate you. And searching those
Q: Am I unique and special in the universe?
A: There are over 10,000 major university and corporate sites running exact duplicates of you in the present release version.
Q: What is the purpose of the universe?
A: God created it because He values elegance and simplicity, but then the users and managers demanded He tack all this senseless stuff onto it, and now everything is more complicated and expensive than ever.
Q: If I pray to God, will He listen?
A: You can waste His time telling Him what to do, or you can just get off His back and let Him code.
Q: What is the one true religion?
A: All systems have their advantages and disadvantages, so just pick the one that best suits your needs and don't let anyone put you down.
Q: Is God angry that Jesus was crucified?
A: Let's just say He's not going to any more meetings if He can help it, because that last one with the twelve managers and the food turned out to be murder.
Q: How can I protect myself from evil?
A: Change your password every month and don't make it a name, a common word, or a date like your birthday.
Q: Some people claim they hear the voice of God. Is this true?
A: They are much more likely to receive email.
Q: How can we interpret the Heisenberg Uncertainty Constant?
A: A manifestation of our machine's precision limit.
Q: What was Aramaic?
A: The original Higher Order MACRO Language.
Q: What does that make Ancient Hebrew?
A: Aramaic++
Q: Why don't we see God at work?
A: God works at interrupt level. When He wants to do something, He suspends our processes, saves our registers and status, and swaps us out. Then He works His will on the world. Then He swaps us back in, restores our registers and status, and resumes our execution. To us, things appear to change by magic.
With thanks for the anonymous person who posted this on the 'net many, many years ago.
If you can stay calm, while all around you is chaos... then you probably haven't completely understood the question.
I thought that all of the new contraversial features in MS Office were supposed to mitigate this problem? Heck, even a very simple encryption algorithm that's transparent to the user will reduce the impact of this problem because it greatly reduces the likelihood that a lost disk/key will be read.
No, I will not work for your startup
Turning off drivers won't do much good if your users retain the ability to boot from a liveCD such as Knoppix. Of course, you might very well remove CD/DVD drives or restrict boot devices in the (password-protected) BIOS, but those are additional steps.
I worked in a couple of Swiss banks for a few years building Windows trading systems. Yeah, yeah. I know. But the new trading app was Windows-based. Anyway...
The company policy on the trading floor (about the size of a football field) was anyone caught with a Natel (read: mobile phone) powered-on was immediately sacked. And immediately meant security locked down the system, locked the desk, telephoned the police, etc. Not a pretty sight I bet, but I never heard of anything like this happening while I was there. Only told about it before we started working on the floor.
All trading goes through the bank's special trading phone system, which is recorded for security and banking reasons.
Since the two of us, who built this system, sometimes needed to go onto the floor, we were exempt from this rule.
Of course, before taking this job, I sold out of all my stocks just to be on the safe side. Ok, maybe I made a bit of money but Apple was then at about USD 15.00. Oh, well.
If you can stay calm, while all around you is chaos... then you probably haven't completely understood the question.
Yet another reason I think SOX considerations will lead to a resurgence in Thin Client computing. How thin, and what form, still to be decided.
Something on the fat side, running Linux, with the local storage being used only for caching, paging, etc. would be my preference. However, even if you returned to PS/2 user interface connections and left off USB, this would only result in somebody developing PS/2 thumb drives.
Ultimately it comes down to hiring good people, treating them well so they're less likely to rip you off, and prosecuting the holy crap out of them if they do. Some of them will still rip you off.
After all, what's cheaper; paying 20 people to develop an innovative concept, or paying one of those 20 to steal it from his employer and give it to you already-developed?
Of course, the words of Asok the Intern (from Dilbert a few years back) pretty much sums the whole thing up:
"If I spent my whole life looking, do you think I'd find anyone who cared about this document marked 'Proprietary'?"
Quite!
It's all about risk assessments. The 'average' office worker knows nothing of liveCDs, or even anything about the typical Windows boot process; therefore, the largest risk comes from regular users plugging their iPods into Windows boxes, and copying stuff across. The easiest fix for that is to switch off the USB ports (either in BIOS or using System Policies). It's a small action with the largest potential gain.
Smarter users might try to gain local disk access with a bootCD of some description. There's ways to prevent that, too - removing the CD drive and floppy from the machine, for example, disabling IDE channels and USB ports in the BIOS, and physically securing the case. It's possible, but is a lot more effort to guard against a much smaller risk.
Security is hardly ever absolute. All you can do is decide how much time and effort you want to spend on it. The first step is a risk assessment by knowledgeable professionals. From the article, it seems that most companies haven't even done that. It's hard to address a problem you don't know about!
-EvilMagnus
OpenVMS auditing showing the image that generated the request, and if I dig through SMF I can usually tell how the dataset was accessed under MVS (ala z/OS)
first some companies already ban them. I have read that the new windows will have the ability to lock out usb drives,
Does the term "data loss" seem to anyone else to represent losing your only copy of important data? It's not being lost, it's being stolen or copied. It's "data theft" or "data misuse", you're either stealing it or misusing it.
I see your point, but the physical loss of laptops was anticipated. The most sensitive data on the hard drives was encrypted fairly well, and based on the circumstances of the theft it apparently didn't seem targeted. As I said, it was a mugging. Could it have been a targeted setup, made to look like a random mugging? Possible, but what was on there wasn't worth that much.
Obviously, an organization needs to weigh the increased flexibility that portable computers give, versus their tendency to be targets of theft (and more often than that, their tendency to get damaged, requiring more robust backup strategies than desktops). In our case, I can only assume that the determination had been made that, equipped with encryption as they were, that the laptops were worth the risk.
Could the organization, today, say conclusively with 100% certainty that the information was never recovered from the lost laptop (provided it was never recovered -- I don't know what happened)? No. But I think it would be equally untrue for them to say that about any piece of information that was sent over the Internet in encrypted form: you can't prove that someone with a lot of computer power wasn't monitoring everyone's communications and intercepted it. It's just a extremely low probability. Eventually, someone just decides that the chances are low enough, and both as individuals and as an organization, you stake your reputation on that.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
"YET. Considering things like Sarbane-Oxley and new rules for medical records losing or misplacing data matters. It costs money to comply with those rules. And if you lose data you shouldn't, it can cost more money. You also might say that some expensive rules come in to being BECAUSE other companies have mishandled data."
Lets be real companies just give lip service to complying with regulations. If they get caught with their pants down the govt slaps their hand with a wet noodle and goes about their way. Again see choicepoint for an example.
evil is as evil does
I used to be in IT (boy do I miss it) and now I'm in accounting (you know, what I actually studied in college haha). Anyway, I had to report some strange goings-on to the IT dept here at my company and they blamed it on my external hard drive... now I know that my harddrive (which uses basic windows drivers) isn't crashing Adobe, but THEY think it is... (the problem is actually TrackIT) my point is, my harddrive is against company policy. Nice of them to tell me over 6 months after I started here instead of the first time they noticed the device (about 5 months earlier). I just want to listen to my music while I work, and since the CD-ROM drive = crap I can't do it that way lol. *sigh* Information theft/loss is going to happen with or without USB devices, so maybe proper security would be something companies should invest time/money into? Just a thought :-P
I'm actually in the west. I do originate from the UK though (10 years ago I moved here). ... you know the type it's either not moving or it's moving too quickly.
:-)
What's worse is that I've had a fair amount of engine, intake and exhaust system mods done, not to mention new lumpier software for the ECU.
In traffic around town it's a bit digital
Out on the freeways I usually stick to about 80, I have aq good radar detector that has kept me in good stead.
I forget what the original topic was that I was ranting away at, but hey, I get back from the pub at 2am and see some dufus talking before thinking and decide to take a potshot.
Yours was one of the first that actually didn't take offense to my rantings.
Actually, nope.
I paid cash.
Like I said, I own my own business and make more an hour than most do in a day.
This is not my first sports car, I don't recall when I last had something more average.
I really like the CGT, but really cannot justify the $440k (without dealer hike) ticket on those, but 205mph does sound great to me.
The best I ever managed was 196mph (obviously not in my current ride, they're good for 175-180), I'd like to break the 200 at some point.
I was half joking about the loan ;-) I bet you have fun zooming around on track day. I use to do that at Wakins Glen years ago.
-- www.globaltics.net
Political discussion for a new world