Home » Data Protection » Network Security

Industry View

The Thumb-sucking Threat

Joe Wagner, senior vice president and general manager of Systems and Resource Management at Novell, explains the security implications of all those popular portable storage devices.

By Joe Wagner

May 16, 2008 —

Thumb drives, media players and other portable storage devices have become widely accepted as tools that bring down costs while increasing employee mobility and productivity. For a mere $20, one can buy a USB device, easily transport data from a work computer to a home computer, and stay ahead of the game.

So small and seemingly innocuous, one rarely thinks about the security implications at hand; but the low cost and convenience of thumb drives could also introduce greater risk into the enterprise. The physical size and large storage capacity of these devices make them a potential data breach time bomb. For example, if a thumb drive containing business files is lost and lands in the wrong hands, there could be severe consequences. Even more terrifying is the potentialfor a malicious attack using these inconspicuous devices. In minutes, a rogue user can load proprietary files on to a thumb drive unnoticed and potentially expose a business to a massive data breach.

These acts can be referred to as thumbsucking - the intentional or unintentional use of a portable storage device to download confidential data from a network endpoint. It is one of the top causes of security breaches, yet it has garnered little attention while the threat continues to grow. According to the Identity Theft Resource Center, the number of publicly reported data breaches in the United States rose by more than 40 percent in 2007. However, even with fears at an all-time high,very few companies have put direct controls and policies in place to prevent these attacks on the endpoint.

Stay in Control

Thumbsucking is a huge threat companies face due to the proliferation of portable storage devices. As people increasingly use media players, BlackBerrys and external hard drives for personal and business needs, each device becomes both a friend and foe to the modern-day corporation. In fact, a 2008 Applied Research-West survey found that workers born after 1980 are 200 percent more likely to have corporate data on their storage devices. This threat becomes even more prominent when devices are not company-owned or issued, but can still be used to store and transport sensitive corporate data, leaving no audit trail or trace of what's been taken. Without control, portable storage devices present four major threats to the enterprise:

1.) They can allow users to bypass the perimeter and introduce malware into the enterprise.

2.) They can allow internal users to remove confidential information such as financial files, health records, and other intellectual property from the organization.