A lowly USB stick, just laying there in the entrance of your work place or in the car park. What harm can it do if you pick it up and put in your pocket? Not much, I hear you say ...
There may be important information contained within the files. It might be a USB drive dropped by a politician, or military secrets worth millions of pounds and you can cash in by being a loyal and good citizen and handing it into the authorities.
More often than not, this scenario has caused chaos and mayhem within organisations as Cybercriminals have deliberately planted 'lost' USB drives with viruses and malware that allow hackers to gain access to passwords. Corporate data can then be seized for ransom and to make demands to large sums of money from businesses and organisation alike.
The viruses, ransomware and malware embedded in the files or documents that you may look through is not always apparent, should you decide to have a peek at the USB drive that you may have picked up from outside.
The United States government itself has fallen victim to flash drive attacks. In 2008 an infected flash drive was plugged into a US military laptop in the Middle East and established a digital 'beachhead' for a foreign intelligence agency. The malicious code on the drive spread undetected on both classified and unclassified systems enabling data to be transferred to servers under foreign control.
USB drives are a real conundrum for the security industry. They play a leading role in how operational environments function, but can also cause incidents if they are managed or handled improperly. They are also one of the most coveted means of attack by cybercriminals.
I'm sure you've seen many a Hollywood movie of a hacker plugging in a USB drive, automatically downloading folders of confidential documents, pulling out the USB drive again and running out of the building. The stolen data is then used by the hacker 'heroes' to bring the victim down a peg or two!
In any organisation, standardising the types of storage devices that are used daily, along with people being trained about the significance of not inserting random USB drives into company devices will help reduce the threats of company networks being attacked by malicious worm programmes. Locking down or disabling USB slots on computers will help too.
There is also a risk of USB drives being stolen, viruses, worms or other malicious software being embedded and then returned without any detection. USB drives are used extensively in many, many applications, including industrial automation. One quote from a manufacturing company indicated that, "We prefer to take the risk of using USB drives rather than take the risk of blocking production".
To combat the problem, technology companies have been developing a new breed of USB drive with PIN codes and Cloud Management systems for the issue and tracking of any memory sticks throughout a company.
But this will not stop the 45% of employees who find a memory stick in the car park and plug it into their work computer just because they're curious. So, education, education, education is the most important lesson as well as locking down your computers as much as possible.
To USB or not to USB? It's a real question.
If you feel inspired to find out more then do call me on 07555 807700 or leave a comment below and I'll be in touch as soon as I can.