Another UK council has had to sign an undertaking with the UK Information Commissioner’s Office (ICO) to better safeguard its data after an unencrypted USB memory stick was lost in the post.

The device, lost by Shropshire Council in England, contained personal and health details of vulnerable members of the public, and of members of the council’s own staff who were working in the sensitive adult social care department. It was being sent by post from the council to a contractor in Cardiff.

The ICO said the loss breached the Data Protection Act, and the undertaking the council has signed requires education of staff on data security, and encryption of portable and mobile devices used to store and transmit personal data.

These incidents show the need for always-on, mandatory protection of data written to removable media: protection which is delivered from use of our Cruzer Enterprise range of secure USB flash drives.

We’ve all lost things at some time in our lives – car keys, wallet, mobile phone – and have experienced the frustrations this can cause.  Some might have lost things like laptops, and had to suffer the problems of paying for a replacement, and the loss of useful information that was on the device. 

These problems are irritating, but usually don’t cause much more than minor inconvenience.  If only it was the same in the business world.  That laptop loss, or loss of a USB flash drive, could be just the first of many problems.  Does the business know what data was on that PC or thumb drive?  Did the user remember to encrypt the data?  What are the ramifications if the data falls into the wrong hands?

This article from Jon Collins, head of research company Freeform Dynamics, looks at practical, good-practice steps companies can take to minimise the fallout from device losses. 

It maps closely onto the benefits our secure USB flash drives and data management solution deliver to users – automated, transparent protection of data, the ability to track and audit what data has been copied to devices, and remote device termination.  With the right equipment, small problems will stay small.

The City Council of Manchester, England, has counted the cost of an outbreak of Conficker in its network earlier this year,  and it comes to a staggering £1.5M ($2.5M) according to a report in The Register. 

The Council was also prevented from issuing hundreds of motoring penalty notices after Conficker worm knocked out parts of its IT systems.  Drivers escaped punishment after the Council’s fine processing system was taken offline in February this year, causing 1,609 motoring offences to go unpunished. 

Infection by the worm left Council staff unable to send emails or print documents, and struggling with extra paperwork after they were obliged to keep additional back-up records in case data was lost.

Clean up costs and consultancy fees were estimated at £600K. In additional, council IT chiefs spent a further £600k on thin client terminals.  A further £169,000 was spent on extra staff needed to handle a backlog of benefits claims.

And the cause of the infection?  Council chiefs blame an infected USB memory stick, and have disabled all computer USB ports in response to the incident.  How much would have been saved by rolling out secure USB flash drives with on-board, integrated anti-virus to stop the infection spreading?

The Chief Technology Officer (CTO) for the State of Michigan, Dan Lohrmann, recently gave this revealing interview. 

In it, he mentioned that the state has cut its overall IT spend by around 20% to $400 million per year.  However, spending on IT security has doubled in the last five years.  Also, when asked specifically about the risks of USB flash drives for data loss and introducing malware, Lohrmann commented:
 
“Certainly, data loss prevention.  It doesn’t necessarily mean it is intentional, but it is the insider threat. People think they are doing the right thing by bringing a Word document home with them - maybe that has some sensitive information on it - and use a home PC; they can certainly bring a virus back into the enterprise. We do have some protection mechanisms in place on devices to look for endpoint viruses and things.”

It’s good to see this strong awareness of the need to protect mobile data is out there at the highest levels.  Hopefully we see data losses and leaks finally starting to diminish this year.

Here’s a useful article offering business travellers useful tips on how to secure their data when they are travelling.  It covers practical and safe methods to safeguard information on laptops, smartphones and removable storage media in airports and other areas where devices are easily lost or stolen.

However, one recommendation that demands caution is the advice to use free encryption software to protect data on laptop hard drives, USB flash drives and so on.

As we’ve posted here before, this approach gives a fair level of protection for data and is better than no encryption at all.  But it’s worth noting its shortcomings:  such software-based encryption is not “always on” – so the user has to remember to actively encrypt data.  Unlike the hardware encryption on our Cruzer Enterprise range of secure drives.

With a true secure USB flash drive, you don’t have to worry whether the data you’re packing is encrypted.

SanDisk Enterprise, a branch of SanDisk Corporation recently announced that their USB flash drives and Central Management & Control (CMC) server software has been selected by the State of Washington’s Division of Child Support (DCS) to protect confidential client data at DCS headquarters and in 10 field offices statewide.

DCS collects about $700 million per year in child-support payments and manages about 350,000 active child-support cases.

SanDisk Enterprise develops USB encryption in flash drives to allow users a password protected flash drive. This way, the user is ensured USB security at all times. Data is not compromised, and users can continue to use secure USB flash drives. Read More »