The UK Government’s data protection watchdog has recently criticised another health organisation for two incidences of data loss in early 2008, one of which involved the loss of an unencrypted USB flash drive. 

While this can seem negative, it’s an example of how attitudes to data security in the UK public sector are changing.  As a result of the Government’s data watchdog’s vigilance and willingness of organisations that have suffered losses to change, the English National Health Service is one of the most advanced in successfully rolling out DLP systems, including mandatory hardware-encrypted USB drives.

An excellent example of how this can be done is given by NHS Dumfries and Galloway, which earlier this year deployed 1100 SanDisk Cruzer Enterprise secure flash drives to protect confidential patient data.

An interesting point was that NHS Dumfries & Galloway didn’t just hand the secure drives to users:  they held an amnesty so that staff could bring in old USB pen drives containing confidential information for orderly disposal.

The organisation arranged distribution days where they travelled to its various different office locations to give out the new drives.  This helped to ensure that all staff knew about the amnesty, and had a chance to familiarise themselves with the organisation’s updated polices – an example of good practice for anyone planning a similar roll-out.

Two researchers at Carnegie Mellon University in the US have recently shown how a single piece of information can be used to commit identity theft, with a little unwitting help from the US Government.

The research has shown how to reverse-engineer an American citizen’s Social Security number (the key piece of ID data that lets an individual apply for driving licenses, credit cards, etc.) using nothing more than data from publicly available government sites, and the data users share with the world on Facebook.

They developed an algorithm which could guess the first part of the Social Security number, which is based on an individual’s date and state of birth, to 90% accuracy.  The remaining digits could then be cracked by random number generation, and then checked for accuracy in name and state against FaceBook listings.

It’s an excellent example of how a determined organisation or person could find and use information that could compromise sensitive data.  All the more reason to keep your data secured wherever it is.

Torbay Care Trust, an integrated community health and adult social care organisation in the South West of England, has chosen our Cruzer Enterprise secure USB flash drives to help protect mobile data stored on the drives from unauthorized access.

The organisation has purchased and rolled out 1000 Cruzer Enterprise flash drives. The drives will be issued to and used by all staff members, in particular those employees working remotely or transferring data between sites.
 
“We decided to deploy an encrypted USB solution across the Trust as data security breaches have become a national concern,” said Sue Fankhauser, IT buyer for Torbay Care Trust. “Our IT department felt that it was necessary to employ a best-practice solution to protect data against any potential threats and to reassure the public that patient data is secured. After evaluating numerous encrypted flash drives, we chose the Cruzer Enterprise flash drive because it met all of our security requirements.
 
“We also asked SanDisk to send us the USBs without any unnecessary packaging - which they were more than happy to do. As well as being environmentally friendly, this produced no waste at our end, helping to support our eco-friendly policies.”
 
Recent data security breaches within other Government organisations have led to calls for greater data security with transportable media devices, such as data sticks, and by deploying the SanDisk drive, Torbay Care Trust feels it is setting the standard for others to follow.