Big Problems, Small Packages (part 1)

    We're constantly hearing about data breaches in the news.  Many are due to external attacks as happened to Yahoo! or OPM.  Many others are caused by well-meaning staff or contractors who carry with them on laptops that then get lost or stolen.

   USB flash drives, often called thumb drives because they're about the size of your thumb, first hit the market in around 2000.  They had relatively little storage space and weren't cheap, but quickly became a security issue both for the potential to carry and load malware as well as taking data out of the office.  I remember discussions about this issue back in the early 2000s and some organizations were even thinking about using hot glue guns to fill in and block the USB ports on computers!  That would have been a mess!

   Before long the prices came down, the storage space went up and the problems multiplied.  Many organizations were not ready for how quickly these drives got integrated into every day work.

   Today we're going to focus on data that is copied on to USB flash drives and taken out of the office.

   The highest capacity USB flash drives we can find today are around 1 TB, though there are plans for 2 TB drives coming on the market before long.  Drives over 512 GB or larger are still pretty expensive.  But we know that prices of the high capacity drives will drop as new larger drives come out.

   To give you an idea of that size... 1 TB is about the size of 1500 CD-ROMs or 143,000,000 Word documents!  That's a lot of data potentially leaving your organization.

   So how do you combat this at your organization?  You don't!  We're not dealing with an adversary who's efforts need to be defeated.  These are well-meaning staff trying to get work done.  Always assume positive intent.

New Year = Same Stuff

   It's a new year, but the same kind of online problems we've seen over the past few years are still here and are more prevalent than ever.

   Here's a great video about this issue by Media Pro:
Don't Let Malware Spoil the Fun from MediaPro on Vimeo. (I can't embed the video here, but do click on the link to view it.)

   The video reminds us that malware can, unfortunately, be found in many places including:

• insecure websites
• email attachments
• browser add-ons
• USB sticks
• PDF files

   In additional to slowing down your system and causing it to not operate correctly, many kinds of malware try to grab your personal or work information.

   As we discussed here recently, your home computer defense toolkit should include:

• anti-malware software
• automatic updates

   But software tools are not enough.  You need to take action to protect your data and your computer:  Remember:

1. You didn't win!...If it's too good to be true, it probably isn't true.
2. Be careful with attachments, unknown programs, or files from USB sticks.
3. Keep your software up to date.

   Let's do what we can to keep ourselves, our data (and our patients', customers' and clients' data) and our computers safe in 2016!

When USBs Attack!

   Sometimes it seems that the more things change, the more they stay the same.  In information security, we've known for a long time that if someone can get physical access to your system, there's a chance they can get into your system.  Once an attacker has possession of your computer, laptop, tablet or smartphone, they can take their time and try multiple attacks.  We can take some preventative measures like encryption, but it needs to be implemented well.

   Of course, it's best to keep your portable devices in your possession!  But they do get lost or stolen.

   Unfortunately, there's more than one way for an attacker to physically get to your system.  If you've ever been to a conference, or a state fair, or just about any kind of gathering with give-aways, you've probably seen free USB sticks (also called thumb drives).  These supposedly have programs, games or advertising files.  And they usually do.  But they can also contain viruses or other malware.  To make matters worse, USB systems have an auto-run feature to make (legitimately) running these files "easier".