Not everything is saved on the cloud yet. Removable media devices like USB drives and external hard disks are still an integral part of the world of IT to transfer files, share data, and take work home from the office.
They’re still convenient—which is not the only thing that matters anymore considering that with convenience comes risk. Especially when it comes to internet security. Removable media can be a significant security threat if not handled carefully. In this blog post, we'll explore the various security risks associated with removable media and discuss effective strategies for avoiding them.
What is a removable media device?
A removable media device is any type of external storage device that can be easily connected (and disconnected) to a computer for data storage, transfer, or backup. These storage devices are designed to be portable and can be carried around conveniently to and from various locations. They typically have limited storage capabilities compared to internal hard drives but are useful for transporting data conveniently.
Common examples of removable media devices:
- USB Flash Drives (thumb drives or USB sticks) – Typically used for transferring files, carrying documents, or creating backups.
- External Hard Drives – Offer larger storage capacities and are often used for data backup, media storage, or expanding a computer's storage capacity.
- SD Cards and MicroSD Cards – Small, flash memory cards commonly used in digital cameras, smartphones, tablets, and other devices to store photos, videos, and data. These can also be inserted into card readers for data transfer to and from computers.
- Optical Discs – Less common now, optical discs like CDs, DVDs, and Blu-ray discs, are used for storing data, music, movies, and software. An optical disc drive (read: more hardware) is needed for reading and writing data to an optical disk
- External Solid-State Drives (SSDs) – Fast and reliable storage typically via USB or Thunderbolt connections. These are most often used for data backup, media editing, or running applications.
5 Risks Associated with Removable Media
Removable media devices are versatile and convenient but also pose security risks if not managed properly via data backup, ITSM systems, or data encryption. It's essential to take precautions to protect the data stored on these devices and prevent any potential security breaches since they’ve become a popular target for cyberattacks due to their prevalence and the ease with which they can be manipulated. The 2022 Honeywell Industrial Cybersecurity USB Threat Report found that “52% of threats were specifically designed to utilize removable media, up from 32% the previous year.” Of the reported threats in the 2022 Honeywell report, 51% were designed to establish remote access capabilities to the organization.
Common security risks associated with removable media:
- Malware Transmission - Malware, one of the most significant security risks posed by removable media, can easily spread through infected USB drives or other storage devices. Infected devices that are connected to a computer or network can infiltrate and compromise the system's security.
- Data Leakage - Sensitive or confidential information can be easily copied onto removable media devices and inadvertently shared or lost by the one responsible. This loss of the device can lead to data breaches, financial losses, and damage to an organization's brand.
- Unauthorized Access - Even if the data is encrypted, attackers can still work to crack the encryption and gain access to valuable information on the lost or stolen device.
- Physical Damage - Dropping a USB drive or exposing it to extreme temperatures can render it useless and potentially compromise the data stored on it—leading to data loss.
- Compliance Violations - Failing to properly manage removable media can lead to non-compliance with industry and organization-specific data compliance regulations that could result in legal consequences and financial penalties for the parties involved.
10 Strategies for Avoiding Removable Media Security Risks
It’s obvious keeping removable media devices secure and on-hand when transporting from one location to another is crucial to your business. Here are some additional effective strategies for avoiding these security concerns:
- Endpoint Security Solutions – Designed to protect devices (e.g., computers and servers) from malware and other cyber threats, endpoint security will help detect and prevent the spreading of threats from removable media devices. It’s advised that you regularly update and configure your company’s endpoint solutions to ensure optimal protection.
- Educate Employees – Invest in training solutions to keep your staff aware and informed about the dangers of using unauthorized or unverified removable media devices. Staff should be encouraged to report any suspicious devices or files and provide guidelines for safe usage. (TIP: Build this into your employee onboarding!)
- Implement Device Control Policies – Regulate the use of removable media with device control policies. Policies can include rules for connecting external devices, mandatory scanning for malware before data transfer, and procedures for reporting lost or stolen devices. Employees need to know what they can and cannot do to keep everyone safe.
- Encrypt Sensitive Data – Always encrypt (encoding data so it’s protected and can’t be read or accessed if it’s stolen) any sensitive data stored on removable media devices. Encryption adds an extra layer of security that ensures, even if the device is lost and a hacker tries to access it, the data remains inaccessible without the encryption key.
- Update Software and Firmware – Set up a system (i.e., a calendar or IT automations) to keep your operating systems, antivirus software, and device firmware up to date. Developers frequently release security patches and updates to address vulnerabilities. Reduce the chances of exploitation through known security flaws by constantly updating when a release is pushed.
- Strong Password Policies – If your devices support password protection, use it. Make them strong – 30% of internet users have experienced a data breach due to a weak password – and unique. Additionally, they should be regularly updated (can be done via automated reminders), while educating employees on the importance of not sharing these passwords.
- Buy From Trusted Sources – Only purchase removable media devices from reputable sources to reduce the risk of receiving counterfeit or compromised devices (for example a device that has a virus or malware installed on it). Cheap alternatives can also lack essential security features—posing a greater security risk for your organization.
- Scan Removable Media Devices – Run your removable media device through an antivirus scan before connecting it to your computer or network. Doing so will help detect and quarantine any malware present on the device – this will help prevent the spreading of malware.
- Implement Data Loss Prevention (DLP) Solutions – Implementing DLP solutions to monitor and control data transfers to removable media will help prevent sensitive information from being copied onto unauthorized devices.
- Removable Media Device Inventory – Keep track of all removable media devices within your organization by recording their serial numbers, purposes, and assigned users (or when checked out and returned if used on a borrowing basis). This log of inventory will help you quickly identify any missing devices and assess the potential associated risks.
To safeguard your organization and personal data from the risks associated with the convivence of data sharing using removable media devices, it's crucial to adopt a proactive approach to removable media security. By implementing the strategies outlined in this blog, you can significantly reduce the chances of your organization falling victim to malware transmission, data leakage, unauthorized access, and compliance violations.
Cybersecurity is an ongoing process, but the faster you get started and begin to make changes, the safer your digital environment will be -- protecting your company’s profits, as well as the well-being of your customer’s data.
Removable Media FAQs
What is a removable media device?
A removable media device is a device that can be removed, with data transferred to it, from a computer while its system is still running.
What is an example of removeable media?
Examples of removable media include CDs, USB-Cs, SD cards, thumb drives, DVDs and external hard drives.
What is malware?
In the world of technology, malware is software that’s designed to intentionally cause disruption to a computer, server or computer network.
