Half of organizations lost information on USB drives
Inexpensive consumer USB Flash drives are ubiquitous in all manner of enterprise and government environments – typically with very little oversight or controls, even in the face of frequent and high profile incidents of sensitive data loss, according to the Ponemon Institute.
The study underscores the pressing need for organizations to adopt more secure USB products and policies. A group of 743 IT professionals and IT security practitioners from global companies based in the United States were polled, and all acknowledged the importance of USB drives from a productivity standpoint.
They cautioned, however, about the lack of organizational focus regarding security for these tools to meet appropriate data protection and business objectives.
The most recent example of how easily rogue USB drives can enter an organization can be seen in a U.S. Department of Homeland Security test in which USBs were “accidentally” dropped in government parking lots. Without any identifying markings on the USB stick, 60 percent of employees plugged the drives into government computers. With a “valid” government seal, the plug-in rate reached 90 percent.
According to the Ponemon study, more than 40 percent of organizations surveyed report having more than 50,000 USB drives in use in their organizations, with nearly 20 percent having more than 100,000 drives in circulation.
The study finds that a whopping 71 percent of respondents do not consider the protection of confidential and sensitive information on USB Flash drives to be a high priority. At the same time, the majority of these same respondents feel that data breaches are caused by missing USB drives.
The Ponemon study concluded that 12,000 customer, consumer and employee records were believed to be lost on average by these same companies as a result of missing USBs. According to a previously released Ponemon report, the average cost of a data breach is $214 per record, making the potential average total cost of lost records to the organizations surveyed for the Ponemon USB Flash drive study, reach upwards of $2.5 million (USD).
Evidence of widespread compromise is apparent
Nearly 50 percent of organizations confirmed lost drives containing sensitive or confidential information in the past 24 months.
The majority of those organizations (67 percent) confirmed that they had multiple loss events ― in some cases, more than 10 separate events.
Oversight and control of USBs in enterprises can be better
Free USB sticks from conferences/trade shows, business meetings and similar events are used by 72 percent of employees – even in organizations that mandate the use of secure USBs.
In terms of policies and controls, of the hundreds of IT professionals and IT security professionals polled, only 29 percent felt that their organizations had adequate policies to prevent USB misuse.
“An unsecured USB drive can open the door for major data loss incidents,” said Larry Ponemon, Chairman and Founder of the Ponemon Institute. “Organizations watch very carefully, and put a plethora of controls around, what enters their businesses from cyberspace. This study drives home the point that they must also take a more aggressive stance on addressing the risks that exist in virtually every employee’s pocket.”