US agency issues USB devices to employees in attempt to control security

By Janine de Blois

Workers at Washington’s Division of Child Support have begun issuing SanDisk Cruzer drives which provide 256-bit AES encryption and are password-protected.

They are replacing all the privately owned devices which many workers were using to store clients personal data.

The personal data ranges from Social Security numbers, tax and employment records, to criminal records and passport data.

Brian Main, the division’s data security officer said, “We do periodic risk analysis of our systems, and one of the things that came up is the use of thumb drives; they were everywhere, said Main. We had a hard time telling which were privately owned and which were owned by the state.”

The agency will also use SanDisk’s Central Management and Control software at its headquarters. The software manages and configures the USB devices and prevents unauthorised access.

“I think a lot of organisations are asleep at the switch. They don’t see this as a huge problem. It obviously has the potential to be the mother of all data-protection issues,” says Larry Ponemon of the Ponemon Institute, which specializes in privacy and data security.