Flash Drive Security

In the earliest years of personal computers being used in offices and homes throughout the land, if you wanted to transfer a file from one computer to another, you would insert a floppy disk into the floppy disk drive of the source computer, copy the file from the hard drive onto the floppy disk, listen to the data being written to the floppy disk (sometimes with an alarming grinding noise), "sneaker net" the floppy over to the target computer, and hope that said computer could read the file from the floppy.

These floppies had a nontrivial rate of failure, so there was no guarantee of success. This is especially true for those disks that had been used as aerial weapons by angry or mischievous programmers, computer room technicians, or IT support staffers. The first generation of floppies, invented by IBM, had a diameter of 8 inches, making them ideal as nerd frisbees. The next generation, at 5.25 inches, did not possess nearly the same lift as their predecessors, and thus worked better as the nerd's answer to ninja throwing stars. The third and final type of floppy, at 3.5 inches and encased in hard plastic, wasn't even floppy. Some say that's when computers grew up and became less fun.

But most of those floppies, regardless of size or computer room lethality, have been swept into the dustbin of computing history — replaced by CDs, DVDs, and thumb drives as the preferred forms of removable computer media. Those first two types are round, unlike the floppies of old, and consequently better approximate a miniature frisbee (that's why AOL sent us all those discs, right?). But, unlike floppies, they are more easily scratched. In addition, they are not nearly as portable as USB flash drives — also known as thumb drives, memory sticks, pen drives, and jump drives. This unsurpassed portability has made flash drives extremely popular, and no nerd's key chain is complete without one. In fact, demand for thumb drives is so strong that their usage has grown exponentially. Companies that used to hand out sales information on diskettes, are now giving away thumb drive equivalents.

Small and Feeling Insecure

The diminutive size and light weight of thumb drives also make them easy to lose, and equally easy for a thief to pocket in an instant. Their storage capacity has grown from 8 MB (in 2000) to 64 GB (as of this writing, 2009). This means even more valuable information that an individual can carry — over 45,000 times that of a standard 3.5-inch diskette! Yet it also means even more valuable information that an individual can inadvertently compromise. Several organizations in the United States alone have managed to do just that, including a school that lost a flash drive containing the names and Social Security numbers of 6500 former students. Even more alarming, shoppers in a bazaar near Bagram, Afghanistan could have purchased flash drives formerly owned by the US Army, and containing classified military information.

These two examples point up what is becoming painfully obvious to businesses, governments, and other organizations that store large quantities of sensitive information: Storing this data on a flash drive may be incredibly convenient, but it can be equally unsafe, given how easy it is to lose one of these small devices — either as a result of one's own carelessness, or a thief's cleverness. In response to this growing problem, flash drive manufacturers and security software developers are creating a variety of solutions — involving hardware techniques, software, and even biometrics.

Fortunately, these efforts are paying off decidedly, resulting in a growing number of options to keep this "data on the go" from going too far afield.

Hardware with No Soft Spots

One method of securing the data on a USB flash drive is to manufacture the device so it has encryption embedded in the hardware itself, by having the device's microprocessor automatically encrypt data being written to the device, and decrypting it when the owner is reading that data from the device's memory. The primary advantage to this method is that the chip can be programmed so that after a certain number of false password attempts, the encrypted data is erased from memory, permanently. Software-only security measures cannot offer this feature, because their encrypted data can be copied from the device's memory, as a backup, prior to trying candidate passwords. If all of those attempts fail, and the software were to delete the data, the data could simply be restored from the backup, for another try.

One disadvantage to this embedded-option method is that these drives typically cost more than secure drives using encryption software not embedded in the device's chip. Secondly, if the legitimate owner of the drive forgets the password, his data is effectively lost — the electronic equivalent of a paper shredder. This may never be a problem for people who keep meticulous track of their passwords, but could prove disastrous for anyone else, and especially anyone with poor recall. This is definitely a case where a minor organic memory problem could turn into a major electronic memory problem!

Manufacturers of hardware-secured flash drives include IronKey, Kanguru Solutions, Kingston Technology, and SanDisk.

Hardened Software

Given the greater expense of encryption-chip USB flash drives, as well as the higher risk of catastrophic data loss, many buyers opt for software encryption flash drives — such as those products manufactured by Lexar — which make no use of microprocessor-based encryption.

Software-based encryption systems are often referred to as employing on-the-fly encryption (OTFE), which means that when the user has successfully entered their password for their flash drive, then all of the files on the drive are instantly accessible, and are decrypted as they are read off of the drive. Examples of OTFE schemes include FreeOTFE and TrueCrypt.

FreeOTFE is designed for computers running Microsoft Windows, as well as PDAs and other mobile devices running Windows Mobile (for those, the product is known as FreeOTFE4PDA). Just as its name implies, FreeOTFE is free for use by all, and the project has every intention of keeping it that way. It is also open source, meaning that anyone can examine the code for flaws — unlike proprietary software. As a consequence, with more programmers and security experts able to scrutinize the source code, the chances of it containing substantial security holes are greatly reduced. The product does not need to be installed, is available in several languages, supports all the best publicly-available encryption methods, and even optionally supports security tokens and smart cards.

TrueCrypt, like FreeOTFE, creates a virtual encrypted disk on the USB flash drive. It also supports Linux and Mac OS X. For people who are crossing national borders and want to keep their private data private, TrueCrypt has a highly-regarded feature whereby an entire instance of Windows XP or Vista, as well as the user's personal data in that partition, can be encrypted and hidden so well that its existence is completely deniable.

Biological Metrics

The third and most futuristic category of flash security measures, is the use of biometrics — at this point limited to fingerprint scanning and confirmation. An example of this is the Kanguru Bio Slider II, a USB 2.0 flash drive that uses proprietary fingerprint recognition technology. When a new owner begins using her drive, she places a thumb or finger on the sensor until her fingerprint has been completely captured and stored in memory. From that moment forward, she would use the drive by inserting it into any USB port and then swiping a finger across the sensor, to access her data. Multiple fingerprints can be used, and all of them are stored on the drive itself, along with the security program. Consequently, nothing needs to be installed on the hardware containing the USB port.

Yet fingerprints are probably not the only biometric technology in the future of flash drive security. With the remarkable advances made recently in retinal scanning for identification purposes, there will most likely be a time in the future when biometric security systems for flash drives move beyond using fingerprints, and instead require the device owner to stare intently at the device to prove his or her identity. But given the hardware requirements for retinal scanning, that may be a ways off.

Perhaps the most critical bit of advice that can be offered to the prospective purchaser of a USB flash drive, is that it does not matter how much memory capacity it has, how strong its security methods, or how sleek its exterior; what matters most is that the data on it should be fully backed up on some sort of computer media that is in a different physical location. These media can include hard drives, optical disks (CDs or DVDs), or Web-based remote storage services.

In a pinch, you could even use old-fashioned diskettes, assuming that your coworkers will give you back the ones you used as Friday afternoon projectiles when the boss had already disappeared for the weekend.