A memory stick that fits on a keyring can now hold gigabytes, and gigabytes are enough to carry an entire organization’s confidential records out through the front door in someone’s pocket without anybody noticing.
That capability arrived quietly, priced as a convenience feature, and its security implications have been catching up more slowly than its storage capacity.
The incidents keep following the same pattern. Somebody copies a working file onto a personal drive to finish something at home, the drive ends up in a coat pocket or a car, and the coat or the car gets lost or stolen, and a spreadsheet with names, addresses, and account details that should never have left a building is now sitting with a stranger. None of these losses involve anything as dramatic as a hack. They involve an object the size of a car key, misplaced the way car keys get misplaced, except this one has other people’s private information on it.
Government departments have been the most visible offenders this year, largely because government losses get reported and audited in ways a company’s internal incident rarely does, and the volume of records involved tends to be enormous when it happens.
Encryption is the available fix, and it is a genuinely good one when it is actually used. A properly encrypted drive is worthless to whoever finds it, reduced from a data breach to a small piece of plastic nobody can read. The trouble is that encryption on most of these drives is optional, requires the user to set it up correctly, and adds a small amount of friction to something people were buying specifically because it was frictionless. Optional security measures get skipped by exactly the people in the greatest hurry, which is a fair description of anyone copying a file at five in the afternoon to finish a task at home.
What organizations serious about this are starting to do is remove the choice entirely: issue only pre-encrypted drives and disable USB ports for anything else, which is heavy-handed and the only approach that doesn’t depend on every employee making the right decision under time pressure every single time. I expect more places to move toward that, not because anyone loves the inconvenience, but because the alternative is trusting a habit that keeps failing in exactly the same way.