Slashdot Log In
State Agency to Destroy Unauthorized USB Drives
Posted by
Zonk
on Tue Mar 18, 2008 04:21 AM
from the what-they-don't-know-won't-hurt-you dept.
from the what-they-don't-know-won't-hurt-you dept.
Lucas123 writes "The State of Washington's Division of Child support has forced hundreds of workers to turn in personal USB flash drives and has instead begun issuing corporate-style USB drives. The goal is to centrally monitor, configure and prevent unauthorized access to storage devices. So far about 150 common drives have been issued. The agency eventually plans to destroy all existing thumb drives collected as part of the security policy change."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Misleading summary (Score:5, Informative)
I know... I apologize for reading the article.
Re: (Score:2)
Re:Misleading summary (Score:5, Insightful)
The whole point of the exercise appears to be about safeguarding the data. The
A better title would have been "Washington's Division of Child Support takes important steps needed to safeguard confidental data" or "State agency moves to plug USB flash drive security gap". Oops, never mind, the second one was already used by *TFA*.
Parent
Re:Misleading summary (Score:5, Informative)
Parent
Re: (Score:2, Informative)
Re: (Score:3, Funny)
How the hell did you get access to my document - I store it on my personal USB drive, its the only copy... when they took it off me and gave me that new one I thought they destroyed my personal one..
Does that mean you have those pictures of my wife too???
Re:Misleading summary (Score:4, Funny)
Parent
Misleading Summary leads to Misleading Tags (Score:2, Insightful)
But then again what does the content of the article have to do with analysis on Slashdot... yeah I know.. flamebait..
Re: (Score:3, Insightful)
The replacement drives might support encryption, which is a normal 'corporate' feature.
Re:Misleading Summary leads to Misleading Tags (Score:5, Insightful)
The replacement drives might support encryption, which is a normal 'corporate' feature.
when it comes to commenting or responding... comprehension is not necessary.
The use of the word "personal" was obviously targetted at getting a rise out of the non-RTFA crowd, as the article itself never terms the drives - "personal drives". They called them "nonapproved thumb drives". We recently discussed "secure" thumb drives [slashdot.org] and I hope they arent wasting their (taxpayers') money on the version of the Cruzer reviewed in the article.
Parent
Re:Misleading Summary leads to Misleading Tags (Score:5, Informative)
RTFA. The reason the state is issuing these new fancy-schmancy thumb drives is that the new ones (claim to) have 256-bit AES encryption and (claim to) self-destruct after 10 consecutive wrong passwords. They're doing this whole switch because of privacy, because the thumb drives contain the private, personal case files of hundreds/thousands of citizens.
Parent
If you had read my response to the other post... (Score:3, Insightful)
Good (Score:3, Funny)
Re: (Score:3, Insightful)
Accuracy of Story? (Score:3, Informative)
Although, it does say in the quote from the manager that they will "manage and back up the new drives using SanDisk's Central Management & Control server software...which relies on a Web connection to directly communicate with agents on the tiny flash drives [and can] remotely monitor and flush any lost drives" so they could read and delete files on the disks remotely.
It also says that they chose the disks for their MSW Vista compatibility which suggests that the "agents" really are (as previously quoted) on the disk rather than the PCs (one assumes so they can track what their employees do with the disks while not using their PCs, which really doesn't seem necessary to me). Hopefully they do have software on the PCs too to ensure that non-authorised disks are not used and to monitor activity if the "agents" are removed from the disk by intrepid employees.
Although, I suppose, in principal, the right to privacy of their clients (which could be breached by data being transferred out of the building) overrides the right to privacy the government employees have while in the office.
Re:Accuracy of Story? (Score:5, Insightful)
My bad. It says "after recalling the thumb drives used by workers. Most of those had been purchased independently by the employees, causing myriad problems for security personnel, Main said. The new policy requires workers to use the drives supplied by the agency. Main said he eventually plans to destroy all existing thumb drives collected as part of the security policy change." Although, I think from this and following comments like "The general perception is no one will report a lost USB memory stick because they're so cheap" there is an implication (although it isn't explicit at all) that the drives were bought with public money and used for public work.
Once again, I don't think there is too much to complain about here. It shocks me how many employers (even in sensitive areas like government departments and law firms) have PCs that will even, by default, run software or an operating system from a USB drive. According to TFA, in this case "sensitive data transported by off-site workers include[d client's] tax documents, employer records, criminal histories and federal passport data" and commonly "the names, dates of birth and Social Security numbers of children".
Of course, in opposition to what the article says, I think education about data protection legislation and issues is more important than attempting to physically constrain employees (which is ultimately impossible), although both may have their place.
Parent
Sensible policy (Score:5, Informative)
This isn't a personal privacy issue for the users (after all its just a USB key) its a personal privacy issue for the people on whom the department stores information.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:3, Interesting)
Re:Sensible policy (Score:5, Insightful)
1. What maybe started along the lines that you described, then has to go through controlling or purchasing or such, which in a lot of places have their job judged and measured by how much they saved. If they saved 10,000$ at the cost of making everyone else spend 1,000,000$ in workarounds and lost productivity, they're doing their job right. So someone will go "auugh, why should we pay a few bucks more on very secure drives, when we could get ordinary ones at a bulk discount? Look, there are these drives with fingerprint scanner for half the price. That's secure, right?" (See the vulnerability linked even on Slashdot recently.)
2. Someone else (or in some organizations the same) will have to make sure it's one of the approved suppliers. Ideally this would mean those who have a good track record of reliability, quality, etc. In practice, it'll mean one of (A) whoever pays more bribe, or (B) the boss's wife's or cousin's supplies company, created just to siphon some money off such purchases. If it's a state agency, stuff like pork barrel, political favours and lobbies have something to do with it too.
Since this _should_ be in conflict with #1 and is exactly the kind of thing that #1 is supposed to catch, sometimes they split the bribe, sometimes they trade favours, and sometimes inventive discounts are used. Like we'll price the USB sticks at $1000 each, give you a 50% discount, and let you show that you've done your job right by negotiating a whole $500 discount per drive.
3. Some IT department has been given thoroughly counter-productive goals, like only keeping the computers or the network running, but no mention of actually providing a service to the rest of the organization. So suddenly the users are their sworn enemies, the filthy pests that keep using and screwing their preciouss computers and network. They'll do their best to contain, thwart and plain old inconvenience those users at every step. So the "secure" setup for those drives will be just an exercise in making it as inconvenient to use as possible, to teach those pesky lusers a lesson.
And indeed the users do learn a lesson: that if you want to get your job done at all, you have to do your own unauthorized workarounds. There goes most of security out the window right there.
Alternately, the IT department has also been on the shit end of #1, and is underfunded and staffed with the cheapest monkeys who can sorta bang on a keyboard, and don't fling too much feces at the screen. So they'll configure something which they think is right, but is not.
Yet another alternative is that a lax PHB can't be bothered to actually organize IT, and some BOFH personality types feel free to override everything and do what _they_ please. I've seen it happen. Stuff like production servers configured without XA support for _years_, just because the relevant BOFH thought that's a buzzword and it runs just as well without it anyway, plus it saves him the bother of installing the relevant libraries on all servers. So he _lied_ to the team for years that they have a feature that they didn't actually have.
And not only I can see all three happening with security too, I've _seen_ it happen with security features too.
4. Some PHB will figure out that it's not really an "enterprise" drive unless it has the organization's logo on it. In fact, that that's what makes anything properly enterprise.
Some frustrated users that have been on the shit end of #3 too often, will begin just printing and gluing makeshift logos to their own USB sticks, rather than put up with Mordac The Preventer Of IT Services again. Noone will be any wiser.
Etc.
Parent
Waste (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Informative)
/dev/zero is a virtual device that whenever you read a character from it, comes out with a stream of zeros; it is always ready to read and never shows end-of-file.
Re: (Score:2)
dd if=/dev/sda1
before and after to be sure.
If you're really paranoid, there's also shred: /dev/sda1 /dev/sda1 300 times, then writes 0's. Spends a couple cycles with I/O to screen to let you know it still cares, [-n 0 -z -v] for a verbose version of dd if=/dev/zero)
shred -n 300 -z -v
(writes random data to
Won't work, even with all the good faith... (Score:3, Interesting)
Even employees that mean to comply will forget, will be at work and need one, reach in their pocket, and find they've got one of their own instead of the corporate-issued one.
I don't know what the answer is, but banning ubiquitous technology is like Canute holding back the waves.
The most dramatic case of the utter failure of this sort of thing I've seen occurred at a company in the 1990s which didn't quite understand that personal computers were personal. This was in the days before antivirus software was standard on any business machine. The company became seriously infected with a boot-sector virus. They had the entire IT department, SQA department, and tech support departments literally stop all their work for about a week while they went throughout the company collecting diskettes and disinfecting them, then pronounced the company clean. Apparently it never occurred to anyone that there were diskettes that weren't in the building.
Even then there were laptops, and, without pointing fingers--OK, pointing fingers--laptops were expensive at the time, and it was mostly the high-income and high-ranking employees, and, of course, people with good reason to have them--salespeople typically--that had them.
The company was reinfected by the same boot virus within less than a month.
Re: (Score:2)
Re: (Score:2)
2) Diasble all USB ports on all computers
3) All users to run as "Users" and not local administrator
4) Use GPO to diasble auto install of USB devices
5) Use GPO to deny all programs unless authorised (Not often used, but in windows you can stop a logged on domain user from running any programs whatsoever, including explorer)
6) Install Proxy that "denies" all webistes except approved one
7) Pissed off users, but more secure network. Senior management support you, so flack direct
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Funny)
Oi - get real (Score:3)
Government and private sector agencies destroy used disks every single day using methods from as simple as patterning 1's and 0's to smelting the platters. This happens so often that their are dedicated machines available to do it for you right up to dedicated companies that specialize in the destruction.
Misleading Comments... (Score:3, Informative)
Somebody has woken up to to personal privacy (Score:5, Insightful)
As to destroying them... Put this in proportion: 150 devices, at perhaps $30 apiece if they wern't bought yesterday: about $4500. On the otyher side, when the UK government lost 2 CDs with large amounts of personal information, the mailshot warning the people whose personal and banking information had been misplaced cost $6,000,000. With cost ratios of this magnitude, the precautionary principle applies. Yes, you could wipe them, and they probably wouldn't leak info. But the cost if they did is so high that the tiny loss involved in destruction is irrelevant.
So I applaud a government department for finally taking privacy seriously. The cost arises becasue they didn't do so before, and is small. The cost for all the other departments who have not yet got it is increasing every day.
Why not disable the USB ports? (Score:3, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
There are security concerns (Score:3, Informative)
So he took a bunch of thumb drives, put a Windows autorun backdoor installer on them, and scattered them around the entrances and outdoor smoking areas.
Hey, presto, instant access.
Now if only all the other agencies would.... (Score:3, Interesting)
The auditor was furious, and demanded we give him the file, rather than just printouts. I said no, and he left, only to return the next day with his supervisor, who also demanded the same and said they'd get the file "legally" if needed.
I told them to give me the USB key, and we'll see. I plugged the key in and turned the monitor around so they could see 9 QuickBooks files from other companies. I asked them if they intended to share my data with the next 9 companies, like they just shared those files with me?
After much haranguing, and threat of legal action, we finally agreed on a full Excel file database dump, but with the critical fields (customer names, CC numbers, etc) wiped.
Is it just me, (Score:3, Interesting)
RTFA (Score:5, Insightful)
Parent
Re: (Score:2)
It's the same in any military situation - hook a device up to a Restricted or higher machine and the only way to 'declassify' it is with a hammer.
Or, as some people have pointed out from TFA, it could be that these were purchases that they've been
Re:You can have my USB key (Score:5, Insightful)
Parent
Re: (Score:2)
Re:What a waste (Score:5, Insightful)
Two things to consider:
Parent
Re:What a waste (Score:4, Informative)
Parent
Re: (Score:3, Insightful)
Depends on the price. If they were 1p I'd buy 100 of 'em. 256 Mb is still a useful amount of storage (plain text, html, mp3 etc. etc.).
Re: (Score:2)
that's the cool part. Plug in two drives, dump contents from one to the other, format the old one, give it away. Really simple.