Campus Study Shows Importance of Protecting Against Any Trojan Horse-Type Attack
Millis, MA, USA – April 12, 2016 – USB sticks have long been a reliable, convenient way for organizations to get important information from point A to point B, back up data, store information, and much more, but lately they’ve been under some scrutiny in the headlines. A recent study conducted by researchers on a college campus seems to single out USB sticks as a potential threat to organizations who fail to protect from opportunistic hackers. In fact, the potential danger is much more pervasive, and the conclusion should be elevated to include threats from any laptop computer, printer, mobile device, webcam, DVD/Blu-ray devices, open wireless connections, internet and cloud services, email attachments, and even instant messaging. The truth is as today’s global technologies become more widely-used and accessible, the potential for threats by criminals gets more and more complex, and the need for vigilant and enforced security policies becomes more important than ever. The good news is that for proactive organizations who maintain security with sensible Endpoint protection are protected from those risks. The bad news is that organizations that leave their gates wide open to anyone could be inviting serious trouble.
A recent study conducted by The University of Illinois showed that human curiosity itself could be considered a major threat. As the study demonstrates, many curious individuals on campus picked up a lost USB stick found on a sidewalk and plugged it in to a computer to see what’s on it. Though the study focuses on USB, it exposes a much larger picture in that there are at least three opportunities where any type of technology could be used to gain a foothold in the door:
- A Criminal’s desire to get in
- People’s curiosity
- Vulnerable systems
Organizations with much to protect need to be wise and cautious to consider methods that protect against potentially dangerous situations under nefarious circumstances. Just as curiosity could kill the cat, a Trojan horse could potentially bring down an organization by any technological means that a devious hacker may exploit to introduce malware into a system, including by means of innocent and curious students, staff members or employees. Luckily this study was conducted by harmless researchers who purposely dropped 297 USB thumb drives around campus to observe what would happen. The researchers had deliberately placed tracking files within the thumb drives for the purpose of the study, so that when opened on a computer connected to the internet, it would confirm that someone had found the drive and opened something on it. The results were phenomenal.
The study showed that a stunning 45% of finders plugged in and opened up one or more files from the lost flash drives. 135 out of the 297 “lost” memory sticks were accessed. Whether the intent by the finder was to locate its owner or some other reason is unclear, however what the study indicates is a startling reality that people are curious and apt to pick up a lost flash drive they find off the street, and plug it in to a computer to see what’s on it.
For organizations that allow any kind of USB thumb drive or open technology on their unprotected network, this is bad news. For organizations using Endpoint Security, it is a non-issue. By selectively locking down and securing specified access types from outside sources, organizations can protect assets, defend infrastructure, and prevent data from being compromised.
Organizations do not need to sacrifice the conveniences of USB storage devices just because of a few bad apples, nor do they need to feel vulnerable to every type of threat out there. Some organizations and IT administrators may feel they are backed up against a wall in preventing these types of threats. Some have tried to implement a company-wide policy of awareness, while others have gone so far as to initiate an outright ban on the use of USB technology and mobile devices all-together. The former, of course, can be extremely difficult to enforce by itself, and the latter just isn’t sensible in today’s mobile environment.
Endpoint Protection provides IT managers with tremendous control over what can and cannot be plugged into their organization by enabling them to scan and weed-out unwanted or untrustworthy devices while letting the responsible use of trusted devices in. Kanguru Solutions, a company committed to helping organizations secure their data and infrastructure recently launched an Endpoint solution with Kanguru Endpoint Protector, which provides three modules that can be used collectively or separately to form a comprehensive solution through a convenient, cloud-based utility. Each module helps organizations enforce powerful security policies company-wide:
- Device Control – protect from exploited USB devices
- Content Aware Protection – monitor, report and enforce strong data security policies
- Mobile Device Management – enforce mobile device security policies
For example, with USB drives, Endpoint Protection enables organizations to monitor their network, blacklist any type of unknown device that could potentially do harm, and whitelist USB devices that are trusted and proven. By stopping users at the source from plugging in a mischievous device, threats are prohibited from getting in.
Along with Endpoint Security, many organizations are embracing secure firmware USB drives to protect their organization. Energy Companies and Utilities for example, with a very large infrastructure to protect, are using Endpoint Security to only allow trusted secure firmware USB devices and unique IDs on their networks. Hospitals with a great accumulation of sensitive patient information are using Endpoint with password-protected, hardware encrypted USB drives to protect patient data. Financial services are using Endpoint protection with encrypted USB to backup important financial data, store wills, insurance documents, bank account information and much more. Kanguru has a line of Defender secure firmware USB drives that are password protected and tamper-resistant, with secure firmware to prevent any exploitation. If a secure flash drive like a Kanguru Defender USB were ever lost, the first benefit is that the required password would prevent any unauthorized individual from attempting to access the data – avoiding a data breach. The second benefit is that the secure firmware would prevent a would-be hacker from using it to compromise an organization in any way. These precautions give organizations great peace of mind in defending their infrastructure, and protecting sensitive data, while maintaining the full flexibility and convenience of USB storage drives.
Though organizations may never be able to stop individuals from picking up lost USB sticks off the sidewalk and plugging them into their computers, or stop criminals from using other technologies to pose a threat, Endpoint protection can prevent those threats from gaining a foothold into their organization, and maintain convenient use of trusted devices to conduct secure and reliable business conveniently and effectively.
Learn more about Kanguru Endpoint Protector or Defender secure firmware, hardware encrypted USB drives.
Kanguru is a global leader in developing TAA compliant data storage products, providing the very best in FIPS 140-2 and Common Criteria Certified, hardware encrypted, secure USB drives, as well as fully-integrated remote management security applications and Endpoint Security. Kanguru also manufactures duplication equipment for duplicating hard drives, blu-ray, DVD and more. For more information on Kanguru, please visit kanguru.com.
