novelty flash drives

[Salesmonkey]

This thread in Fratching got me thinking about my department's take on novelty flash drives:
http://fratching.com/showthread.php?t=6743

Except, in our case, the "novelty" flash drive is a 4G Ironkey Enterprise flash drive. These things are not cheap. And EVERYBODY has to have them. It's like as soon as somebody's cube-neighbor gets one, they have to requisition one also.

Granted, they're truly leet for what they do. We don't resent the expense for the extra security they provide. I resent the fact that they are NOT BEING USED.

How do I know? By the password reset requests that I have to process! Thank goodness for the Enterprise version, though. The Personal version ironkey doesn't have an administrator function- and if you enter the wrong password 10 times, the encryption chip self-destructs. Poof, $150 bucks gone.

The gravy on this porkchop is that the reason we use encrypted flash drives is to help with HIPAA compliance. If a flash drive with Protected Health Care Information went missing, it could lead to a data breach. So if the drive is encrypted, no worries.

Except that my co-workers, who have been given Ironkeys, are using their own dang flash drives for most of their work! They complain it's "too hard" to use them, and "I can never remember the password". Duh, that's because you aren't using it! And you have lousy password discipline, see my other posts on this subject.

So WHEN they lose their personal flash drive, that may or may not contain Protected Health Care Information, they will be putting my boss's job on the line for a data breach. She doesn't deserve that! She's the only decent boss I've ever had! I can't lose her!

Plus, since they put the stuff on their own property, there's a certain amount of personal liability too. The last HIPAA data breach in the news affected about 4 people I know of. The lower-ranking people all lost their jobs. The supervisor had to do community service and pay around $50 K in fines.

At least now that we've been buying these things for a couple of years, we are stocked up. One of the managers and one of the section heads are retiring, so I have 2 flash drives to distribute, so my department isn't going to be dinged for buying new ones soon.

And since nobody actually uses them, they won't notice the drives are only 4G!

[mhkohne]

Except that my co-workers, who have been given Ironkeys, are using their own dang flash drives for most of their work! They complain it's "too hard" to use them, and "I can never remember the password". Duh, that's because you aren't using it! And you have lousy password discipline, see my other posts on this subject.!

Sounds like management needs to get brutal on the subject. While I have mixed feelings on some of the specifics of the HIPPA regs, I certainly agree with the spirit, and if you've got folks avoiding proper security protocols when you've given them the right tools, I've no sympathy for such folks.

Yes, good security dicipline can be a pain in the ass. But since it's other people's info and other people's JOBS, then one has to get over oneself and do it anyway.

Besides, if you actually USE it, the password gets easier to remember!

[Amadan]

Is it possible to limit the use of memory sticks / removable media on the user's computers?

I know certain employees where I work have very restricted access on machines.

[PepperElf]

So WHEN they lose their personal flash drive, that may or may not contain Protected Health Care Information, they will be putting my boss's job on the line for a data breach. She doesn't deserve that! She's the only decent boss I've ever had! I can't lose her!

Plus, since they put the stuff on their own property, there's a certain amount of personal liability too. The last HIPAA data breach in the news affected about 4 people I know of. The lower-ranking people all lost their jobs. The supervisor had to do community service and pay around $50 K in fines.

holy mother of stupidity. i can only hope you can punish them for disobeying the rules.
cos "it's too hard" isn't a fucking good enough reason to not adhere to data security.

[Hanzoku]

Out of curiosity, why is it your boss's fault instead of idiot employee's fault?

[mhkohne]

Out of curiosity, why is it your boss's fault instead of idiot employee's fault?

The boss is responisble for their department - the employee would ALSO get into trouble, but the boss would get made an example of.

[PepperElf]

The boss is responisble for their department - the employee would ALSO get into trouble, but the boss would get made an example of.

Pretty much this. Many companies will blame the supervisor because in they're thinking "why are we paying you a supervisor's salary if you can't actually supervise your people?"

The idea is that the supervisor is suppose to fix employees who don't want to adhere to rules and that if they can't or won't then ... maybe another supervisor will do the job.

[emax4]

For those who want an IronKey now, I'd suggest to them that they put down some sort of security deposit on it. Those that REALLY want one will gladly fork over the funds, but those who are just in the "meee tooo" pool should just skip over it and get their own flash drive.

[Sarthor]

Here's a tip for people who have trouble remembering passwords.

Forget about remembering words and instead remember a shape.

Choose a block of keys, say 3x2 and then pick a shape to make by hitting keys within that block. Always use the same shape.

For example say I have the block QWE ASD. I then draw a rectangle QEDA and add in a diagonal line QD. Many passwords require at least one number so I add in the number directly above the Q which would be 1. There's my password.

The password expires and I have to come up with a new one ? No problem. I just shift to the right so that QEDAQD1 becomes WRFSWF2. I can even write it down in plain sight since the only thing I would need is the first letter of the block.

I don't use this method myself, but I do remember my PIN numbers by the shape they make on a keypad. Sooo much easier than remembering 4 digit numbers.

[Seshat]

for PIN and the like, I like to choose two numbers which are significant to me. I use the smaller as the base, and convert the larger number to that base.

Try social-engineering THAT in 3 tries!