Why Copying Work Data to a USB Drive Can Create a Compliance Problem

USB drives are incredibly convenient. You can fit thousands of documents on something smaller than your thumb, carry them anywhere, and plug them into almost any computer.

Need to take a presentation home? Copy it to a USB drive. Need to move a large file between computers? A flash drive makes that easy, too.

Unfortunately, that same convenience creates some very real risks to your data and, subsequently, your safety and compliance.

What’s Wrong With a USB Drive?

There is nothing inherently wrong with using USB drives. The problem comes down to who controls it.

Your company’s approved storage systems may have encryption, access controls, automatic backups, audit logs, and other protections surrounding the information stored there.

Copy a file onto an ordinary USB drive, however, and many of those protections disappear. What happens if you lose the USB, somebody steals it, or you leave it out somewhere? Whoever finds it can access everything stored inside.

The Risks of Not Encrypting USB Drives

USB drives are easy to lose. They get left in laptops, dropped into bags, forgotten in conference rooms, and tossed into desk drawers for months at a time.

Now imagine that one of those drives contains customer records, employee information, financial documents, or other Personally Identifiable Information (PII). Suddenly, losing a tiny piece of plastic becomes a very big risk.

From a compliance standpoint, it doesn’t matter whether you accidentally lose the information or intend to give it away. Your company may still need to investigate what happened, determine exactly what information was involved, and decide whether the incident triggers any reporting requirements.

Some organizations allow employees to use USB drives, but require them to be encrypted. Encryption essentially scrambles the information so that someone cannot simply plug the drive into another computer and start reading your files.

That can significantly reduce the risk if your device or drive disappears. Remember, though, an encrypted USB drive does not give you permission to copy whatever you want. Your company’s data handling policies still determine what information you can move and where you can store it.

What Comes Into Your Computer Adds Another Risk

USB drives do not just take information out of company systems. They can also bring in unwanted files.

If you find a USB drive in a parking lot, conference room, or other public area, resist the temptation to plug it into your work computer to figure out who owns it. Report and turn it in immediately instead.

Unknown removable devices can contain malicious software.

The same caution applies to USB drives used on personal or public computers. Connecting them to a work device may introduce security risks that your organization is specifically trying to prevent.

What Should You Do Instead?

The safest option is usually to use the storage and file-sharing tools your company already provides. If you genuinely need removable storage, then follow your organization’s policy rather than grabbing whatever USB drive happens to be nearby.

A few simple security practices can help:

• Only use company-approved USB drives.

• Never store sensitive information on an unencrypted drive.

• Do not connect unknown USB devices to your work computer.

• Keep approved drives physically secure when you are not using them.

• Report a lost drive immediately, especially if it contains company information.

If you are unsure whether you can copy something onto removable storage, ask first.

Conclusion

USB drives make moving information incredibly easy. That is exactly why they can become a compliance problem.

Think about what you are carrying before you copy files onto removable storage. That little USB drive in your pocket could contain far more sensitive information than its size suggests!

Once sensitive information leaves an approved system, your organization may lose some of its ability to monitor, protect, back up, and control that data.