Portable storage devices pose IT security risk

27.03.2006
Baptist Memorial Health Care Corp. in Memphis recently found itself dealing with a proliferation of user-owned plug-and-play USB port drives that posed a security risk to sensitive patient data.

Lenny Goodman, IS director for desktop management at the health care company, said users found it difficult to copy significant amounts of data to floppy disks, and the company "did not allow CD writers."

So users turned to "the USB flash drive, with enormous capacity and zero installation," Goodman said earlier this month. "Very handy, very risky -- both as a way for data to leave and a way for malware to arrive. We had to do something."

The result: Baptist Memorial created strict policies around the use of flash memory sticks, iPod music players and other portable storage devices by standardizing on USB memory sticks that have native encryption and password protection.

The Health Insurance Portability and Accountability Act "mandates that all health care organizations develop a methodology to account for all removable media," Goodman said.

But with more than 42 million of Apple Computer Inc.'s iPods sold so far in the U.S. alone, the threat of data theft or loss from downloading information on a USB port device is growing exponentially, according to analysts. Apple officials declined to say whether they plan to improve iPod security.