CEH

398 Chapter 17 ■ Physical Security

Securing a portable hard drive or any storage device can be made easier through the

application of technology and proper procedures. One of the most efficient ways to protect

the confidentiality and integrity of information on these devices is encryption. Applying

encryption across a whole volume or drive provides robust protection against data

falling into the wrong hands. With the increasingly widespread availability of full drive

encryption, it is worthwhile for every company or organization to evaluate the need and

benefits of implementing this type of protection. Although full drive encryption will not

prevent a drive from being physically stolen, it will go a long way toward preventing the

thieves from accessing the information easily.

Problems with USB

External USB hard drives have been lost or stolen on numerous occasions,

compromising a company’s security in the process. In some cases, it was even found

that drives that were bought with the intention to serve as a backup eventually became

the storage area for the sole copy of data. Many companies have had to rebuild data or

recover data that resulted in big financial losses as well as lost time and productivity.

For security reasons alone many organizations such as the U.S. Department of Defense

have banned the use of these devices, making it punishable to have them in some

facilities.

Legal Issues with Data

Encryption may be mandated by law. For example, some U.S. agencies are legally

required to encrypt the hard drives that are present in laptops in case the device is lost

or stolen. For example, in 2006 the U.S. Department of Veterans Affairs (VA) lost a laptop

that resulted in the compromise of 26.5 million patient records. The fallout from this

incident were financial issues due to identity theft for many of the affected patients as

well as a $20-million settlement and credit monitoring services for the victims.

Currently there are numerous options for deploying drive encryption. Among the leading

solutions are:

■ PGP

■ TrueCrypt

■ Microsoft BitLocker