Portable storage devices pose security threat

InfoWorld - Have you been following the story about cell phone records being sold on the Internet? The Chicago Sun-Times published an interesting article on this not long ago, but this outrageous practice has been going on for quite some time.

In essence, anyone with a credit card and a cell phone's telephone number could get in touch with the Locatecell Web site (or others) and, by paying $110, quickly receive a list of all the calls made from that phone over a one month period.

I say "could," in this case, because according to Mobile Tech News, Cingular Wireless -- one of the telcos affected by Locatecell -- has filed a lawsuit against Locatecell's parent company, Data Find Solutions, and another phone-number reseller, claiming that those phone records were stolen. Cingular has also obtained a temporary restraining order against the two companies to prevent future use and sale of the cell numbers.

It's unclear at the moment how those phone records were obtained (and I am not going to speculate when there is an ongoing court proceeding), but that story is a clear indication of how easily customer information can be disclosed.

Replace "phone records" with any other valuable customer data (bank records, engineering records, purchase records, order histories, etc.) and a similar situation becomes possible right in your own company.

"Companies have been overlooking the fact that a lot of the company data is on personal storage devices, such as USB drives," says Nimrod Reichenberg, director of marketing for corporate solutions at M-Systems. (If you aren't familiar with M-Systems, here's what you need to know: The company has been a pioneer in developing flash drive technology.)

Reichenberg adds that in the past year or so, the security officers of major companies have become more aware of the risk involved with personal storage devices, "but the storage guys are still under a rock and don't even consider the device as part of their storage strategy."

M-System's recently created Xkey division, of which Reichenberg is part, targets the corporate market and aims to address the security and asset management issues related to personal storage.

"No employee would ever think of buying a laptop and bringing it to the office to do some work," Reichenberg says. "But most people won't think twice about taking a USB drive they bought at Best Buy into the office, copying some financial information to it, and just walking out."

Reichenberg has a good point: USB drives and other similar devices' ease of use make them ideal tools