Abstract
Physical security is considered an integral part of information systems security. The idea that small devices pose a security threat for enterprises is well established. On the other hand, consented and supervised access to USB ports via USB flash drives is sometimes allowed. This paper will highlight the risk associated with this kind of access by devices such as IPods and USB flash drives. It will show a proof of concept USB device that runs automatically once connected to a personal computer and copies files and folders from the victim's computer to its storage and executes potentially harmful code on the computer without the user's knowledge. The paper then provides measures necessary to mitigate this type of physical attacks. Keywords USB Device Security, Small Digital Device Forensics, password auditing, physical computer security, USB device auditing.
INTRODUCTION
USB Flash Drives (UFD) or “USB sticks” are becoming popular means of storing and transporting data and applications. UFD sales worldwide reached $2 billion US Dollars in 2005, according to Gartner research. Gartner expects UFD sales to increase fifteen percent per year through the year 2010, driven in part by interest in "USB smart drives" carrying software or operating environments (Roush 2006). USB Flash Drives (UFD) are becoming increasingly capacious and affordable with drives at a capacity of onegigabyte selling for a rate of for $4050 US Dollars for the low end ones and $60100 US Dollars for the ones with high end components or smart features (Bowman 2006, Roush 2006). This in turn led to a rise in the level of corporate data theft by rogue employees sneaking corporate data out of the workplace on memory sticks, iPods and mobile phones (AAP 2006).
UFD THREATS TO THE CORPORATE ENVIRONMENT
The increase in capacity and affordability and the decrease in size of UFD's have made them into a security risk in a form of a covert tool for stealing data from the corporate network. The Australian Computer Crime and Security Survey found that theft or breach of confidential information accounted for the highest portion of financial losses in 2005 at an average of $2 million Australian Dollars per company (AAP 2006). UFDs may also be used as an effective channel for transferring malicious software, pornographic materials or other illegal software or hacking tools to the corporate network. UFD transferred tools can then be used within the corporate environment to conduct corporate espionage and execute tools that may not otherwise be transferable or executable in the corporate environment. Moreover, UFDs may involuntarily become means of storage and transfer of malicious code. Employees transferring files from home or other sources such as Internet cafes to the company network on a UFD may not be aware of viruses,


Download full report
http://googleurl?sa=t&source=web&cd=2&ve....1.163.109%26rep%3Drep1%26type%3Dpdf&ei=BpJUTpT8HYHIrQeHmdGxDg&usg=AFQjCNE9nFRLQm8cM1Cgc2D_5iX3rRkUEw