Various flash drives

Related content

Flash drive security

Three basic rules

The most important rule for flash drive security -- or for the security of any portable storage media -- is also the simplest to state: 

If you can follow the first rule, you don't need to read any further.  If you must keep sensitive information on a flash drive, then the second and third rules are critical:

  • Keep the flash drive safely in your possession or otherwise locked up in a safe place, just like any valuable object.
     
  • Use a drive with built-in access control and encryption protection, and use that feature.  Don't count on your ability to never lose the drive, or never have it stolen.

Passwords and fingerprints

Secure flash drives control access by using passwords or, in the case of some newer models, fingerprints.

Such drives usually allow you to divide up their capacity into a "public" area that can be used by anyone who has the drive -- and a protected "private" area that requires the password/fingerprint.

In addition to limiting access to the private area, secure drives use an encryption algorithm to encode information stored there.  The password (or fingerprint) is mathematically converted to be used as the encryption key.

If you use a model with a password, the usual password selection and protection considerations apply.  Using a bad password defeats the protection.  On the other hand, if you choose a password so good that you forget it yourself, you may never get the information out of your device.  (Some drives allow you to store a "hint" phrase or question, that's provided when an incorrect password is entered.)

Fingerprint models eliminate the need for passwords.  Most drives allow you to "enroll" multiple fingers of your own (in case of injury), or you can use that capacity to enroll other persons' fingerprints (e.g., to share access with family members if you're using it for emergency document storage).  Some models also allow a password to be set, allowing access other than by fingerprint.

Costs and benefits

You will pay a bit more for protected USB drives.  How much is the confidentiality of your information worth?  If it's your personal information, that's your call.  If it is UM's information, we can tell you the answer:  Secure USB drives are required any time you use one to carry around copies of sensitive work-related information.

In addition to paying a bit more for the drive, there is an "operating" cost.  Use of the unsecured area of a secure flash drive works just like a regular drive.  You simply copy (or drag) a file to it.  However, interacting with the encrypted private area requires accessing the drive via the security software that comes bundled with it.

First you must set up the secure area, and select a password or record fingerprints.  From then on, you'll need to "log on" to open the secure area of the drive, by entering the password or scanning your finger.

As with any other type of software, some manufacturers do a better job than others of creating an easy-to-use system.  (You generally cannot mix-and-match.  You must use the security software that came with the drive.)  

Here are some thing to consider when selecting a model:

Platform compatibility - All secure drives work with Microsoft Windows XP and 2000, but most are not compatible with older versions of Windows, such as 95, 98 and Me.  (For many reasons, we recommend you no longer use those older operating systems.)  Only a relative handful will work on Apple Mac or Linux systems.

Setting up the secure zone - As noted, secure drives allow you to divide up the drive capacity into "public"  and "private" partitions.  While this division can be re-adjusted, doing so sometimes requires that all data on the drive be deleted first.  Be careful. 

Bundled security software - Sometimes the security software must be installed on every machine with which you wish to use the secure flash drive feature.  In others, it need only reside on the drive.  Be careful not to erase your only copy of the security software when you divide the drive between secure and non-secure zones, as on some models a partition operation erases even that.  (Usually you can download a replacement from the manufacturer's Web site if you forget to make a backup copy.)

Accessing the secure and "non-secure" zones - You usually cannot access both the secure and non-secure (unencrypted) partitions at the same time, or easily flip between them.  If you are "logged in" to the secure zone, you will see only the files in that area; and you'll see only those in the non-secure zone if not.  To simplify use, we recommend you configure all the available drive space as secure, and use a separate (cheaper) flash drive for files that don't require security. 

Fingerprints vs. passwords - Fingerprint models are convenient (if you hate remembering yet another password), but a bit more expensive.  The long-term reliability of the fingerprint scanners used in such devices has not been established.  Also, currently they are only available for Windows systems. 

Secure drive models

There are dozens of secure models, with new ones arriving on the market all the time.  This is only a partial list.  Since prices change constantly, we have not included them here.

  • BioCert ClipBio Biometric (up to 10 fingerprints, with master unlocking password)

    Windows XP/2000 only.  Nicely packaged, but expensive (and given physical design, hard to "register" big fingers).  Consider the Sandisk Cruzer Profile for a cheaper fingerprint alternative.
     
  • Crucial Gizmo Overdrive with Security Software (password)

    Not yet evaluated.  However, Crucial products are generally of high quality.
     
  • Kanguru BioDrive, BioSlider (up to 10 fingerprints, with optional recovery password)
     
    Not yet evaluated.
     
  • Kingston DataTraveler Elite and DataTraveler Elite Privacy Edition (password)

    Windows XP/2000 required for password/encryption features.  Basic (unencrypted) file storage for Mac OS and Linux.
     
  • Lexar JumpDrive Secure II (password)
     
    Windows XP/2000 and Mac OS X (10.2+).  One or more secure partitions with individual passwords, file "shredder" for secure deletion.  Software easier to use than most.  Recommended for persons who live in an Apple and Microsoft world.
       
  • Sandisk Cruzer Profile (up to 10 fingerprints, or password)
     
    Windows XP/2000 only.  Software easier to use than most.  Recommended fingerprint model for Windows users.
       
  • Verbatim Store 'n' Go Pro (password)
     
    Windows XP/2000 required for password/encryption features.  Basic (unencrypted) file storage for Mac OS and Linux. 

More information

All about flash drives
What they are, how they work, and links to even more information.