Re: Secure USB drive

["Ken S" <ken.securitylist () gmail com>]

I am just completing the selection of the following drives as our
corporate standards:

- mtrust mdrive 500
http://www.m-systems.com/site/en-US/Products/DiskOnKey/M-Drive/
- Kingston Data Traveler Elite - Privacy Edition
http://www.kingston.com/flash/dt_elite_privacy.asp
- Verbatim Store 'n Go Corporate Secure
http://www.verbatim.com/products/products.cfm?pc_parent=B0733EA6-8EC0-45D8-A2D2583CDBCAF4D4&pc_id=F8AA6F0B-1143-3415-5F565CF64A41FA47

They are all the same drive, except you can get a few more goodies on
the mdrive than the others (like embedded AV).  Assuming you only need
to support Windows 2000 and XP, I would highly recommend them.

FWIW, here's what we were looking for:

Basic use cases:
•  Executive needs to give a presentation at a
partner/customer/analyst site and doesn't have his/her own laptop to
use for the presentation.
•  Employee needs to have network, system, Incident Response or BCP/DR
documentation or call trees available at all times.

Specific Requirements
•  USB only.  No other flash memory medium is allowed due to lack of
authentication and encryption options.
•  100 % encryption of device data.  No unprotected "public" area allowed.
•  128-bit or better encryption.
•  Portable – able to be used on most Windows XP machines
       •  administrator rights are NOT required to use or configure.*
       •  no software is required to be installed on the local machine for use
• Hardware-based encryption. (Not software-based, due to portability issues.)
• Strong authentication
       •  Complex password:
            •  minimum length of 6 characters
            •  combination of 3 of 4: upper case, lower case,
numerals, special characters.

* Admin rights are not required on initial setup, but they are
required to subsequently change the password or reformat the drive.
There is software available from m-systems which can be installed on
desktops to allow users without admin rights to manage the drive after
initial setup.

Best of luck in your search for the right solution.

Ken

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------