Sensitive information and thumbdrives

The death of the floppy and CD

Over the past few years, USB thumbdrives have largely replaced CDs, DVDs, Zips and floppies as the popular way to transfer files by hand.  They are compact, inexpensive, reusable and can hold large amounts of information.    Having gigabytes of storage in a package smaller than a pen is very convenient, but also means that data is easily misplaced.  Whether it falls out of your pocket on the bus, or is dropped out of a purse when you pull out your keys, your thumbdrive might end up lost forever. 

Sensitive information must not be 'easily lost'

Carrying unprotected sensitive information (patient records, banking/tax information, student records, etc) in a package that is easily lost is a risky prospect that is not acceptable at Emory.  This type of information should never be stored on unprotected USB thumbdrives or other portable media.   

What if it is necessary to combine sensitive and portable?

Some USB thumbdrives are specifically designed to address the concerns of storing sensitive information by using built-in hardware encryption.  These drives are more expensive, but much cheaper than dealing with the repercussions of losing sensitive information.  For situations where it is necessary to store sensitive information on a thumbdrive, Emory's Office of Information Technology has approved both IronKey Personal USB thumbdrives and Kingston Data Traveler Vault - Privacy Edition thumbdrives for this purpose.  These drives use hardware-based encryption, ensuring that all data stored on the drive is encrypted.  This removes doubts of whether encryption software was installed and configured correctly, and if a particular drive was encrypted when it was lost.  No other thumbdrives are approved for storing sensitive Emory data.

See the table below for direct links to specific products through CDWG for institutional purchases.  University departments looking for a secure file server offering should review Emory's Enterprise Storage offerings.