Portable Storage Devices

A portable storage device is storage hardware that you can carry around and plug into a computer, such as a USB flash drive, an external hard drive, a memory card or a smartphone used to store files. Using one at work is an internal threat because the danger comes from a person already inside the organisation, not from an outside attacker breaking in.

Introducing malware

When a device is connected to an organisation's computer, any malware stored on it can run or spread onto the network. A staff member may plug in a device that picked up malware on a home computer or another machine, and the malware travels with it onto work files and other machines.

Loss and theft

Portable storage devices are small, so they are easy to leave behind, drop or have stolen. If a drive holding personal data about patients, pupils or customers is lost, the data can be read or used by someone else. This is a data exposure risk even when the staff member did not mean any harm.

Device failure

Portable devices have a short lifespan. Flash memory can only be written to a limited number of times, and a hard drive's moving parts wear out, so a device can stop working after repeated use and without warning. If the only copy of a file is on that device, the file is lost.

For example, a coach at a community sports club keeps players' medical details and emergency contacts on a smartphone so they can be checked at away matches. The phone is left on a bus, so the club loses the only copy of those details and cannot control who reads them.