Many companies are focused on improving IT security in light of the increased use of smartphones and tablets in business. But there’s another portable computing device responsible for security troubles, as well:

Portable USB drives.

Though they’re certainly convenient for transferring data from location to location, those tiny, portable and easily misplaced storage devices have also been responsible for plenty of data breaches. Those devices are also a common method of spreading malware.

It was recently revealed that in 2012, an unidentified US power plant was hit by a malware attack that originated from a USB drive.

The incident occurred when a third-party technician used a USB drive to upload a software update during a scheduled outage, according to Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), which was called to intervene. The drive contained malware which was only discovered later after it was plugged into a computer with more up-to-date antivirus software.

No one details were given about how exactly the malware worked, but the infection led to about three weeks of downtime for the plant.

Stop USB drive malware

This isn’t the first time malware has hit an organization due to an infected USB drive. In fact, one study from 2010 estimated that one-in-eight malware attacks were related to a USB device. In another study, 33 out of 50 lost USB drives uncovered at a train station in Sydney were infected with viruses. (And in addition to that, none of them were encrypted and many contained sensitive personal or work-related information.)

Here are some USB security tips businesses can use to keep their tech systems safe:

• Disable USB ports for employees who don’t need them
• Disable PCs’ auto-run function for USB drives
• Distribute secure, encrypted USB drives to employees that may need those devices for work, and
• Make sure antivirus software is installed and updated.

Tags: cyber attack, malware, USB