Transcript
By: Brian C. Pascale, Andrew L. Weitz, & Marion D. Livermore on behalf of the Technology Committee
iStorage datAshur Pro 3.0 Millions of external data storage devices are lost or stolen every year. This figure does not even include lost and stolen laptops, tablets, and phones. The impact of losing a nonencrypted USB device can have a devastating effect on lawyers and their firms. It could lead to sanctions, embarrassment, adverse media attention or loss of clients. It could also open you or your firm to extortion if the device is found by the wrong person. An encrypted USB flash drive can protect against all of this. CAPACITIES: 8, 16, 32 & 64GB
SPEED: USB 3.0
NOTABLE FEATURES: 100% Military Grade Encryption Works on All Operating Systems & Platforms Timeout & Auto-Lock Capable Brute Force Hack Defense Mechanism Bad USB Immune Dust & Water Resistant
With data breaches and cyber security failures being in the news constantly, some hitting too close to home for some of us, the Academy Technology Committee believed it was important to look into a secure USB storage device for our membership. When searching for the right device, the Committee prioritized a few requirements: the device had to be encrypted, fast, and available in different storage capacities to suit the individual needs of each user. Two companies, iStorage and Apricorn, provided the Committee with their latest secure USB drives for comparison. The devices tested were the iStorage datAshur Pro and Apricorn Secure Key. Both devices were 32GB, which is large enough to hold most firms’ entire document servers. Both drives used the newer USB 3.0, so they were far faster than any USB drive we had previously used. Unlike most commercially available USB flash drives, both devices were made of metal and featured programmable alphanumeric keypads to unlock each device.
The Committee unanimously found that the iStorage datAshur Pro was simpler to use and program. It was also considerably smaller and lighter than the Apricorn Secure Key. While the size and weight may not seem important when selecting the right USB drive, most members of the Committee found that the Secure Key’s increased heft pulled down on the USB port, risking damage to the port itself, the drive, or both. In addition, the datAshur Pro is Operating System and Platform Independent meaning it will work for Windows, Mac, Linux, Chrome, Android and Thin Client users. However, one complaint some members had concerning the smaller size of the datAshur Pro was some difficulty entering the PIN numbers on the keypad. Based upon this review, the Technology Committee believes that any practitioner who uses portable data storage drives should consider investing in the iStorage datAshur Pro 3.0. The drive’s retail prices for the different storage sizes are $100 (8GB), $129 (16GB), $159 (32GB), and $188 (64GB). iStorage has been generous enough to provide Academy members a 15% discount off MSRP if they use discount code NYSATL16 at checkout. To purchase your own secure flash drive use the following link: www.istorageuk.com/product/datashur-pro/.
Beneficial Features of the iStorage datAshur Pro 3.0 EXTERNAL ALPHANUMERIC PIN KEYPAD: The first thing users notice is an alphanumeric keypad on one side of the device. The datAshur Pro has a built-in rechargeable battery allowing the user to enter a 7-15 digit PIN onto the keypad before connecting the drive to a USB port. The device supports having dual Admin and User Independent PINs. Above the keypad are two padlock symbols with red/green colored LED’s above allowing users to easily identify whether the device is locked. REAL-TIME MILITARY GRADE ENCRYPTION: All data transferred to the datAshur Pro is encrypted in real-time with built in military grade XTS-AES 256-bit hardware encryption1 using a FIPS PUB 197 Validated Encryption Algorithm.2 This protects your information from unauthorized access, even if your device is lost or stolen. iStorage has submitted the datAshur Pro for multiple certifications with the various authoritative bodies. The following pending certifications are expected to be granted in the near future: FIPS 140-2 Level 33; CESG CPA Foundation Grade Level 24; and NLNCSA5 Level 2.
TIMEOUT LOCK & AUTO-LOCK C APABLE: The secure drive also has a timeout lock which will lock the device after a predetermined amount of time. This means that users only have a set amount of time to plug the drive into the USB port before the drive will automatically lock and require that the PIN be re-entered. Further fool-proofing the security of this device is the auto-lock feature which automatically locks the drive when it is removed from the USB port, requiring entry of the PIN to unlock it again. SELF -DEFENSE MECHANISM: The datAshur Pro further protects data through the use of a Brute Force Hack Defense Mechanism. A “brute-force attack” is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works. The datAshur Pro prevents this because it is unlocked using the device’s own keypad and not through a keyboard. If both Admin and User Independent PINs have been created and an incorrect PIN is entered 10 consecutive times, the datAshur Pro’s brute force mechanism triggers and the User PIN is deleted. The drive will only be able to be accessed then with the Admin PIN. If the incorrect Admin PIN is attempted 10 consecutive times, then the encryption key and all data will be deleted from the device and the datAshur Pro will revert to its factory default settings. It will also need to be formatted before it can be reused. IMMUNE TO BADUSB: “BadUSB” is a hack that writes – or overwrites – a USB device’s firmware code to carry out malicious actions covertly. The computer is unable to detect the firmware code, while the malware is capable of interacting with and modifying software on the host computer. The malicious firmware code can plant other malware, steal information, divert Internet traffic, etc. Worse, it may not be detectable through virus scans. The datAshur Pro is immune to this hack. RUGGED HOUSING: The device is both dust and water resistant due to its metal housing that is certified to IP57 Standard.6
http://csrc.nist.gov/groups/STM/cavp/documents/aes/aesval.html http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf 3 The Federal Information Processing Standard (FIPS) Publication 140-2, (FIPS PUB 140-2), is a U.S. government computer security standard used to accredit cryptographic modules. http://csrc.nist.gov/groups/STM/cmvp/standards.html#02 4 CPA is an accreditation process for products to be used by government, public sector and industries requiring access to government accredited networks. https://www.digitalmarketplace.service.gov.uk/g-cloud/services/7044013343961613 5 Netherlands National Communications Security Agency. 6 The IP Code or International Protection Rating, consists of the letters IP followed by two digits and an optional letter. As defined in international standard IEC 60529, it classifies the degrees of protection provided against the intrusion of solid objects (including body parts like hands and fingers), dust, accidental contact, and water in electrical enclosures. 1 2
