Emailed Password-Protected Documents: The New and Silent Breach

We rely a lot on emails

Emailing, whether for personal or business purposes, is ubiquitous in our modern way of life. In the wake of the COVID pandemic, businesses rely more and more on remote meetings versus personal visits. As a result, company workers share more files with colleagues, clients, customers, or other third parties (e.g. service providers, contractors, financial, legal and engineering partners, etc). It is more important than ever that we feel secure when attaching files with sensitive information to our emails–that we can trust that our sensitive data is secure with email providers that properly encrypt our messages, end-to-end.

Many people go further. Applications such as Word, Excel®, Adobe® Acrobat®, and numerous others allow users to password-protect a file. This built-in encryption is intended to boost confidence that the data within will be kept secure, accessible only to the intended recipients with the correct password.

However, this confidence can be misplaced. IT departments do not routinely check outgoing emails for potential breaches of protected data, as data on its own or in cloud servers as required by laws and regulations. In many cases, a contractor with an email breach may not report it to its partners.

Effective brute force attack protection

All accesses to an IronKey drive are routed through the secure microprocessor. To allow access to the data, the secure microprocessor requires either a valid password or a PIN for keypad drives. The secure microprocessor keeps a count of invalid password retries (if you ever had a cell phone reset on you, you know how it works). IronKey drives allow multiple passwords, Admin, User and One-Time Reset. If One-Time Reset or User passwords are entered wrong 10 times in a row, the drive will lock the passwords. If the primary Admin password is entered wrong 10 times in a row, the secure microprocessor will engage in a data self-destruct mode – it will execute a crypto-erase of all encryption parameters, format the data storage, and reset the drive to factory state. At this point, the data previously stored on the drive is lost forever. This is the defense against most attacks that you want for your sensitive data.

Best practices for securing sensitive data

Unfortunately, electronic transmission of password-protected files by email or posting on a cloud server can lead to data breaches as the files themselves cannot be protected with today’s AI and computer technologies. The best security requires that mobile data be transported physically in your possession – in your pocket or in your bag. Then, it can be shared with the other party. Or, you can ship the drive to your customer/partner and tell them how to access the data. The drive can be left with them to keep the data secure and off-the-grid. IronKey external SSDs with capacities up to 8TB can provide strong security for a range of professionals, from law firms all the way to providers of medical or financial services.

Many manufacturers no longer email key intellectual property documents and details, instead shipping IronKey drives to others (often in different countries) and following up with instructions on accessing the data. IronKey drives allow Admin role to set a global read-only mode, which prevents any alteration of the files when a User password accesses them.

IronKey drives follow the best practices of the CIA Triad and are an inexpensive insurance to keep your sensitive data secure and protected to the best extent commercially possible. In the end, it is all about the perceived value of your information.