How to choose the right drive for your data

It’s critical to keep personal and confidential data protected, but with several levels of data sensitivity and a wide variety of encryption options on the market, it’s not always clear what device will be the best fit for a given data protection solution. The level of protection, ease of access, form factor or capacity of a drive can all play a role in this decision – and depending on the nature of the data, stringent regulatory requirements like HIPAA, GDPR, CCPA, NIS2 and DORA may require a specific level of protection for compliance.

While many focus on securing network-based data when considering these restrictions, properly handling mobile data, such as files stored on USB drives or external solid-state drives (SSDs), often gets overlooked. Choosing the right drive is a critical part of maintaining mobile data security hygiene. Making the wrong choice can lead to severe consequences, including data breaches and legal or regulatory ramifications with penalties.

With the growing availability of advanced hacking tools, it’s more important than ever to select storage solutions that offer trusted and strong data protection. Among the many options available, hardware-encrypted USB drives and external SSDs from reputable manufacturers stand out as top-tier choices for safeguarding valuable data. However, not all drives labelled "encrypted" provide the same level of security. Here’s what you need to consider when choosing the right drive for your needs.

Must-have security features

A trusted manufacturer

When selecting a product for data protection, it’s essential to choose a trusted vendor that has been in the drive protection business for many years. A strong track record in the marketplace, along with active product testing by independent penetration testing companies is a basic requirement. There are many inexpensive drives from unknown brands on the market that provide little or no protection. Kingston has been in the business of producing hardware-encrypted drives for over 20 years and counts Fortune 100 companies, governments and the military as its regular customers.

Hardware-based encryption

One of the most important factors when selecting a drive is the type of encryption it uses – and not all encryption is the same. Think of an encryption method as a house’s front door: a screen door, plywood door and steel door with a deadbolt can all claim to provide some level of protection, but only one of those methods could hold up against an attempt to break and enter.

The same is true with different types of encryption: Hardware-based encryption is much more secure than software encryption, which can be vulnerable to brute force password attacks. The Advanced Encryption Standard (AES) in 256-bit XTS mode is considered the gold standard, offering strong protection against data breaches. Hardware encryption ensures that encryption keys are stored securely on the drive itself, reducing the risk of exposure compared to software encryption, which exposes them to the attached computer. All Kingston IronKey drives use built-in, always-on XTS-AES 256-bit hardware encryption for trusted data protection. These drives are engineered and built from the ground up as data protection devices, using secure microprocessors with certified XTS-AES 256-bit encryption.

Protection against brute force attacks

Drives should have safeguards that limit password-guessing attempts. A trusted hardware-encrypted drive will wipe its data after a certain number of incorrect password attempts, preventing unauthorised access. All IronKey drives feature brute force attack protection and will crypto-erase data when incorrect password attempts are exhausted.

Always-on encryption

It’s essential that the drive’s encryption cannot be manually enabled or disabled. Some consumer drives allow users to disable encryption, which poses a data exposure risk. For businesses and government agencies, this can result in non-compliance with data protection regulations. Always-on encryption ensures that your data is protected at all times, even in the event of human error.

Certifications and compliance

The National Institute of Standards and Technology (NIST) is the US agency that defined the AES 256-bit encryption standard and is the de facto worldwide standard-setter for data encryption. Drives that meet recognised security standards, such as NIST’s newest FIPS 140-3 Level 3, have undergone rigorous testing by a NIST-certified lab to ensure they provide strong protection against attacks and data exposures. These certifications are mandatory for government and military uses and should be a priority for businesses handling sensitive and valuable data. Kingston IronKey™ Vault Privacy 50 Series (VP50) and Vault Privacy 80 External SSD (VP80ES) drives are FIPS 197 certified to ensure they properly implement XTS-AES 256-bit encryption. The Keypad 200 Series (KP200) and the best-in-class D500S drives are FIPS 140-3 Level 3 (Pending) certified, which includes military-grade security protections, including

Advanced protection features and methods

1. BadUSB protection

BadUSB attacks exploit vulnerabilities in USB firmware to install malware. Drives equipped with RSA 2048-bit encrypted firmware (also called digitally signed firmware) can prevent this type of attack. Secure microprocessors in these drives authenticate the firmware upon startup, shutting down the drive to protect data if the signature doesn’t match.

2. Usability enhancements

Drives that offer multi-password support and user-friendly features like free-text passphrase entry with support for international characters on a graphical user interface (GUI) can improve security without sacrificing convenience. These features help users create complex, memorable passwords that are harder for attackers to guess. Kingston IronKey drives provide many of the NIST-recommended features, including the option to use passphrases instead of complex passwords.

3. No software installation

Some drives require users to download software to enable encryption, which can increase risk. Without the software, the drive remains unprotected. GUI-based drives that store authentication software on a locked partition provide a safer, more reliable solution. Additionally, hardware-encrypted drives with keypads or touchscreens, such as Kingston IronKey Keypad 200 Series (KP200) or Vault Privacy 80 External SSD (VP80ES), eliminate the need for software authentication completely, making them more versatile as they are OS-independent.

4. Passwords vs fingerprints

While fingerprint authentication might seem secure, it can be less reliable than password-based systems on USB drives which have limited controller capabilities. Fingerprint scanners are also prone to errors, and in some cases, hackers can bypass these systems. For this reason, hardware-encrypted drives with strong password features are often a better choice.

5. Protected, air-gapped backups

Protection against malware and ransomware requires backups. For small and medium-sized businesses, finding a cost-effective solution is key to ensuring business continuity. Drives such as the IronKey Vault Privacy 80ES (VP80ES), which can store up to 8TB of data, can be used to create air-gapped backups, separated from the Internet, to ensure recovery from ransomware attacks. Following a 3-2-1 backup method is the best practice to protect against such attacks and recover quickly if needed.

Summary

Choosing the right storage drive is a critical step in protecting your valuable data from cyberattacks and ensuring compliance with industry regulations. Before selecting a storage drive, carefully choose a vendor with a long track record of producing data protection solutions. Avoid the use of software encryption with consumer USB drives. Prioritise hardware-encrypted drives with XTS-AES 256-bit encryption, always-on encryption functionality and robust protection against brute force and BadUSB attacks. Additionally, seek drives with certifications such as FIPS 197 or FIPS 140-3 Level 3 to ensure they meet the highest security standards. If a drive manufacturer employs independent penetration testing companies to evaluate its drives, this indicates a well-engineered solution that the manufacturer can stand behind.

Each organisation has varying needs for data protection and security. Kingston IronKey drives provide a solution for each of these needs. For more highly classified and valuable data, IronKey best-in-class D500S (IKD500S) along with the Keypad 200 Series (KP200) offer military-grade security with FIPS 140-3 Level 3 compliant architectures, whereas for small-to-medium enterprises, Vault Privacy 50 Series (VP50) and Vault Privacy 80 External SSD (VP80ES) are ideal for admins to widely deploy.

When it comes to safeguarding sensitive information, businesses and government agencies alike can’t afford to compromise on security. By investing in a drive from a trusted manufacturer, like Kingston Technology, with a proven track record in data security, you can protect your data and minimise the chances of a costly data breach due to drive loss, theft or hacking.