Lost USB sticks cost enterprises millions

That was evident in a study released today by the Ponemon Institute, of Traverse, Mich. Ponemon estimates that the more-than-700 organizations studied in the survey will lose as much as $2.5 million because of missing memory sticks.
On average, the companies lost 12,000 customer, consumer, and employee records on missing USB sticks, the study explained. At an average cost of $214 a record, that amounts to losses that could go north of $2.5 million for the companies in the survey.

"While these devices may be small," the study said, "the data breaches that can result from lost or stolen USBs are huge. More than 70 percent of respondents in this study say that they are absolutely certain (47 percent) or believe that it was most likely (23 percent) that a data breach was caused by sensitive or confidential information contained on a missing USB drive."

In addition, nearly half (47 percent) the 743 IT and IT security practitioners in the study said they were "absolutely certain that their organization experienced the loss of sensitive or confidential information on a missing USB drive during the past two years," as shown in the chart below, which appeared in the Ponemon report.

Despite the dangers USB sticks pose to organizations, security surrounding the devices remain lax, the surveyors found. "We believe the lesson to be learned from the research is that organizations do understand they are at risk because of employees’ negligence, but are not taking the necessary steps to secure USB drives," the study reported. “The main reasons cited for not being proactive include: Uncertainty about monitoring and tracking USB use in the workplace, desire not to diminish productivity, and the reliance on employee integrity and trustworthiness."