Over the past few months, I’ve been moving from one hotel to a flight and into another
work trip after being home for a few days so I needed ways that I can quickly access
my files but keep them secure, especially if I'm switching from a laptop to my PC or
vice versa.
I often can't rely on cloud storage for data since I sometimes don't have reliable and
secure internet access, so I've been relying on local storage that I can access from any
computer I'm on at the time but that is secure so I don't have to worry about anyone gaining
access to important data without my consent.
I found three portable data storage options that can allow you to be on the go and secure
at the same time.
Kingston Technology is partnering with me on a couple of videos this season, to show
you how these products work and why hardware security is important.
I actually got to take these 3 Kingston Ironkey products with me on an adventure so I've gotten
a chance to use them in a real life scenario where you'd need encrypted data storage.
Huge thank you to Kingston for sponsoring this video and sending these out for me to
test hands on.
The first device for my demo today is the IronKey Keypad 200 USB, which uses the USB
3.2 Gen 1 interface in a little case with a keypad.
It comes in 8, 16, 32, 64, or 128 GB storage sizes and it’s IP57 weather resistant.
This USB drive is totally OS agnostic so you can use it with any platform as needed, including
on mobile.
It uses XTS AES 267 bit hardware based encryption and is FIPS 140-3 level 3 pending certified
for military grade use - which is a specification published by NIST.
It has a few optional read only modes which can protect against malware from untrusted
systems or machines.
The Global mode makes it read only and can only be reset by the admin.
The session only mode can be set by the user.
It also protects against brute force attempts by locking the device if a user attempts 10
unsuccessful logins.
If the Admin PIN is incorrectly attempted 10 times, it’ll erase the drive, destroy
the data and reformat.
This one is unique because it uses a rechargeable battery that’s secured by epoxy to the casing,
and it comes with a 3 yr warranty, and the keypad can be used to unlock it without any
software before it’s plugged into a machine.
Inside the casing, the circuitry is covered in a tough epoxy to make it harder for attacks
to occur against the semiconductor components and make it tamper evident.
The keypad itself is covered in polymer to protect the keys from fingerprint analysis.
*This little lightweight USB Drive uses FIPS 197 certified AND XTS-AES 256 bit encryption
and also protects the user from attacks like BadUSB (since it has digitally signed firmware)
and brute force attacks*.
It uses the USB 3.2 Gen 1 interface and comes in 8, 16, 32, 64, 128, or 256 GB.
This one can also be used in read only mode - which means it’ll be write protected against
malware attacks or if you have to plug it into an untrusted system.
For businesses, that could be extremely useful if having to carry data from one machine to
another, since we know USB drives can be used in attacks going back to the days of Stuxnet.
Since this one doesn’t have any kind of screen or touchpad on it, you can use a virtual
keyboard to enter your password, which can also protect against keyloggers.
I noticed upon first setup that I had the option of setting a complex password or a
passphrase.
The complex password could be 6-16 characters long using 3 out of 4 character sets.
The passphrase mode allows for a numeric PIN, a sentence or list of words at 10 to 64 characters
long.
So it can be something unique to you, and easy to remember.
The Ironkey VP50 can be used on Windows
and Mac.
The Kingston Ironkey VP80 External SSD is my 3rd choice, and the one I recently shared
a full detailed review on.
I've been using this one since the summertime and love that I can edit my 4k videos off
of it with no issues.
In fact, between July and now, all of my videos on my channel have been edited from this VP80ES.
I've stored all of my video and audio files on this thing, as well as my editing project
files, and it keeps the process smooth and is quite reliable.
The SSD is very much plug and play.
First boot just requires that you set up a pin code on the little screen, then you can
access your settings to change options.
You can change how many times the password can be entered before the data gets wiped,
how long your password is, an auto lock time and more.
This SSD is also hardware encrypted with FIPS Certified XTS AES 256 bit encryption and it
uses a common criteria EAL5+ certified secure microprocessor which is a component on the
actual drive.
One great question I've seen is if a thief steals your hardware encrypted drive, couldn't
they just remove it from the shell casing, put it in another case, and access your data.
In other words, is the encryption happening in the case or actually on the SSD?
The encryption actually happens on the drive thanks to a chip found on the actual drive,
so if a thief rips your drive out of this shell, the drive is still encrypted.
The drive has the XTS AES 256 bit encryption built into it, and it won’t work without
the original casing because the authentication of cryptographic keys inside the CC EAL5+
secure processor is required before decrypting data on the drive.
If a thief steals the device and does try to brute force their way in by guessing the
password but fails - the device reformats itself in FAT32.
The second question I see is what’s the difference between hardware and software security?
That’s a great question too.
Hardware encryption happens when a drive like the ones in this video have a dedicated processor
chip physically on the encrypted drive, which contains a random number generator to generate
the encryption key.
The user or admin’s password unlocks this key.
This offloads encryption from the main host system to increase performance but still guards
the keys and keeps authentication directly on the hardware.
The encryption is “always on” since it’s tied to a specific device and there’s no
additional drivers or software needed on the host PC or client machines, so that gives
it the ability to be platform agnostic.
Hardware encryption also protects against brute force attacks, cold boot attacks, and
specific attacks like BadUSB.
Software encryption has a place too.
In this case, you use encryption software to encrypt all sorts of media devices, and
often it’s really cost effective.
The trade off is software encryption is only as secure as the computer you’re encrypting
your device from.
So your choice as to what works best for you really comes down to what your threat modeling
scenario looks like.
Are you running around with proprietary information for your company?
Or do you need to give multiple people access to protected information about clients?
I generally go for the encrypted SSD so I can carry around my video projects, which
do take up tons of storage, and contracts that I need to work on, etc - so in that sense,
encryption is important to me.
So these are 3 different ways you can protect your digital life on the go.
Each one gives you a slightly different experience depending on your needs.
I’d love to know your questions below in the comments, and if you found this overview
helpful, subscribe for more!
Thanks for watching, I’m Shannon Morse, bye yall!