TrueCrypt
USB flash drives are great little devices. Gigs of information stored quickly and easily on a light weight unit you can stuff in any pocket. The downside is that these things get lost often too, and users of these devices apparently are too relaxed about them and put data that should never be on a removable drive on it. Recently I got a letter from a college I have attended, informing me that some moron in their organization of higher learning had lost a flash drive that contained a spread sheet with hundreds of students names, addresses and social security numbers, and that I should be on the look out for my hits against my credit report or any other identity theft issues. {Climbing onto soapbox} Personally I think I should not have to do a thing, that the organization that was so flippant with such sensitive data should shed large sums of money to protect those they have harmed and prosecute those who use the data. Maybe these places would then take seriously securing our information when they have huge dollars of losses resulting in their sloppiness. {Climbing back down off soapbox}.
Anyway, since I have never carried anything sensitive on my flash drives, I figured I would see how difficult, inconvenient it was to encrypt data on a flash drive to protect it. I selected the OpenSource product TrueCrypt. It is free, open and works on Windows and Linux and I can only assume that you could build it from source on a Mac. While free it has no institutional control from a central IT perspective which could be hard to deploy for an IT department, although it would not cost an organization anything to use it, so you can rule out “its too expensive to do” excuse. I installed the small application onto my Windows laptop and plugged in a flash drive. Started the application and you have two options, you can either encrypt the entire drive or just a file. Pluses and minus to each and you would have to decide which worked better for your organization, personally if I were handing out flash drives to uses the entire thing would be encrypted so that users don’t take the lazy way of copying data do the unencrypted portion. You can select the type of encryption you want and can even test the device and TrueCrypt will tell you what one is quickest and explains each method of encryption. Once the device has been encypted you launch the TrueCrypt application and mount the device. It can no longer be mounted as a regular device and has to be mounted through the application. Once mounted it simply shows as another drive in the My Computer window, start coping files to it and they are encrypted and protected. Pretty simple.
The downside I see is that it does take a few extra clicks to mount the encrypted device, but if organizations were financially responsible for the data they lost, a couple extra clicks would be no big deal. The other would be people in the organization who will always try to circumvent IT policies be cause it is too inconvenient for them. Again if you were to make the person who lost the drive, use their personal finances to offset the costs to the victims, you would not see these people try to workaround the security. The other major downside is that if you travel with the device you either need the application install on the remote computer or use the Traveler Mode of the application. The bad thing with Traveler Mode requires you to have Admin rights on the machine.
Bottom line is, it is not too difficult to protect data on removable drives and people and companies need to be held financially responsible when they do loose data.