Local governments lose or fail to track USB devices

Local authorities have admitted that they have experienced a number of cases of data loss due to the loss of devices.

In response to Freedom of Information Act requests from Apricorn, Kent County Council reported 734 breaches between January 2023 and December 2023, Surrey County Council recorded 665 breaches and Norfolk County Council 605. Other major losses were reported by Warwickshire County Council (495) and East Sussex County Council (490).

Additionally, Warwickshire County Council noted that its devices are not encrypted and the organisation relies on multi-factor authentication (MFA) to access its systems, whether using a laptop or mobile device.

Surrey County Council said peripherals are not monitored and USB sticks are the department’s responsibility and are not monitored by the asset management department.

Lancashire County Council has also stated that it does not record/document information about lost devices.

“Failure to properly document and report lost or stolen devices not only compromises the privacy and data security of individuals, but also undermines the trust and credibility of the board,” said Jon Fielding, Managing Director, EMEA, Apricorn.

“By implementing security tools and practices, such as deploying removable storage devices with built-in hardware encryption, government departments can implement this across the organization, ensuring that all data can be safely stored or moved offline. Even if a device is lost or stolen, the information will be incomprehensible to those unauthorized to access it.”

Scenario

Dan Raywood
Editor
SC Media UK

Dan Raywood is a seasoned B2B journalist with over 20 years of experience, specialising in cybersecurity for the last 15 years. He has covered topics from advanced persistent threats and nation-state hackers to major data breaches and regulatory changes. Outside of work, Dan enjoys supporting Tottenham Hotspur, managing the mischievous cats and tasting craft beers.