Several times this year portable storage devices have been a security issue, ranging from USB keys to direct-attach USB hard drives, which are now in common use in most organizations. One point I've made about these devices is that their easy transportability is a potential security problem for IT. When anyone with a USB key can pull data off of a business computer, without regard for the security of that data, IT has a real problem.

I have listened to many domain admins describe their solutions to the portable storage security problem--everything from banning the use of USB keys in the office to disabling USB ports at the OS level. None have been completely satisfied with their solutions, however, and each solution has introduced its own set of problems affecting business workflow. I've also heard from IT Admins who've suddenly realized that portable media players are also a storage device that can copy files from their client computers and networks.

As part of a disaster-recovery plan, many companies regularly perform full backups of their network or server data and store the backups offsite. However, after spending the time and resources to secure the data, it's risky to simply store the backups offsite. You need to protect them as well.