What is a USB?

A USB flash drive, also known as a thumb or jump drive, is an external storage device which can be plugged into a computer’s USB ports to store and retrieve files. They are a popular option for storing and transporting files as they are readily available, inexpensive, and portable. These drives are removable, rewritable, and have a storage capacity ranging from 8GB to 2TB.

Considerations when choosing to use USB devices

The convenience of a USB device’s small size and its portability make them popular for users and also make them easy to misplace and attractive to cyber attackers. These devices could be loaded with  Malware designed to infect the machine and/or the network. This type of attack or the loss of a device containing sensitive data can lead to loss of productivity, and a costly data breach. It could result in damage to the University of Waterloo’s reputation. 

Alternatives to using USB storage devices

Before storing sensitive data on a USB device consider alternative options for file sharing, collaboration and back-ups, such as:

1. Sendit – secure file transfer service

   • Recommended for large files that contain information classified as Restricted

   • Log in at sendit.uwaterloo.ca using your WatIAM credentials and refer to the IST knowledge base article, Sendit, for detailed instructions

2. Cloud computing

   • SharePoint - collaboration environment

     • Share/create files with cross-functional groups on campus

     • Configured as an intranet and requires a nexus login to access

   • Microsoft 365 – cloud storage and a collaboration environment

     • 5TB available to store files in one place via OneDrive

     • Share/Create files internally and externally and retrieve them from any device

   • Microsoft Teams – Secure chat application for communication

     • Collaborate in real-time with users across campus by creating a team

     • Share/Create files among Team members

Using a USB device securely

Although portable USB drives have inherited security risks, there may be times that it is the most practical option. Follow these tips to use a USB securely:

1. Do not plug an unknown USB device into your computer. A found USB should be submitted to IT support.

2. Disable “autorun” features on removable media.

3. Scan the USB using an anti-virus software before opening the device.

4. Encrypt the device. Encryption is a great way to prevent data breaches, security incidents and sensitive data falling into the wrong hands. When retrieving the encrypted files from the device, ensure that the machine used to open files is also encrypted to maintain the security integrity. 

Recommended options

Windows – BitLocker To Go

BitLocker To Go uses Advanced Encryption Standard (XTS-AES-128) with key lengths of 256 bits.  It is not compatible outside its respective OS. The following instructions are only for currently supported version of Windows: 10 and 11.

1. Plug the USB drive into the correct port on a Windows device.

2. Search for ‘Manage BitLocker’ from the Windows search menu and open.

3. Under Removable data drives – BitLocker to Go, select the drive to be encrypted.

4. Select Turn on BitLocker.

5. Create a strong password that will meet BitLocker To Go’s requirements and IST’s Password Standards. 

6. Enter the secure password a second time and click Next.

7. Save or print the recovery key to a secure location. The USB drive contents can be recovered when the password if forgotten using the recovery key. The key can be saved by printing it as a PDF and can be saved to a different location other than the USB device. This location should also be encrypted. 

   • Select Print the recovery key

   • Select Microsoft Print to PDF

   • Save the PDF in a secure location or print the document and file securely

8. Click Next

9. Select how much of the drive to encrypt initially.

• Please note that BitLocker automatically encrypts new data as it is added

  • For a new drive, select “Encrypt used disk space only”

  • For a previously used drive, select “Encrypt entire drive”.

10.  Click Next to start the encryption process.

11.  Click Close. The drive is now encrypted.

Unlocking the Encrypted USB

1. Plug the USB drive into the correct port on a Windows device.

2. Search for ‘Manage BitLocker’ from the Windows search menu and open.

3. Under Removable data drives – BitLocker to Go, select the drive to opened and click the Unlock drive option.

4. Enter the password and confirm.

5. If the password is forgotten, click More options and enter the 48-digit recovery key.

Manage BitLocker To Go Encryption

1. Plug the USB drive into the correct port on a Windows device.

2. Search for ‘Manage BitLocker’ from the Windows search menu and open.

3. Under Removable data drives – BitLocker to Go, select the drive to be managed

4. From this menu you can:

   1. Back up the recovery key:  obtain the recovery key for the drive encryption

   2. Change password: to revise the password

   3. Remove Password: remove the password protection (not recommended)

   4. Add smart card: add a smart card instead of a password.

   5. Turn on auto unlock:  USB drive opens automatically (not recommended)

   6. Turn off BitLocker: decrypts the USB drive

macOS – APFS

APFS uses the Advanced Encryption Standard (XTS-AES-128) encryption with key lengths of 256 bits. It is not compatible outside its respective OS. Flash drives with the FAT file system must be formatted, therefore, the flash drive should have everything deleted before starting the process.  The following instructions are only for currently supported versions of macOS: 10.15 Catalina, 11.x Big Sur, and 12.x Monterey.

To format the USB drive before encrypting

1. Plug the USB drive into the correct port on the Mac device.

2. Open the Disk Utility app from the Applications/Utilities menu.

3. From the toolbar click the View button and select Show All Devices if it is not already ticked.

4. From the sidebar click on the top-level name of the USB drive and select Erase.

5. Name the USB drive.  

6. Select GUID Partition Map from the Scheme dropdown menu to see the encryption option in the Format dropdown.

7. Select APFS (Encrypted).

8. Click the Erase button.

9. The USB drive will now be ready for encryption.

To encrypt the USB drive with APFS

1. Plug the USB drive into the correct port on the Mac device.

2. Select the drive from the desktop, right-click, and select Encrypt.

3. Create a strong password that will meet APFS’ requirements and IST’s Password Standards. Enter the secure password a second time.  This password cannot be recovered or reset.

4. Enter a password hint and click Choose.

5. Click Encrypt disk. The drive is now encrypted.

Unlocking the encrypted USB drive

1. Plug the USB drive into the correct port on the Mac device.

2. Launch Finder and right-click the encrypted USB drive.

3. Select the Decrypt option.

4. Enter the password and confirm.

Related articles