USB flash drives, External Hard Drives & other External Storage


Advice regarding External Storage Devices, including appropriate use, details of IT support levels, suggested alternatives & information on how to purchase.

Definition

For the purpose of this article "External Storage Device" refers to any storage medium which is not part of an IT storage service; this includes (but is not limited to); USB flash drives (USB sticks), external hard drives, CD-Rs, DVD-Rs, consumer Network Attached Storage (NAS) devices and the internal storage of portable computing devices, such as smart phones, tablets and laptops.

Protecting University Data

The University is committed to storing all data with an appropriate level of security and durability to ensure that data is accessible, secure and only visible by those authorised to access it. Everyone at the University must ensure that the use of External Storage Devices conforms to the University Information Protection Policy, specifically the section on 'Device Security':

There are serious consequences for any data security breaches. Please see these related articles for further information:

All members of the University are also responsible for ensuring that the use of external storage is in keeping with data management requirements from their funding bodies.

Appropriate use of External Storage Devices

The reliability and lack of redundancy inherent in many External Storage Devices means that they are not suitable for the storage of many categories of University data, including anything which is of such criticality that functions or operations would be disrupted should it be lost or become unavailable or corrupted.

IT supported alternatives

IT Services offer the following options for the storage, sharing & transfer of data:

Please see the related articles for information about how to access and use these services.

University network storage service

Appropriate use of External Storage Devices

There may be occasions where it is appropriate to use an External Storage Device for the storage of University data, such as:

If the External Storage Device is being used to store confidential data, then the data must either be stored in an encrypted form or kept permanently within a locked office. External Storage Devices should not be used for the storage of Highly Confidential data.

External Storage Devices should never be used to store the only copy of data which is of such criticality that functions or operations would be disrupted should it be lost or become unavailable or corrupted

What to do if you are still unsure

If you are still unsure whether or not an External Storage Device is appropriate for your requirements after reading this article, IT Services will be happy to provide further advice. Please search for ‘Log a general request’ on http://it.leeds.ac.uk or use the option in this article’s related requests section.

How to procure and encrypt External Storage Devices

Procurement

If the IT supported alternatives do not meet your requirements and you believe you have a legitimate requirement for an External Storage Device you can organise the purchase yourself via your usual purchasing route (however you would order stationary or lab consumables etc). You don't need to contact IT to procure this for you.

Encrypting USB Sticks and External Hard Drives

Many USB Sticks and External Hard Drives are available via the University's regular purchasing systems. IT Services recommend iStorage's "datashur" or "diskashur" range which include PIN authenticated hardware encryption.

Encrypting iPads and Android tablets

Encryption is enabled on an iPad by enabling a Passcode Lock.

Encryption is enabled on Android by turning it on in security settings. The exact steps to enable this will vary depending on the device.

What you can expect from IT Services

IT Services will:

IT Services will not: