Encrypted USB Enforcement Program

Stanford University security regulations require that transportation or storage of sensitive data on physical media, such as a USB drive or external hard drive, be done on an encrypted drive.

If you attest Yes to High Risk Data, security software will be deployed to your computer to ensure that any USB drive used on your computer is encrypted before you may write data to it.

The software agent (Digital Guardian (DG) on Windows, CoSoSys Endpoint Protector on Macs) will be installed on your computer. This software will prevent writing to an externally-connected USB drive that is not on the approved list of drives. You will still be allowed to copy from any drive to your computer. If the drive is an approved drive, you can both read from and write to the drive.

Can I use an encrypted drive that is not from Apricorn?

Initially, only Apricorn drives will be recognized, but other hardware-encrypted drives can be added to the list if they meet the standards for compliance. To request adding your existing hardware-encrypted drive to the policies, please go to Requesting Encrypted USB Enforcement Assistance and select the second radio button. 

Will the IT staff be able to see the contents of data being transferred between my drive and my computer?

No, this is an automated system that only identifies the make/model of the drive – it does not examine the contents of the drive or your computer.

This change will ensure sensitive data is not accidentally copied to an unencrypted device (USB flash/thumb or external drive). The loss of such a device could have serious consequences to the University and to you personally. While it has always been critical to store sensitive data on encrypted media, the School of Medicine has not previously applied technical controls to ensure that data is not written to unencrypted media.

Will I notice any performance issues?

The team has done extensive testing and any performance issues have been resolved.

What are possible issues that can occur after the agent is deployed?

Testing to date has shown minimal impact in the installation process other a reboot may be required to complete the installation. Ordinarily, you should not notice the agent other than if you attempt to write to a non-Apricorn drive.

What if I’m already using an encrypted drive?

• Apricorn drive = you can continue to transfer data to or from it.
• Any Filevault-encrypted external drive = Macs with CoSoSys EP will automatically recognize and approve these drives.   Windows/DG does not recognize drives encrypted with Filevault or Bitlocker.
  
• Non-Apricorn drive (or other previously-approved drive) =
  
  • Digital Guardian = from the ‘Justification’ prompt, describe the drive you are using and hit ‘Continue’ for short-term approval.   Submit request for long-term approval.
    
  • CoSoSys Endpoint Protector = submit request for a one-time-code or to approve your hardware-encrypted drive.
    
• To request adding your existing encrypted drive to the system policies, please go to somdrives.stanford.edu and select the second radio button. 

What happens to my USB mount for my mouse, or my phone or other accessories?

• The agent will not prompt for a mouse or phone USB mount. The prompt may appear when you copy music to an mp3 player, but once you enter Justification and Continue, you may continue the ‘write’ file operation.

What do I need to do for installation?

Nothing. The Digital Guardian software agent will be deployed to your computer via the University’s system management software (currently BigFix) just like other critical patches or security software.

Where can I get an Apricorn drive?

The School of Medicine can provide a 16GB Apricorn flash/thumb drive to SoM personnel. If you don’t already have one, submit a request using somdrives.stanford.edu.

Please Note: You will need to sign an acknowledgement with your SUNet ID and the serial number of the drive issued to you. If the device should be lost, this assists us in confirming that you were issued a drive.

Am I able to purchase additional Apricorn drives for my use? 

Yes, drives can be obtained at ofweb.stanford.edu.

• Select SU Internet Procurement
• In the Amazon Business search field, type Apricorn store
   

External drives:

• portable:  Apricorn Aegis Fortress L3 USB 3.0,  FIPS level 3
  • sizes 500GB, 1TB, 2TB, 3TB, 4TB, 5TB   ($210-$428)
  • also in solid state drives: 512GB-16TB
• desktop: Apricorn Padlock DT FIPS USB 3.0
  • sizes: 2TB, 4TB, 6TB, 8TB, 10TB, 12TB   ($185-$724)
  • also available in 16TB, 18TB directly from vendor at apricorn.com 

For assistance, please contact the TDS Service Desk at (650) 725-8000 or submit a ticket using the link below.

Is there an exception process?

If you have unusual circumstances that will impact your work, please submit a ticket and provide a full description of why this should exclude you.