Unvetted USB Drives and Mixed Systems: A Military Lesson in Basic Security Hygiene

The Register's weekly PWNED column recently highlighted a security failure inside the US Air Force. Justin Henkel, now CISO at SolarWinds, previously worked in Air Force IT security. He recalled that in the early 2000s, mission data was burned to CDs that moved between unclassified and classified systems before being loaded into aircraft. The data helped pilots navigate and contained information about threats they might face.

When USB thumb drives replaced discs, the same habit continued. Henkel said pilots used one device on both types of system and did not grasp that a USB drive can be written to as well as read, which means it can carry malware. In his words, they were "not really understanding the overall threat picture."

The risk grew because personnel often bought flash drives from local vendors instead of official military suppliers. Henkel said it was harder to bring a US-based computer into the country than to buy locally, so staff would simply ask vendors for large batches of USB sticks. According to Henkel, enemies of the US noticed and began selling infected drives to local vendors in the Middle East. He knew moving data this way between classified systems was a recipe for disaster, but said no one would listen to him.

This account comes from the opening of the article, so it is only part of the full story.