SanDisk rolls out RSA-packin' Cruzer Enterprise flash drives
By Donald Melanson 
posted Apr 7th 2008 12:54PM
posted Apr 7th 2008 12:54PM
It looks like anyone that makes regular use of an RSA key for one reason or another could soon have a new favorite USB flash drive, with SanDisk announcing the availability of so-called "two-for-one" Cruzer Enterprise drives, which provide both secure date storage and RSA SecurID software tokens for two-factor authentication (eliminating the need for a separate hardware authenticator). The drive is also apparently no slouch when it comes to the usual storage security measures, with it boasting 256-bit AES encryption, and a setup process that requires users to create complex passwords before they're able to make use of the drive. No word on pricing just yet, but you'll apparently be able to get the drive in your choice of 1, 2, 4, or 8GB varieties, with each boasting a respectable read speed of 24MB per second and a write speed of 20MB per second.
And the easier and cheaper alternative to this drive:-
Dont let your normal flash drive out of your sight, and save money.
This is clearly not meant for end consumers, who may or may not even be keeping confidential documents on the drive. It is meant for corporate customers who already buy secure tokens for things like vpn access, and who are also looking for some heavyweight encryption on removable storage (since a population of users is going to have a certain loss rate of the drives). You solution really wouldn't fly in that environment.
And an easier and cheaper alternative to having a memory stick at all is just to REMEMBER the stuff you would have put on it... what a useless suggestion.
These things get lost all the time because they are small and unattached, not to mention that if you have any confidential data, it should not be written unencrypted to any disk, least of all a portable one.
I use TrueCrypt and TCExplorer, it's a good free option, but still a little clunky.
yeah, and easier, cheaper and AWFUL alternative, if you don't care at all what's on your flash drive. as a consultant, i use many computers and use my flash drive as a portable storehouse of many key personal and work files. as such, both encryption and online backup are great features.
Sure, and someone might accidently lose their drive with PII on it, and then have to disclose this in the news and give their company terrible PR and most probably cost them quite a bit of money...
So.. save a few dollars by going to Staples or save potential thousands, your job, and your company's by buying something secure, which would you chose?
I try not to put too crucial of information on these, but they can easily get lost.
Obviously none of the above posters (save for Josh) have ever used RSA SecurID to log in.
"which provide both secure date storage and RSA SecurID software tokens for two-factor authentication (eliminating the need for a separate hardware authenticator). "
You can encrypt any drive for free, sure, but you can't put SecurID on it and act as your authenticator.
If you don't work in an enterprise environment, you probably wouldn't understand.
SecurID Software eh? If this was a USB key and had rolling digits on it like their RSA tokens, I'd be happier.
It does have rolling digits, they're just software based.
Hardware RSA SecurID cards are soooooo 2005.
A cap? Seriously?
So, now when someone steals your flash drive, they can break the weak encryption to get at your files AND use the token to impersonate you and steal more. Sounds like a winner to me.
Give me a break, if someone is stupid enough to store the information needed to log in to their VPN on the USB drive, then they deserve it.
Just because you have the SecureID, doesn't mean that you also have the location of the VPN client, the address to use said VPN client, and the user name + pin to login with.
You obviously have no clue as to why they call it *two factor* authentication.
whats the point of a USB drive with which you can't get to your documents on a non-windows platform.
Hahaha... Oh wait, you were being serious...
Or:
Just use any USB Flash drive and Truecrypt (http://truecrypt.com).
Bonus:
Works on all systems, regardless of OS.
TrueCrypt is a great program, but I'm not sure I agree with the 'works on all systems' bit. It's not like you can just walk up to any machine and use it, since you need to install softare on the host.
You'd need executables for every OS stored on the unencrypted portion. Plus on Windows you need Administrator rights, which you probably don't have if it's not your PC (Though TCExplorer can get round this).
This is where I see the advantage of hardware based security.
Feel free to correct me... I'd be happy to learn an easier way!
"secure date storage"—I think you mean "data", unless this thing has some uses that Spitzer should have known about.
RE:Tired_ @ Apr 7th 2008 2:53PM
"So, now when someone steals your flash drive, they can break the weak encryption to get at your files AND use the token to impersonate you and steal more. Sounds like a winner to me."
Now I know why I don't normally read the comments here but I'll bite, 256 bit AES is very strong and has never been cracked so STFU if you don't know what you are talking about
http://www.slipperybrick.com/2008/02/princeton-broke-encryption-freezing-memory/
More of bypassing encryption on a PC hard disk, but certainly fallible.
It would really be funny if the RSA token was the key to the drive encryption.
Viruses, encryption, on flash drives, oh my!
I'm at RSA Conference now and they gave the schedule to us on these drives. :)
nice. But can it fit inside a dog tag? http://olinari.com
Not as good as the IronKey.
We are using this in our enterprise environment. It's an excellent alternative to regular USB's. You can track what and where a file was copied, writed or deleted. Strong authentication, AD integration, FAST r/w, easy to manage, online backups, all the content is encryped and secured, etc
I recommend this product with the CMC software for enterprise environments. Good for compliance too!
if you are a regular home user, hacker wannabe or cheapo company, get a regular USB with "security" on it.