eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
IronKey has built its Enterprise D200 and S200 USB flash drives to withstand just about anything thrown at it. And I made it my goal to find out how much of a beating it could actually take.
The USB flash drives are rugged, waterproof to MIL-STD-810F specifications and meet Security Level 3 of FIPS 140-2. A tamper-resistant and tamper-evident design houses flash memory storage and a crypto chip, which provides AES 256-bit encryption in CBC mode.
For those who are price sensitive, the D200 series uses MLC flash memory, while the S200 series uses SLC flash memory to provide faster performance and longer data life. Both series share the same physical characteristics. The S200 is priced at $79 for a 1GB model, $199 for 8GBs and $299 for 16GB. The D200 is priced at $99 for a 4GB model, $129 for 8GB and $299 for 32GB. The management service costs $24 per user per year.
The IronKey drives are extraordinarily solidly constructed of flash memory embedded in military-grade epoxy wrapped in a single piece aluminum casing. To put it concisely, I beat the hell out of these things. I blame IronKey for encouraging me by sending me seven test units. I felt like I should just keep finding new ways to torture them.
The hardware didn’t flinch when thrown off the roof of a four-story building, spiked down a flight of stairs, put through the dishwasher and anchored under Barnegat Bay for a month. The body took the blow of a 20-pound weight, although the cap did split open after a direct shot. The USB connector, however, was undamaged.
I broiled the device in the toaster oven at 325 degrees for 15 minutes, at which time the plastic over the “in use” LED melted into a brown gooey mess. I allowed the drive to cool to room temperature and then plugged it in, and it didn’t work. Fascinatingly, a cheap USB drive did work after being subjected to the same broiling. IronKey specifies maximum operating temperature at 70 degrees C, or 158 degrees F, which is reasonable-exposing the hardware to such heat would be a rather unusual use case.
IronKey provides a hosted (SAAS) management solution for enterprise customers to enroll, deploy and manage devices once they create an online account. The company does provide an on-premises software solution, but since, according to IronKey, most of its clients opt for the online service, I chose to review that. First I created a management account and a default security policy. Then I enrolled devices based on serial number in the management console and applied a security configuration prior to deploying to end users. Devices are shipped with bar codes etched into them that are mapped to serial numbers stored on the device to enable rapid deployment and asset tracking. Units can go very quickly from their boxes to providing users with preconfigured and secure portable storage environments.
The device can be configured to not only provide encrypted storage but to also self-defend. I installed the Silver Bullet Service, an optional management feature that checks and applies security policy from the IronKey server over the Internet when a drive is connected and log-in is attempted. With the Silver Bullet Service, I set and verified the functioning of drives to deny access if the security policy could not be accessed online, lock out the user or issue a self-destruct command, in which case the crypto chip is destroyed and the data is deleted from the flash memory.
I easily placed restrictions on location based on the network the host is connected to when the device is attached. This could be useful in a situation where employees can use devices at work but not on the road or at home. Configuration options are extensive: The device can be set to pull a configuration script from a URL or to route all traffic through a proxy, where the traffic can be secured and audited. On a device or group basis, I could prevent read and/or write, and applied Lockdown Autorun to prevent executables from running on the drive. Between read-only and preventing executables from running from removable media, I had the beginning of a larger anti-malware campaign.
There are tools to help create secure backups either on the drive or from the drive. These can be preconfigured by an administrator or manually invoked by the user. From the management console, it was very easy to choose which features and applications to deploy to individual units. I chose to deploy the full suite, but could just as easily have deployed the units as storage only.
When I plugged in the D200 (or S200, they are functionally the same), I went to My Computer, double-clicked IronKey Unlocker and then double-clicked IronKey.exe to launch the IronKey Control Panel. Secure versions of applications such as Mozilla Firefox can be run from the S200. First-time users can orient themselves rapidly by reading the PDF “IronKey Enterprise User Guide.” Identity Manager stores and protects usernames and passwords-either automatically as each site is visited or manually keyed in and saved. A virtual keyboard pops up on-screen whenever a user is prompted for a password to prevent keyloggers from stealing them. I enjoyed being able to toggle Secure Sessions on and off with a single click from within Firefox. Toggling this switch enables Tor (The Onion Router), an open-source HTTP proxy that renders user IP addresses untraceable-and therefore safer from attacks. There’s nothing saved to the drive and nothing run from the drive, Firefox is proxied through Tor, and your users are looking pretty clean in the outside world.
Performance for the D200 was rated at up to 25MB/s read and 17MB/s write. The best result obtained through ATTO Disk Benchmark was 27.5MB/s read and 11.3MB/s write. I copied a 700MB file to the drive in 71.9 seconds (9.7MB/s) and back in 30.0 seconds (23.3MB/s). For the S200, the device is rated at 27MBps read and 24MB/s write, a significant difference from the 26.9MB/s read and 14.5MB/s write that I measured in ATTO. I copied a 361MB file to the S200 in 30.5 seconds (11.8MB/s) and from the S200 in 17.8 seconds (20.2MB/s). These are very respectable numbers, although it is worth noting that write speeds are well below the manufacturer’s ratings. For reference, a “normal” or “el cheapo” USB stick does 24.0 MB/s read and 6.6MB/s write in ATTO.
IronKey is compatible with a wider variety of operating systems than the competition, such as Windows 7, Vista, XP SP2 and 2000 SP4; Mac OS X 10.4+; and Linux 2.6+. I had no problem using the S200 on various flavors of Windows and Linux. For a far-flung enterprise, this is significant: A device could be preconfigured and prepopulated with important information, mount on just about anything, and run its own secure environment. In my case, I connected my S200, launched Firefox, installed the Xmarks plug-in and had access to all of my bookmarks. I could just as easily had essential policies, procedures, manuals and other documentation saved to the drive.
Sending field agents a netbook and a preconfigured IronKey is something worth considering if your business or agency compels quick mobilization.