Security Review Finds Kingston IronKey Locker+50 G2 Provides Strong Encryption but Not Impervious to Attack
What Happened — ZDNet tested the Kingston IronKey Locker+50 G2 hardware‑encrypted USB drive and confirmed it uses military‑grade AES‑256 encryption with built‑in brute‑force protection. The review notes practical limitations (USB‑A connector, removable cap) and that no publicly disclosed exploits currently bypass the encryption, but stresses that physical loss still poses a data‑exposure risk.
Why It Matters for TPRM —
- Hardware‑encrypted removable media remain a common vector for data loss in third‑party environments.
- Vendor‑supplied encryption claims must be validated against independent testing before relying on them for compliance.
- Physical security controls (caps, lanyards, device tracking) are required to complement cryptographic protection.
Who Is Affected — Enterprises across all sectors that use removable storage for PHI, PII, or proprietary data; especially finance, healthcare, and legal firms that outsource data handling to contractors.
Recommended Actions —
- Inventory all third‑party removable media and verify encryption specifications.
- Enforce policies that require hardware‑encrypted drives with tamper‑evident caps and mandatory key management.
- Incorporate physical loss‑prevention controls (secure storage, asset tagging) into vendor risk assessments.
Technical Notes — The IronKey uses AES‑256 XTS mode with a tamper‑detecting cap and a self‑destruct mechanism after a configurable number of failed unlock attempts. No CVE or zero‑day exploit was identified; the primary risk is loss or theft of the device. Source: https://www.zdnet.com/article/kingston-ironkey-locker50-g2-review/