You know the old saying, that appearances can fool you? Well, if you thought the IronKey is just another USB drive, you’d be very wrong. Jump in for the full review.

From IronKey, Inc., founded in 2005, an elite team of experts from big names such as GeoTrust, PayPal, RSA Security and VISA just to name a few, developed an amazing product that enables end-users to protect their privacy and data with something as small and portable as an USB stick.

Tough on the outside, smart on the inside; that would be a sentence to characterize the IronKey perfectly. The sensitive components of the USB stick, the memory and the cryptographic chip, are protected by the metal alloy shell and by epoxy-based filling. This means you can drop the IronKey without worrying about destroying it, and it also means it is water-proof.

The epoxy has another benefit: once it is hardened, it’s nearly impossible to conduct a physical attack on the IronKey in order to retrieve the memory chips. Which, without adequate computing power, would be completely useless since the IronKey can detect a physical attack and initiate a self-destruction sequence that permanently removes the keys from the cryptographic chip. This auto-distruct sequence is also enabled after 10 consecutive failed password attempts. The IronKey has successfully passed 140-2 tests required by the U.S. and Canadian government:

FIPS 140-2 validation is the benchmark for security within government departments and agencies. Government purchasing agents must purchase products validated for FIPS 140-2 in preference to non-validated products. To achieve validation, the IronKey underwent stringent testing by an accredited independent lab, earning the Federal Information Processing Standards (FIPS) 140-2 Level 2 certificate number 938 from the National Institute of Standards and Technology (NIST) and the Canadian Communication Security Establishment (CSE). –IronKey Press Release

In addition, IronKey also passed FIPS 186-2 – which ensures an correct implementation of “RSA, AES, SHA-1 and SHA-256 standards for digital signature generation and verification” and FIPS 197 – “certifying IronKey’s correct implementation of the AES algorithm and its various modes”.

All the information on the IronKey is safely stored, encrypted with AES 256 keys generated the first time you plug in the IronKey – not even IronKey’s employees know the keys to your data.

After the initial setup, which comprises of picking a password then waiting for the IronKey to generate the encryption keys and install the software, you’ll be welcomed by a password prompt each time you plug the device on. Various options let you choose what the next automated action will be: open the IronKey control panel, an Explorer window with your files or viewing your online IronKey account.

The IronKey comes with a free service called ‘Secure Sessions’, a secure Password Manager and a hardened version of Firefox.

• The Secure Sessions feature encrypts and routes all your web-surfing through the Tor network – ensuring anonymity online as well as protecting you against local password sniffers.
• The Password Manager remembers password you entered for various websites. This way, there’s no need to worry about keyloggers monitoring your keystrokes – the password is entered automatically for you. It also lets you generate strong passwords that are automatically remembered. This may be helful for those not familiar with GRC’s Perfect Password Generator.
• Currently, the IronKey comes with Firefox 2.0. They are currently working on some compatibility issues with Firefox 3.0. I’m not really sure how their version of Firefox is hardened, but I immediately installed NoScript, AdBlock and CustomizeGoogle. These 3 extensions easily allow you to block ads, flash and scripts from running – 90% of online threats.

If you’re thinking like me, you’re probably worried about the stick getting infected with auto-run type malware after the device is unlocked; fortunately the IronKey team has thought about that and apparently figured out a solution:

The patent-pending USB AutoRun anti-worm malware protection is available immediately on newly purchased IronKey Basic, Personal and Enterprise devices. Existing customers of IronKey Personal and Enterprise devices can remotely update their software and firmware to add this critical new security capability to their devices.

I can’t say that this is 100% effective, but I can say that I used the IronKey on a malware infested computer and nothing caught on when I ran a scan at home.

Like any USB stick, you can install portable applications such as: Chrome, Notepad++, Pidgin (Open-Source Multi-Protocol Instant Messenger Program) and VLC. The nice thing about the IronKey is that you don’t have to dig through the file system to find the launchers – you can easily integrate them into the IronKey Control Panel.

You can also automatically update the firmware for the IronKey, configure proxies and preferences for Firefox. An useful feature, Lost and Found, lets you customize a message that is shown every time the device is plugged in. If someone finds your IronKey, chances are that you’ll get it back, especially since they can’t re-use it.

There’s also an online part to the IronKey experience. Here, you can choose whether or not you want to backup your password in case you forget it, remotely disable lost devices or configure the security warnings. There’s also a feed of recent activity which will let you know if someone accessed your data without your knowledge.

The IronKey proved to be very useful to me. I can now securely check my email from potentially malicious computers, on the go; take with me even my password list or PayPal account information without being afraid that someone will recover that information. While this device certainly is more relevant to the business crowd, there are a lot of uses for the average guy and I strongly recommend this product to anyone who who thinks that security matters in this world. Go to ironkey.com.

IronKey works with Windows, Mac and Linux, altough some features may not be available on the latter platforms. For more information visit the IronKey Library.

We thank Katie Mason from Nadel Phelan, Inc. for providing the IronKey review unit.