Employees are aware of USB drive security risks, but don’t follow best practices