Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It is prohibited to use USB drives at our office, due to security reasons. But some people still use them to steal information. It is now a great risk factor at our office.

Now we need to ensure any one will not be able to use USB drive in our Local Area Network.

How can we ensure this?

share|improve this question
    
steam information? –  Lucas Kauffman Sep 8 '12 at 7:20
    
steal, sorry i edited the question –  Md. Mahbubur Rahman Sep 8 '12 at 7:21
add comment

5 Answers

up vote 5 down vote accepted

There are pieces of software that prevent you from using the usb ports like Pointsec except if you have a "trusted" usb device. In case some people still need USB drives.

But as many of us will agree, there is nothing better than to spray epoxy in your usb ports.

share|improve this answer
    
Which softwares ? –  Md. Mahbubur Rahman Sep 8 '12 at 7:39
    
Pointsec can do this I think –  Lucas Kauffman Sep 8 '12 at 7:43
    
Just contact a salesrep of them –  Lucas Kauffman Sep 8 '12 at 7:44
add comment

I have try many hardware and software solutions of USB cotrol (I'm sysadmin). At this time I use and can recommend NetRCM. It can lock access to USB devices in a network and a lot of other features. Here is it: http://teseisoft.com/products/netrcm

share|improve this answer
    
+1 for good resource. –  Md. Mahbubur Rahman Jul 22 '13 at 3:01
add comment

Don't forget to consider process as well. For example, have you clearly communicated to everyone that USB sticks are banned in your Information Security policy?

Are you firing people found with one in their possession? (And if you haven't found one, are HR and Legal on board with firing anyone found in the future?)

share|improve this answer
add comment

This can be easily done also using group policy by following the next steps from MSDN:

Import this administrative template into Group Policy as a .adm file. See the link in the More Information section if you are unsure how to do this. CLASS MACHINE CATEGORY !!category CATEGORY !!categoryname POLICY !!policynameusb KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR" EXPLAIN !!explaintextusb PART !!labeltextusb DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 3 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY   POLICY !!policynamecd    KEYNAME "SYSTEM\CurrentControlSet\Services\Cdrom"    EXPLAIN !!explaintextcd
 PART !!labeltextcd DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 1 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY   POLICY !!policynameflpy    KEYNAME "SYSTEM\CurrentControlSet\Services\Flpydisk"    EXPLAIN

!!explaintextflpy PART !!labeltextflpy DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 3 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY   POLICY !!policynamels120    KEYNAME "SYSTEM\CurrentControlSet\Services\Sfloppy"    EXPLAIN

!!explaintextls120 PART !!labeltextls120 DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 3 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY  END CATEGORY END CATEGORY   [strings] category="Custom Policy Settings" categoryname="Restrict Drives"

policynameusb="Disable USB" policynamecd="Disable CD-ROM" policynameflpy="Disable Floppy" policynamels120="Disable High Capacity Floppy" explaintextusb="Disables the computers USB ports by disabling the usbstor.sys driver" explaintextcd="Disables the computers CD-ROM Drive by disabling the cdrom.sys driver" explaintextflpy="Disables the computers Floppy Drive by disabling the flpydisk.sys driver" explaintextls120="Disables the computers High Capacity Floppy Drive by disabling the sfloppy.sys driver" labeltextusb="Disable USB Ports" labeltextcd="Disable CD-ROM Drive" labeltextflpy="Disable Floppy Drive" labeltextls120="Disable High Capacity Floppy Drive" Enabled="Enabled" Disabled="Disabled"

For more information check http://support.microsoft.com/kb/555324

share|improve this answer
add comment

If the USB ports are not necessary, disable them in the BIOS (and password the BIOS), or simply epoxy over the USB sockets.

Some BIOSs will let you disable USB only for mass storage devices, which would seem to solve your problem. It's not a feature found on many boards, though.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.