Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We are currently in the process of allowing USB memory sticks, but with a stricter policy. Some key points in the policy is:

  • Any confidential data stored on the USB drive has to be encrypted
  • Always keep your USB drive with you or in a safe place if it contains sensitive data
  • USB drives which are used in work situation should never be used for any private (non-business) objective.

I've read about Security Threats in this article on wikipedia: Usb_flash_drive#Security_threats, but I am having some trouble in explaining exactly how and why allowing USB sticks is dangerous. Some points I've brought up:

  • Less attentive to the dangers that could be hiding on an USB drive when it becomes more accepted to use them in the business. People also might not think twice in plugging in an USB they found lying on their desk.
  • Potential spreading of malware. It is quite common for malware to propagate through USB drives.
  • Potential exploits to be autorun through USB drive. Example is plugging in an USB drive which is responding as a keyboard. Once it is plugged in it sends the necessary keyboard commands to fetch a file online and run it.

Does anyone have any other arguments in why it's dangerous to use USB drives, and perhaps any suggestions on policy if we need to allow them?

share|improve this question
add comment

3 Answers 3

up vote 8 down vote accepted

USB drives allow the propagation of data without control from the network firewall -- so any reason why such a firewall was set in the first place is a good reason to ban USB drives.

I do not see how you could enforce a policy of no-private usage. People will use USB drives to transfer private data, if only the latest photographs of their dog, and there is very little you can do to prevent that, as long as USB drives work at all for users. To enforce a security policy, you need to have at least one of the following:

  • users have no immediate interest in a cheap workaround (e.g. the USB support has been removed from the OS, so plugging a USB drive will make nothing useful to a user);
  • users understand why the policy was set, and willingly comply (fat chance on that);
  • technological safeguards are setup (but you may have a hard time making an automated tool which distinguishes business data from private data);
  • non-compliers are punished with the utmost severity (but if the users themselves do not consider USB drives as potentially harmful, they will not cooperate, thus making USB police operations very expensive).

If you want to allow usage of USB sticks, I would suggest setting it on a dedicated machine, which runs a Unix-like system (thus immune to Windows and MacOS viruses -- for extra security, aim for a confidential setup, e.g. NetBSD on an old PowerPC-based MacIntosh hardware), executes antivirus software automatically, and exports the (verified) USB drive contents through a network protocol (e.g. CIFS, or maybe a simple local HTTP server). At least this will avoid issues with USB devices which act as keyboards. Possibly, this may prompt users to exchange data through the network, removing the need for USB drives in that situation.

As for the dangers of USB devices, you can cite as example the "PSJailbreak" which is the most common PS3-breaking system as of mid-2010 (that was before the discovery of the tremendous blunder of Sony with regards to ECDSA). The PSJailbreak looks like a USB key, but internally acts as a USB hub with four virtual devices, which exploit a buffer overflow in the kernel.

share|improve this answer
add comment

I have built a business case, got funding and implemented removable media controls at a large bank. I wrote about my lessons learned here.

The key reasons on why you need removable media controls:

  • Data loss prevention - if you lose a removable device with lots of valuable data on it you don't get fined by the regulator, face data breech reporting and lose face with your stakeholders. Check datalossdb.org for some actual £/$ incidents including the massive HMRC loss.

  • Data leakage prevention - You close down one of the easiest and highest volume ways your staff can steal your information e.g. when they leave for a competitor. This is easy for senior management to understand because they are usually the biggest culprit of needing to take "personal" data. Yes there are other ways like email but people will select the most convenient, close them down one at a time or at least encrypt and monitor so you know what is being copied

  • Malware - as you mentioned. HBGary example is a good one, plenty of others. Originally I did not have this as a driver as our Desktop AV seemed to be effective. But if implementing now I would definitely push for limiting read access on USB as well as AV just is not effective against fast emerging threats.

Your policy seems reasonable but I would suggest the following changes:

  • Any non public data stored on USB and removable media needs to be encrypted. This is a lot easier for people to apply and for you to run an awareness campaign about rather than asking people to classify data which they are notoriously bad at doing

  • Only corporate provided USB drives are to be used on corporate equipment. Simple. I would suggest using a hardware encrypted drive like an Ironkey and simply blocking everything else.

  • Read and write access to removable media shall only be provided with a business reason and be approved by your line manager. Access shall be re-certified every quarter. Some companies issue 24 hour or one use USB access but I think the above provides a better balance of risk and convenience

  • Any one time copy activities will be performed by the Help-desk / Desktop support. They will have USB keys approved for this activity. Any data to be copied will be approved by your line manager and HR/Compliance if it is regarding copying of corporate data for personal use e.g. on leaving the company.

You also need an effective exception process of course for the policy, where the risk of the exception is reviewed by IT security and approved by the business.

share|improve this answer
    
+1 for suggesting use of (and restriction to) IronKey. If you're going to allow USB at all, that's the way to go. Slightly better (if it exists) would be a hardware encryption solution that requires client-side software on the PC, which would make it less likely that users will plug the stick into hardware not owned by the company. –  Iszi May 25 '11 at 13:09
    
@Iszi thanks. Yes I have made a feature request to Ironkey for allowing a certificate based authentication. This would enable easier use (no passwords) and restrict use the the corporate endpoints. However they don't trust the endpoint, which is fair in a Internet cafe or home computer situation but it would be a good option to have for enterprise. If you use software based encryption like Sanctuary (Lumension Device Control) then you can use certificates. Of course use cases need to be considered and exception process e.g if users need to copy data to supplier machines, create boot disks etc –  Rakkhi May 25 '11 at 14:25
    
Certificate-based authentication alone would be one solution. Another thing that would be nice would be two-factor authentication. That reduces the "we don't trust the endpoint" risk, while still requiring the endpoint to have a certificate. –  Iszi May 25 '11 at 16:45
    
@Iszi not sure how you would do 2FA on a USB though....SMS OTP is clunky. Maybe a soft token on mobile would work. –  Rakkhi May 26 '11 at 9:13
    
I use an IronKey myself for storing encryption keys and other sensitive data, but I remain keenly aware of its biggest limitation, which is that once unlocked, the computer has full access to all the data on the IronKey. If I plug it into an Internet cafe even in read-only mode so as not to pick up Flame 2.0, that computer can now capture all my keys. So I have to go through even more hoops to keep this data secure. Probably filling the USB ports with epoxy as they do in US embassies is the only real protection. –  Major Major Jun 6 '12 at 8:55
add comment

While USB sticks do have security risks, they are also useful. They increase productivity. I can completely understand why an organization might want to allow use of USB sticks but apply some mitigations to try to mitigate the risk as much as is possible, without loss of utility/productivity.

In that vein, one suggestion for policy would be: make sure autorun is turned off across your organization. Another suggestion is to use anti-virus software on all your Windows machine, and make sure the anti-virus software is configured to automatically scan the contents of the USB stick when it is inserted (or to scan the contents of those files on-demand when/before they are accessed).

For transferring files from one machine to another, you could consider encouraging use of write-once CD-Rs and DVDs (not the rewriteable variety). This is certainly less convenient, though to try to make it more convenient, you could try keeping supplies of blank CD-Rs/DVDs in easily accessible places. I don't know if the security benefits (which are modest) are worth the bother though.

share|improve this answer
    
+1 for sanity. The internet is incredibly dangerous but you don't see many companies banning it completely. It seems like another good thing to mention would be educating users to only use their own USB drives, and turn in any they find to the front office. –  Brendan Long Jun 6 '12 at 4:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.