We are currently in the process of allowing USB memory sticks, but with a stricter policy. Some key points in the policy is:
- Any confidential data stored on the USB drive has to be encrypted
- Always keep your USB drive with you or in a safe place if it contains sensitive data
- USB drives which are used in work situation should never be used for any private (non-business) objective.
I've read about Security Threats in this article on wikipedia: Usb_flash_drive#Security_threats, but I am having some trouble in explaining exactly how and why allowing USB sticks is dangerous. Some points I've brought up:
- Less attentive to the dangers that could be hiding on an USB drive when it becomes more accepted to use them in the business. People also might not think twice in plugging in an USB they found lying on their desk.
- Potential spreading of malware. It is quite common for malware to propagate through USB drives.
- Potential exploits to be autorun through USB drive. Example is plugging in an USB drive which is responding as a keyboard. Once it is plugged in it sends the necessary keyboard commands to fetch a file online and run it.
Does anyone have any other arguments in why it's dangerous to use USB drives, and perhaps any suggestions on policy if we need to allow them?