I´m currently employed at an Hospital and with rising danger of ransomware etc. spread by usb drives we decided to block all USB-Ports (roundabout 600 Clients/Windows only) via Symantec Endpoint Protection. This blocking can determine if a device is a HID-Device (we use Smart-Card-Keyboards, Fingerprint-Mice and Voice Recorders which rely on USB in crucial areas where these Devices need to work, Input Devices like normal Mice and Keyboards are mostly PS/2) or a Storage Device. If It´s anything other than a HID-Device the Port gets locked. Also you can grant USB privileges for certain Users/Computers where they are absolutely necessary (Admin PCs, Technician PCs, etc)
It´s common Practice that users (Doctors, Managing Employees) come in with their private USB-Sticks to import data, like medical studies, presentations, pictures, etc. and want them imported in the System (simply saying no is not an option unfortunately) which is obviously a pretty huge security Risk
There is a specific Computer that is in a completely separated network where users put in their drives and they get scanned by SEP, if it´s check came out ok, an admin puts the drive in his PC (!) and copies the files to the network share the user needs. Obviously this is also not very secure, not only are we relying only on SEP for Protection but also this method is prone to BadUSB Attacks etc.
What i wanted to do
To securely integrate these foreign USB sticks I thought of a combination of different approaches:
After this step the user can take back his Drive and further working steps get done by the First Level Supporter. This first step should get rid of more "unsophisticated" attacks, like BadUSB, makro-viruses and so on.
Step 2 (AirGap1)
The First Level Supporter gets the "probably safe" USB Stick to a Machine running Qubes-OS (https://www.qubes-os.org) which is configured so that the USB-Controller is a separate VM. This Machine would then automatically check the USB-Drive with various different Antivirus applications. This should allow us to check for more sophisticated attacks like good programmed Rootkits. After the automated script running various AV-Checks the First Level Supporter takes the now "known" to be safe USB Stick and gets to a third Machine
Step 3 (AirGap2)
This Machine is a regular Windows PC that is in the Hospitals Network, SEP is installed and performs another security check on the drive before it gets Mounted, afterwards the Employee just drags the Files to the Destination the User wanted them and is finished.
Why I´m here
Unfortunately CIRCLean sounds like a neat tool but I could not find a version that runs properly (I´m not alone with that, I cannot post more than 2 Links but just look at the issues on Git).
So after all this background story, where coming to my Question:
How does one ensure foreign USB Drives are secure ? Is my approach any good, and if so, how would you "switch out" the non working CIRClean Part?