In the context of business use of laptops with sensitive data, we need to prevent data leaks. We cannot disable usb interfaces because it is needed for external keyboard, mouse, webcam and authentication with a card reader. Moreover, we may need to keep the usage of usb drives.
One solution would be to use authenticated encrypted flash drives which can only be read in clear when the laptop is connected to the company network thanks to a PKI, and no other storage drives than authorized ones can be mounted.
- How can this be performed?
- Is there a better solution?
- For most users, it may be enough and safer to disable completely usb drivers for storage devices. How to perform this both on Windows and Linux?