How to restrict flash drives in Local Area Network

Question

It is prohibited to use USB drives at our office, due to security reasons. But some people still use them to steal information. It is now a great risk factor at our office.

Now we need to ensure any one will not be able to use USB drive in our Local Area Network.

How can we ensure this?

Answer 1

There are pieces of software that prevent you from using the usb ports like Pointsec except if you have a "trusted" usb device. In case some people still need USB drives.

But as many of us will agree, there is nothing better than to spray epoxy in your usb ports.

Answer 2

If the USB ports are not necessary, disable them in the BIOS (and password the BIOS), or simply epoxy over the USB sockets.

Some BIOSs will let you disable USB only for mass storage devices, which would seem to solve your problem. It's not a feature found on many boards, though.

Answer 3

This can be easily done also using group policy by following the next steps from MSDN:

Import this administrative template into Group Policy as a .adm file. See the link in the More Information section if you are unsure how to do this. CLASS MACHINE CATEGORY !!category CATEGORY !!categoryname POLICY !!policynameusb KEYNAME "SYSTEM\CurrentControlSet\Services\USBSTOR" EXPLAIN !!explaintextusb PART !!labeltextusb DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 3 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY   POLICY !!policynamecd    KEYNAME "SYSTEM\CurrentControlSet\Services\Cdrom"    EXPLAIN !!explaintextcd
 PART !!labeltextcd DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 1 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY   POLICY !!policynameflpy    KEYNAME "SYSTEM\CurrentControlSet\Services\Flpydisk"    EXPLAIN

!!explaintextflpy PART !!labeltextflpy DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 3 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY   POLICY !!policynamels120    KEYNAME "SYSTEM\CurrentControlSet\Services\Sfloppy"    EXPLAIN

!!explaintextls120 PART !!labeltextls120 DROPDOWNLIST REQUIRED

   VALUENAME "Start"
   ITEMLIST
    NAME !!Disabled VALUE NUMERIC 3 DEFAULT
    NAME !!Enabled VALUE NUMERIC 4
   END ITEMLIST
 END PART    END POLICY  END CATEGORY END CATEGORY   [strings] category="Custom Policy Settings" categoryname="Restrict Drives"

policynameusb="Disable USB" policynamecd="Disable CD-ROM" policynameflpy="Disable Floppy" policynamels120="Disable High Capacity Floppy" explaintextusb="Disables the computers USB ports by disabling the usbstor.sys driver" explaintextcd="Disables the computers CD-ROM Drive by disabling the cdrom.sys driver" explaintextflpy="Disables the computers Floppy Drive by disabling the flpydisk.sys driver" explaintextls120="Disables the computers High Capacity Floppy Drive by disabling the sfloppy.sys driver" labeltextusb="Disable USB Ports" labeltextcd="Disable CD-ROM Drive" labeltextflpy="Disable Floppy Drive" labeltextls120="Disable High Capacity Floppy Drive" Enabled="Enabled" Disabled="Disabled"

For more information check http://support.microsoft.com/kb/555324

Answer 4

Don't forget to consider process as well. For example, have you clearly communicated to everyone that USB sticks are banned in your Information Security policy?

Are you firing people found with one in their possession? (And if you haven't found one, are HR and Legal on board with firing anyone found in the future?)

Answer 5

I have try many hardware and software solutions of USB cotrol (I'm sysadmin). At this time I use and can recommend NetRCM. It can lock access to USB devices in a network and a lot of other features. Here is it: http://teseisoft.com/products/netrcm