0

I am currently discussing / considering the possibility to disable access to USB drives (USB storage) on Windows machines.

There are technical means to do this and I am trying to balance arguments in the threat scenario.

PRO removal of USB drives

  • ability to bring in malware (no malicious intent from user)
  • ability to bring in malware (malicious intent from user)
  • ability to offload data
  • loss of unencrypted drive → potential loss of data

CON removal of USB drives

  • none (from the perspective of security)
  • plenty (from the business perspective: exchange of data with customers, offloading of large files)
  • the attack can come from BadUsb (this is not a real "CON", rather the fact that USB drives do not cover the whole threat spectrum)

There are also counter-arguments for the PRO section:

  • the "ability" part is not limited to USB drives, the data/virus transfer can be done though virtual means (virtual disks, email, ...)
  • the "not encrypted" problem can be solved by requesting that connected drives are forcefully encrypted

My question: are there tangible recommendations for USB drives to be disabled?

Tangible here means either "standards based" (common sense optional), or "common sense".

  • Depending upon your perceived threat environment, you may also want to consider other usb devices such as: Printer (or virtual printer), usb ethernet device, usb WiFi dongle, usb serial device. All of these can act as output mechanisms. Also usb CD/DVD device. It's possible to allow only pre-selected device hardware IDs, but these can be spoofed. In general you're trying to defend against someone with physical possession, a difficult task that becomes even more difficult as you assume knowledgeable intentional attacks. Consider your intent and the pain of use. – user10216038 Jul 4 at 15:19
1

Annex A.8.3 of ISO 27001 relates to the management of removable media. I can't find a link to the standard itself, but there are some online resources which refer to it:

http://iso27001guide.com/annex-a/asset-management/media-handling/iso-27001-management-removable-media-requirements/

"ISO 27001 does not mandate that removable media cannot be used, it just recommends that media is used in a secure manner. By specifying the organisations stance and implementing controls to support this policy, the organisation can gain a level of control over removable media that may otherwise pose a very high risk"

and ...

"organisations must be able to demonstrate that the risks posed by removable media to the organisation are controlled. ISO 27001 describes this as implementing procedures in line with the classification scheme adopted by the organisation"

https://www.isms.online/iso-27001/annex-a-8-asset-management/

"General use of removable media must be risk assessed and it may be necessary to carry out use-specific risk assessments beyond that too. Removable media should only be allowed if there is a justified business reason"

0

There is no good formulation to 'disable drives'. You practically block access to them. And you can do that completely or only for writes.

If you require USB blocking of specific devices like storage drives, there are multiple ways to accomplish that. Many anti-viruses today offer this possibility by enforcing a policy on client computers.

You can also do it using Group Policy in the case of AD. Here is how.

In addition to that, many companies today use a software that encrypts documents (works in a similar manner like a ransomware but practically you can open the documents when providing correct password for the software). Copying them to external media practically makes the copies useless as no-one outside the company will be able to decrypt them.

After your comment clarification, disabling access to storage should be done selectively when needed. This scope may depend on the nature of the work done on the targeted workstations.

In my current case, from about 300 PCs only 3 have the possibility to copy files to USB storage media. For the others, they are able to read USB storage but not write to it.

In your case you should take into consideration things like:

  • do you have sensitive data that can be stolen that way ?
  • do you have a risk of being infected via data transferred from USB drives ?

You basically should make study of commodity vs security and decide if to restrict USB attached storage or not.

  • I am not sure I understand: why are you talking about drivers? I did not mention how to do the removal (that would be either through existing software or a GPO), I am asking about the recommendation/certification requirements for the idea itself. SUB drives (providing storage) can be disabled by targeting the right ID family in the GPO. – WoJ Jul 5 at 10:26
  • I apparently miss-read, but saying disabling drives is an absurdity. You do not disable drives, you prevent access to them. The question should be completely rephrased. Even so, my recommendations of limiting them stand. I will adapt the answer a little. Done. – Overmind Jul 5 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.