Are there tangible recommendations for USB drives to be disabled?

Question

I am currently discussing / considering the possibility to disable access to USB drives (USB storage) on Windows machines.

There are technical means to do this and I am trying to balance arguments in the threat scenario.

PRO removal of USB drives

• ability to bring in malware (no malicious intent from user)
• ability to bring in malware (malicious intent from user)
• ability to offload data
• loss of unencrypted drive → potential loss of data

CON removal of USB drives

• none (from the perspective of security)
• plenty (from the business perspective: exchange of data with customers, offloading of large files)
• the attack can come from BadUsb (this is not a real "CON", rather the fact that USB drives do not cover the whole threat spectrum)

There are also counter-arguments for the PRO section:

• the "ability" part is not limited to USB drives, the data/virus transfer can be done though virtual means (virtual disks, email, ...)
• the "not encrypted" problem can be solved by requesting that connected drives are forcefully encrypted

My question: are there tangible recommendations for USB drives to be disabled?

Tangible here means either "standards based" (common sense optional), or "common sense".

Answer 1

Annex A.8.3 of ISO 27001 relates to the management of removable media. I can't find a link to the standard itself, but there are some online resources which refer to it:

http://iso27001guide.com/annex-a/asset-management/media-handling/iso-27001-management-removable-media-requirements/

"ISO 27001 does not mandate that removable media cannot be used, it just recommends that media is used in a secure manner. By specifying the organisations stance and implementing controls to support this policy, the organisation can gain a level of control over removable media that may otherwise pose a very high risk"

and ...

"organisations must be able to demonstrate that the risks posed by removable media to the organisation are controlled. ISO 27001 describes this as implementing procedures in line with the classification scheme adopted by the organisation"

https://www.isms.online/iso-27001/annex-a-8-asset-management/

"General use of removable media must be risk assessed and it may be necessary to carry out use-specific risk assessments beyond that too. Removable media should only be allowed if there is a justified business reason"

Answer 2

There is no good formulation to 'disable drives'. You practically block access to them. And you can do that completely or only for writes.

If you require USB blocking of specific devices like storage drives, there are multiple ways to accomplish that. Many anti-viruses today offer this possibility by enforcing a policy on client computers.

You can also do it using Group Policy in the case of AD. Here is how.

In addition to that, many companies today use a software that encrypts documents (works in a similar manner like a ransomware but practically you can open the documents when providing correct password for the software). Copying them to external media practically makes the copies useless as no-one outside the company will be able to decrypt them.

After your comment clarification, disabling access to storage should be done selectively when needed. This scope may depend on the nature of the work done on the targeted workstations.

In my current case, from about 300 PCs only 3 have the possibility to copy files to USB storage media. For the others, they are able to read USB storage but not write to it.

In your case you should take into consideration things like:

• do you have sensitive data that can be stolen that way ?
• do you have a risk of being infected via data transferred from USB drives ?

You basically should make study of commodity vs security and decide if to restrict USB attached storage or not.

Answer 3

Speaking as somebody who used to work for a company that did advanced research for the Department of Defense and has expertise in cyber warfare, I can tell you that it is standard procedure among defense contractors to glue up USB ports on personal computers and laptops that are used for sensitive work. Any glue that hardens and would be difficult to remove is usable. Two part epoxy is especially effective and can be bought at any hardware store.

That being said, just be aware that anybody who is determined to exfiltrate data can find a way to do it. The USB glue up just removes the most convenient option.

However, disabling USB ports is nevertheless very valuable from a security standpoint because it prevents drive by attacks. These are attacks where a visitor to an office or someone posing as cleaning personnel enters an unoccupied office and inserts a USB stick in a machine which then installs malware. Glue ups prevent this kind of attack.