I am currently discussing / considering the possibility to disable access to USB drives (USB storage) on Windows machines.
There are technical means to do this and I am trying to balance arguments in the threat scenario.
PRO removal of USB drives
- ability to bring in malware (no malicious intent from user)
- ability to bring in malware (malicious intent from user)
- ability to offload data
- loss of unencrypted drive → potential loss of data
CON removal of USB drives
- none (from the perspective of security)
- plenty (from the business perspective: exchange of data with customers, offloading of large files)
- the attack can come from BadUsb (this is not a real "CON", rather the fact that USB drives do not cover the whole threat spectrum)
There are also counter-arguments for the PRO section:
- the "ability" part is not limited to USB drives, the data/virus transfer can be done though virtual means (virtual disks, email, ...)
- the "not encrypted" problem can be solved by requesting that connected drives are forcefully encrypted
My question: are there tangible recommendations for USB drives to be disabled?
Tangible here means either "standards based" (common sense optional), or "common sense".