0

There is plenty of discussion on how USB thumbdrives can be used for malicious purposes if one decides to go down that rabbit hole. One mitigation that is discussed in that context is to completely disable USB storage devices.

Are there any alternative strategies?
In a normal business context, not being able to use USB thumb drives at all, would be quite a large limitation to users.

Are there ways to make some USB thumb drives "known" to all computers of a Domain, and allow the use of them; while at the same time block all "foreign" USB thumb drives?
Would such an approach be feasible/realistic or would that not be worth the effort?

This question specifically applies to a business context. Think of a company with dozens of employees/computers. Thus, explicitly telling each computer the hardware ID of each "allowed" thumb drive would not be feasible.

1
  • You have 2 questions in one: 1. what are some strategies, and 2. can you whitelist USBs. The 2nd one is super easy to look up.
    – schroeder
    Oct 9, 2023 at 13:38

1 Answer 1

1

In a normal business context, not being able to use USB thumb drives at all, would be quite a large limitation to users.

It depends on the organisation. I helped an entire university ban all USB drives for staff and students and use OneDrive as an alternative. It worked for them. It doesn't always for others, but don't dismiss it too quickly.

Can I approve certain USBs?

Of course. You create an allow-list with the device IDs from AD or from endpoint agents.

Are there any alternative strategies?

Lots:

  • Virus scan each USB on mount
  • Use a "sheep-dip" machine to cleanse USB drives before use
  • Use an endpoint agent to automatically encrypt all USB drives (this limited how a USB can be infected to just company machines)
  • Use a proxy machine that allows USB, block USB on all other machines, and transfer files from that proxy machine

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .