Changing policy to allow USB drives. Why should I try to stop it?

Question

We are currently in the process of allowing USB memory sticks, but with a stricter policy. Some key points in the policy is:

• Any confidential data stored on the USB drive has to be encrypted
• Always keep your USB drive with you or in a safe place if it contains sensitive data
• USB drives which are used in work situation should never be used for any private (non-business) objective.

I've read about Security Threats in this article on wikipedia: Usb_flash_drive#Security_threats, but I am having some trouble in explaining exactly how and why allowing USB sticks is dangerous. Some points I've brought up:

• Less attentive to the dangers that could be hiding on an USB drive when it becomes more accepted to use them in the business. People also might not think twice in plugging in an USB they found lying on their desk.
• Potential spreading of malware. It is quite common for malware to propagate through USB drives.
• Potential exploits to be autorun through USB drive. Example is plugging in an USB drive which is responding as a keyboard. Once it is plugged in it sends the necessary keyboard commands to fetch a file online and run it.

Does anyone have any other arguments in why it's dangerous to use USB drives, and perhaps any suggestions on policy if we need to allow them?

Answer 1

USB drives allow the propagation of data without control from the network firewall -- so any reason why such a firewall was set in the first place is a good reason to ban USB drives.

I do not see how you could enforce a policy of no-private usage. People will use USB drives to transfer private data, if only the latest photographs of their dog, and there is very little you can do to prevent that, as long as USB drives work at all for users. To enforce a security policy, you need to have at least one of the following:

• users have no immediate interest in a cheap workaround (e.g. the USB support has been removed from the OS, so plugging a USB drive will make nothing useful to a user);
• users understand why the policy was set, and willingly comply (fat chance on that);
• technological safeguards are setup (but you may have a hard time making an automated tool which distinguishes business data from private data);
• non-compliers are punished with the utmost severity (but if the users themselves do not consider USB drives as potentially harmful, they will not cooperate, thus making USB police operations very expensive).

If you want to allow usage of USB sticks, I would suggest setting it on a dedicated machine, which runs a Unix-like system (thus immune to Windows and MacOS viruses -- for extra security, aim for a confidential setup, e.g. NetBSD on an old PowerPC-based MacIntosh hardware), executes antivirus software automatically, and exports the (verified) USB drive contents through a network protocol (e.g. CIFS, or maybe a simple local HTTP server). At least this will avoid issues with USB devices which act as keyboards. Possibly, this may prompt users to exchange data through the network, removing the need for USB drives in that situation.

As for the dangers of USB devices, you can cite as example the "PSJailbreak" which is the most common PS3-breaking system as of mid-2010 (that was before the discovery of the tremendous blunder of Sony with regards to ECDSA). The PSJailbreak looks like a USB key, but internally acts as a USB hub with four virtual devices, which exploit a buffer overflow in the kernel.

Answer 2

I have built a business case, got funding and implemented removable media controls at a large bank. I wrote about my lessons learned here.

The key reasons on why you need removable media controls:

• Data loss prevention - if you lose a removable device with lots of valuable data on it you don't get fined by the regulator, face data breech reporting and lose face with your stakeholders. Check datalossdb.org for some actual £/$ incidents including the massive HMRC loss.

• Data leakage prevention - You close down one of the easiest and highest volume ways your staff can steal your information e.g. when they leave for a competitor. This is easy for senior management to understand because they are usually the biggest culprit of needing to take "personal" data. Yes there are other ways like email but people will select the most convenient, close them down one at a time or at least encrypt and monitor so you know what is being copied

• Malware - as you mentioned. HBGary example is a good one, plenty of others. Originally I did not have this as a driver as our Desktop AV seemed to be effective. But if implementing now I would definitely push for limiting read access on USB as well as AV just is not effective against fast emerging threats.

Your policy seems reasonable but I would suggest the following changes:

• Any non public data stored on USB and removable media needs to be encrypted. This is a lot easier for people to apply and for you to run an awareness campaign about rather than asking people to classify data which they are notoriously bad at doing

• Only corporate provided USB drives are to be used on corporate equipment. Simple. I would suggest using a hardware encrypted drive like an Ironkey and simply blocking everything else.

• Read and write access to removable media shall only be provided with a business reason and be approved by your line manager. Access shall be re-certified every quarter. Some companies issue 24 hour or one use USB access but I think the above provides a better balance of risk and convenience

• Any one time copy activities will be performed by the Help-desk / Desktop support. They will have USB keys approved for this activity. Any data to be copied will be approved by your line manager and HR/Compliance if it is regarding copying of corporate data for personal use e.g. on leaving the company.

You also need an effective exception process of course for the policy, where the risk of the exception is reviewed by IT security and approved by the business.

Answer 3

While USB sticks do have security risks, they are also useful. They increase productivity. I can completely understand why an organization might want to allow use of USB sticks but apply some mitigations to try to mitigate the risk as much as is possible, without loss of utility/productivity.

In that vein, one suggestion for policy would be: make sure autorun is turned off across your organization. Another suggestion is to use anti-virus software on all your Windows machine, and make sure the anti-virus software is configured to automatically scan the contents of the USB stick when it is inserted (or to scan the contents of those files on-demand when/before they are accessed).

For transferring files from one machine to another, you could consider encouraging use of write-once CD-Rs and DVDs (not the rewriteable variety). This is certainly less convenient, though to try to make it more convenient, you could try keeping supplies of blank CD-Rs/DVDs in easily accessible places. I don't know if the security benefits (which are modest) are worth the bother though.