Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Background:
My organization has to find a removable storage solution. However, it is my understanding that the DOD is pretty strict about flash drives due to security considerations.
Question:
My users will always have connection to the internet, but may sometimes not be on our network. Are there any alternatives to flash drives?
If we were to allow flash drives, what steps need to be taken to mitigate the malware risk?
You want to distribute the flash drives yourself, and forbid usage of any flash drive which has not been "approved". Reason: there are devices out there, which look like flash drive, but, when inserted, tell to the computer that they really are keyboards, and begin typing things wildly.
If only genuine flash drives are ever inserted in the computers you want to protect, you should be able to deal with malware, with a "reasonable" success rate, through the usual tools (antivirus & co). Malware risk can be drastically lowered by enforcing use of an operating system which is resilient to malware, e.g. NetBSD (resiliency being achieved mostly by rarity - malware developers do not bother with targeting NetBSD). But users may object...
Be aware that whatever you do, users will insert random USB devices into machines to which they have physical access, unless you pour glue into the USB ports. Best defense is probably a combination of up-to-date operating systems, good antivirus/malware detector, and, more important than everything else, security awareness training. You will be infected at some point -- but you can hope for a low rate of successful infections if the users, on average, exercise caution.
One risk with flash drives is that they can serve as a vector for the spread of malware (e.g., viruses).
Here's how malware facilitates the spread of malware. If a clean flash drive is inserted into a compromised machine, the compromised machine might write malware onto the flash drive. If the now-infected flash drive is subsequently inserted into a second machine, the malicious data on the flash drive might exploit a security vulnerability on the second computer and cause the second computer to become compromised. Flash drives may also spread malware through social engineering (AngelinaJolie.jpg, which actually contains a .exe that when clicked on launches malware). This risk is especially pronounced if you use a flash drive that you obtained from a stranger or outsider.
One possible way to partially mitigate this risk is to only use removable media internally -- never allow anyone to insert a flash drive obtained from any external source, or while travelling. However, this policy may be harder to communicate, police, and ensure compliance with than a simpler "flash drives are banned" policy.
Another possible way to partially mitigate the risk is to use write-once media (e.g., CD-Rs, DVD-Rs) to transfer large files between machines. If malicious data is stored onto the media, the write-once nature won't help you. But the way that write-once media helps is that it removes the potential that inserting clean media into a compromised machine could infect the media. Thus, write-once media is not a panacea, but it might be a way to somewhat reduce the risk.
A third possibility is to encourage people to use networked solutions for sharing files, e.g., through a secure website (secured with HTTPS and with anti-virus scanning for all uploaded files) or through secure email (with anti-virus scanning on your email gateway).
The concerns about flash drives are that:
See the following for the threats:
To handle the stealing data issue and the issue from naughty USB devices, some places that don't allow flash drives, still allow other media such as CD's, since if there are no burners, you can get data in but not out.
To handle the malware issue, as Tom Leek identified, use an unlikely threat target, such as FreeBSD, and/or consider using some type of hardened system (possibly stand-alone, ie. not connected to anything). Then virus scan the files, and then copy the data to the system you need to use it on. You may wish to use the same media, or burn the files to a CD to remove some possible risks (such as a naughty filesystem, or additional naughty files a stuxnet .lnk file somehow ending up on the device). Or you might implement some way that this system only has access to an ftp server that it can upload files to, which can then be accessible by the rest of the network.
The above paragraph might be overkill for you, so the easier solution is just ensure Autoplay is turned off and scan the drive for malware before opening the folder with windows explorer.
If they are not on your network, can they VPN? Do you have a secure location for them to upload files to?
If you are a Windows shop, through GPO you can create a list of allowed flash USB by manufacturer, serial number, model, etc. So your users won't be able to use any other flash USB (Just make sure they don't have admin rights).
This though will not prevent malware, it will just give you more control over what flash USB your users can use.
You need to make sure that auto-play is not active and your AVs are up-to-date as well as your systems of course including third-party apps (Java, Flash, etc.)
The DoD does allow flash drives, but only specific ones (Ironkey I believe). If you want to only allow specific flash drives then the security software on the user's computer would have to support this and turn on or off access based on the inserted device.
In the long run, something will happen and be prepared for it when it does.
