Security

Ask something
Discussion Locked

USB Flashdrives as Security Threat!

0 helpful
17 replies

by nolipineda

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have recently disabled the ability of our Windows XP machines to load and recognize a USB Storage devices and we have been fighting fire ever since. Does anyone here knows of tech article enumerating the risk of removable storage and/or case studies on the web or tech news outlining the risk of usb storage?

thanks in advance,
Noli

17 replies

by deadly ernest

that floppy discs represented. You have to balance that against the advantages of being able to use easy data transfers methods. The simplest way is to set up the system to do a virus scan of all drives when they are detected and to have the virus scanner running live on each PC. The same way protection against a floppy spread virus was done.

If you just disable the USb what is stopping someone who is trying to steal data from plugging in a newtork drive aand storing to that?

Examine what you are protecting against and remember you cannot protect against employee theft, just try to monitor or limit it through access rights.

by ru_trustified

" remember you cannot protect against employee theft, just try to monitor or limit it through access rights" is a sad statement. If you believe that one can not prevent insider breaches,and do nothing to prevent them, then it is only a matter of time until you are a victim.

Perhaps the reason why the theft of trade secrets in the US alone is now estimated to be well over $300 BILLION a year. You might want to check out the book "the Insider" by Dan Verton, it is a real eye opener.

You can add another $100 billion or so due to assorted privacy breaches, identity theft etc..

Monitoring increases awareness of the problem after the fact, but if your trade secret is gone to the other side of the world, it is too late already. Monitoring does not prevent innitially and you must rely on HR and legal involvement, education, policy creation and enforcement etc..

No amount of education will stop a vengeful act by a disgruntled employee triggered by an event such as a missed promotion or outsourcing.

Disabling USB ports compromises business flow and functionality. Would it not be better to have a technology that regulates employee access to all data and all of the devices at their disposal so that they were still available for legitmate use?

The fact is, employee theft is preventable but it requires multilevel security and a trusted computing environment. This level of security has been left to top security installations in the past due to cost and complexity, but we have now commoditized it in such a user friendly manner that it is cost effective and practical for even SMBs. This technology regulates everything that goes on inside the network by authorized users.
You may want to watch for it for future reference.

by schwana

Agreed, disabling functionality is not the answer, and often enough, neither is a security solution that costs thousands of dollars to implement. Email and document security such as Essential Taceo (tah-say-oh) is affordable and can be put onto any PC desktop without requiring server setup, and uses encryption and rights controls that prevent unauthorized access. More: http://www.essentialsecurity.com/yourbusiness.htm

by dukeinlondon

A lot of the need for removable media is because
of limits on attachment size for emails.

Lift that limit and you'll significantly reduce
the need for flash pen and such. The problem is
that partner companies and clients need to do
the same if that's to do the trick.

emails are no safer in terms of data security
but at least, they can be logged (so authors of
leaks can be held to account) and are usually
virus scanned at both ends.

by jeff dray

Most blocking of USB devices is done at the BIOS stage and it is fairly easy for a user to re-enable them in Bios to use them. Far harder to remove all driver support from the OS, unless you make the BIOS password uncrackable a determined person will get round it. the other problem is that they are very handy devices for support people to use when rolling out upgrades and new software. Where does it end? take out all external storage devices? CD ROMS, Floppies, etc.

by mark40930

Recently the LA Times had investigated the theft of USB thumbdrives from a US airbase in Afghanistan that wound up being for sale in the local bazaar.

http://www.latimes.com/news/nationworld/world/la-fg-drives27apr27,0,2091770.story?track=tothtml

The US military is slowly coming around to the fact that current security proceedures may need to be revamped, including the need to reinforce to its soldiers to be vigilant when USB drives contain sensitive or classified information. Any lessons learned and applied by them over the coming months will no doubt trickle down to the regular business community.

by jnussey

You will find material at www.devicewall.com to support your lock down of devices, although it will come with the conclusion of buying their software. We use the product at our company so that we can allow some users to use these devices. The software also allows you to encrypt data that goes onto USB Flashdrives so that only computers on your network can read the data.

by the_hunteroz

I work in a high school as the systems administrator and unfortunately the disablement of the USB memory sticks storage devices etc. poses a particular issue when students have to load or hand in work, so i would say the disablement of USB memory stick access is a negative

by jgaulsr

I hold the same capcity at a college. The students would go nuts without thier flash drives. But, if someone is deadbent on getting thier hands on your data, they will find a way. 3rd party software(such as Winternals ERD Commander) allows for change of a local machines administrative password. I can have ALL your data then if I want, even deleted data or lost volumes. Scary, eh?

by michael_orton9

1. Usually just running regedit will overcome this.
2. Disabling USB gives the appearence of security, but if you have data worth grabbing what about TEMPEST, optical tempest, "hard cards," Software adn hardware keystroke loggers, the application of the "Three Bs" to your staff? (Bribery, Blackmail and beating).
You can use usb drives for security, for free. Almost all versions of PGP from 2.2 upwatrds (with equally free windows front ends) will run from a usb device. I use it to encrypt sensitive files, so if the PC is stolen the keys and the randomseed bin are nowhere to be found. The cost is trivial ?16 per drive, and you can even stick in yet another drive to transfer/save the encrypted files.
Triple DES is also freeware, and in this case even a 64Meg key will store the 3 keys and 3 IVs and the program. With a 128 meg device, the truely paranoid can have both 3Des and PGP. Encrypt first with 3DES and then super-encrypt with 1024 RSA key.
USB devices can be a problem, disguised versions can be bought, up to 2 GIG, they can be carried internally, and your cleaning staff could be using them at night.
One cheap solution is to buy a HD caddy for ?14, and then remove the HD and lock it up in a safe, BUT just Google '"Matt Blaze" + safecracking' and you find that your Safe isn't as safe as the makers claim.
Unfortunately all too often have I seen what at first seemed to be "Total IT security" fall apart with only moderate effort and expense.
If someone really wants your data and has the time, skills, and cash, you will be hard pressed to keep your data, and you probably won't even know if it has been copied if it is done well.

by k.nylund

The basics of disabling devices are just like placing pad locks on doors. They are not there to stop the determined they are there to keep honest people honest. The pro's and con's should be weighted to ensure the value of this process is worth the effort. I am surprised that all of the answers so far have been so jaded against a simple solution to help stop mass theft or misplacement of company goods.

I recommend the use of a registry entry that disables mass storage devices since if nothing else it ensures that the basic day to day activities will not become dependant on replacing data transfers with the old sneaker network that was so pervasive 10 years ago. It will also bring to light people that where using this system without understanding the risks. Once we disabled these devices we had more people than expected ask us why they could not use these devices any more.

The ease of setting this up and even undoing it makes it well worth the time.

by jeanne9

I know of a new product out for enterprise data centers that allows security encryption on USB drives. You will start to see this coming out, but only data centers with big budgets and compliance mandates will likely partake. $60K plus starter price for these products.

Jeanne

by michael_orton9

Both the free versions of PGP and Triple DES have worked to encrypt anything on a usb drive for as long as there have been USB drives.
With dos/windows (all versions) a simple batch file can be used to encrypt/decrypt and as powered x4 USB hubs can be bought for under ?8 in UK discount supermarkets (ALDI & LIDL) a second USB device can be used to actually run the software, though I always have a crippled version on the HD just to b****r up any intruders and I have encrypted versions of Eskimo Knell with very interesting file titles to increase the phun!
The same FREE software is also available for Linux.
I don't see any need to buy anything new when I can have 2048 digit PGP encryption for free!

by ian lewis

Our core SQL Server database would fit easily on a 512Mb-1Gb flash drive. There's plenty of other mission critical stuff too to pad out the remaining space.

So, yes, I've disabled access to flash drives...

Now for the email problem

by itoilman

We find that USB Lock RP is second to none in taking care of this vulnerability.
Reasons are:
-Ease of use
-Excellent tech support
-Effective
-Makes global and per machine status reports.
Admistrative Control can be used from any PC. (NON-"Active directory" dependance)
10 day DEMO can be downloaded from:
http://www.advansysperu.com/usb_lock_remote_protect.htm

Hope that helps.

This discussion is closed to new replies.