USB sticks feel like old technology. Most files now move through cloud storage and email, and plenty of organisations assume removable media stopped being a risk years ago. It has not. A USB port is still one of the simplest ways for data to leave an organisation and for malware to arrive, and it sidesteps most of the controls you have on email and the web.
Two risks, one port
Data leaving. A USB drive can carry an entire customer database out of the building in seconds, with no email gateway, no cloud audit log and no web proxy in the way. Most data loss through removable media is not malicious. It is someone copying work to take home, or a stick lost in a car park. The effect is the same.
Malware arriving. Infected drives still spread malware between organisations, especially where people swap files with partners, contractors or sites with poor connectivity. Phones and other devices that connect over USB raise the same questions.
What the NCSC recommends
The National Cyber Security Centre's guidance on malware and ransomware advises organisations to "disable autorun for mounted media (prevent the use of removable media if it is not needed)". Its data security guidance says disk encryption should be used where there is a risk of physical theft, "such as laptop computers and removable media". It also recommends that drives holding backups are not left permanently connected.
A practical approach
- Find out what is being used. Before you block anything, record which devices are plugged in, where and by whom. Most organisations are surprised by what they find.
- Block by default and allow by exception. Block USB storage and phones for most people. Keyboards, mice, headsets and printers should keep working.
- Use read only where you can. Many people need to read files from a stick far more often than they need to write to one.
- Require encryption for the drives you do allow, so a lost stick is an inconvenience rather than a reportable breach.
- Make exceptions easy. If a legitimate exception takes a week, people find workarounds. A request button and a quick approval keep the policy intact.
- Keep a record. You want to be able to answer the question "what was plugged into that laptop last Tuesday?".
Where Portcullis fits
Portcullis does this for Windows endpoints. Removable storage is closed by default and opened on purpose, for one device, one person and a set time. Every connection and every decision is recorded in an audit trail the endpoints cannot write to, and a new appliance can start by recording everything and blocking nothing, so you see the picture before you close the gate. You can read more about Portcullis or ask us about it.
Sources
- NCSC, Mitigating malware and ransomware attacks: ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks
- NCSC, 10 Steps to Cyber Security, Data security: ncsc.gov.uk/collection/10-steps/data-security
