16 ms·

"An IT policy that prevents USB use should be implemented, the US Department of the Interior suggested." ...seriously? They want to make life harder for people

"An IT policy that prevents USB use should be implemented, the US Department of the Interior suggested." ...seriously? They want to make life harder for people that have legitimate USB mass storage needs because of this? Do they have a DLP solution? DLP software can restrict what gets copied to and from a drive. Software restriction policies can be pushed to prevent execution from removable drives. Mind you,they said an "IT policy" meaning a rule that punishes anyone who uses a USB drive. This is the equivalent of your house getting broken into and your response is to have a rule thay punishes people for leaving the door unlocked instead of getting a home security system. Also,why is this a bbc news story?

totony 8y ago
For most enterprises, removage storage is a liability, e.g. ip thief, ip mismanagement, loss, security There are better ways to handle file sharing than removable storage if an employee needs it
- badrabbit 8y ago
  And it's the security teams job to assess the security needs of the business and apply policies. If the entire business has a data loss risk then sure a blanket ban makes sense. I disagree with what you said in that I believe "most businesses" need granular security policies that should be applied for specific departments. There maybe better ways of handling files but say you're a news corp and sources give you data over USB or a fashion company that has freelancers walk into your location's in person to hand in photoshoots and large cad files. The resteiction would have an impact both to users and to the business. For example,I worked at a company where specific departments were not restricted from accessing any website due to the possible business impact of them not being able to reach a required site.
CHsurfer 8y ago
My company, which is quite large, disabled all USB storage, with some exceptions. We survived.
- badrabbit 8y ago
  I know of company that did that as well. "We survived" is a very low standard. Security improvement should be measured against user impact and data being handled. The org. in the article does not have data confidentiality requirements that warrant such a severe user impact. I know of first hand a corporation whose nationwide business would bw crippled by USB mass storage blanket ban. Context insensitivity is bad security.
klodolph 8y ago
Honestly I am generally in favor of these policies. We have these at work. If you want to copy files, you use the network. Note that they said "IT policy that prevents", not "IT policy that prohibits". So I am not reading the implication that people who use USB drives would be punished, rather, the OS would be configured not to allow USB drives.
- badrabbit 8y ago
  Fair enough,probably meant what you said. In general these restrictions sound good but they're really bad when applied as a blanket policy to everyone. I prefet a "default" (not blanket) ban with exception/whitelist process in place. And this ,only for data sensitive departments. The response to lateral movement via USB mass storage should be measured to restrict that specific attack vector(execution from mass storage). It is not an excuse to recommend a policy that solves problems outside the scope of the incident. If there are data loss concerns,the policy should be made after proper risk analysis,available solutions and user+business impact. IMO,How you do these things tends to be more important than whether they get done or not(process>practice).
swarnie_ 8y ago
...seriously? This has been best practice in government and enterprise for about as long as i can remember.
- badrabbit 8y ago
  Lies. I know first hand a few very large corporations that don't have this restriction. I only know of one corporation that has a blanket ban. "Government" is huge,the department in question does not handle confidential(classification) and above information.
koolba 8y ago
Blanket restrictions on USB drive usage is a good policy for any government or data sensitive organization. Considering that most people are idiots when it comes to security limiting the damage they can do is a good thing.
- badrabbit 8y ago
  Respectfully disagree,blanket ban is good if the specific business unit handles sensitive data. Some departments might need to interact with external third parties and customers who would send them data over mass storage. Most people are not idiots when it comes to security since it is the job of system and security engineers to design a secure system for "most people" ,however a security policy that does not take into measure context specific business impact is foolish.
gizmo686 8y ago
No, they make the reccomendation because USB is not secure. Unless you can verify a USB device is not hostile, you should never plug it in to anything. Given how common and not suspisious USB storage device giveaways are, the policy makes sense. Even leaving malisious USBs in the targets parking lot is a viable attack.
- badrabbit 8y ago
  If you're going that route,peripherals can also be "hostile" not just mass storage

totony 8y ago

For most enterprises, removage storage is a liability, e.g. ip thief, ip mismanagement, loss, security There are better ways to handle file sharing than removable storage if an employee needs it

badrabbit 8y ago
And it's the security teams job to assess the security needs of the business and apply policies. If the entire business has a data loss risk then sure a blanket ban makes sense. I disagree with what you said in that I believe "most businesses" need granular security policies that should be applied for specific departments. There maybe better ways of handling files but say you're a news corp and sources give you data over USB or a fashion company that has freelancers walk into your location's in person to hand in photoshoots and large cad files. The resteiction would have an impact both to users and to the business. For example,I worked at a company where specific departments were not restricted from accessing any website due to the possible business impact of them not being able to reach a required site.

CHsurfer 8y ago

My company, which is quite large, disabled all USB storage, with some exceptions. We survived.

badrabbit 8y ago
I know of company that did that as well. "We survived" is a very low standard. Security improvement should be measured against user impact and data being handled. The org. in the article does not have data confidentiality requirements that warrant such a severe user impact. I know of first hand a corporation whose nationwide business would bw crippled by USB mass storage blanket ban. Context insensitivity is bad security.

klodolph 8y ago

Honestly I am generally in favor of these policies. We have these at work. If you want to copy files, you use the network. Note that they said "IT policy that prevents", not "IT policy that prohibits". So I am not reading the implication that people who use USB drives would be punished, rather, the OS would be configured not to allow USB drives.

badrabbit 8y ago
Fair enough,probably meant what you said. In general these restrictions sound good but they're really bad when applied as a blanket policy to everyone. I prefet a "default" (not blanket) ban with exception/whitelist process in place. And this ,only for data sensitive departments. The response to lateral movement via USB mass storage should be measured to restrict that specific attack vector(execution from mass storage). It is not an excuse to recommend a policy that solves problems outside the scope of the incident. If there are data loss concerns,the policy should be made after proper risk analysis,available solutions and user+business impact. IMO,How you do these things tends to be more important than whether they get done or not(process>practice).

swarnie_ 8y ago

...seriously? This has been best practice in government and enterprise for about as long as i can remember.

badrabbit 8y ago
Lies. I know first hand a few very large corporations that don't have this restriction. I only know of one corporation that has a blanket ban. "Government" is huge,the department in question does not handle confidential(classification) and above information.

koolba 8y ago

Blanket restrictions on USB drive usage is a good policy for any government or data sensitive organization. Considering that most people are idiots when it comes to security limiting the damage they can do is a good thing.

badrabbit 8y ago
Respectfully disagree,blanket ban is good if the specific business unit handles sensitive data. Some departments might need to interact with external third parties and customers who would send them data over mass storage. Most people are not idiots when it comes to security since it is the job of system and security engineers to design a secure system for "most people" ,however a security policy that does not take into measure context specific business impact is foolish.

gizmo686 8y ago

No, they make the reccomendation because USB is not secure. Unless you can verify a USB device is not hostile, you should never plug it in to anything. Given how common and not suspisious USB storage device giveaways are, the policy makes sense. Even leaving malisious USBs in the targets parking lot is a viable attack.

badrabbit 8y ago
If you're going that route,peripherals can also be "hostile" not just mass storage