Fair enough,probably meant what you said. In general these restrictions sound good but they're really bad when applied as a blanket policy to everyone. I prefe

Fair enough,probably meant what you said. In general these restrictions sound good but they're really bad when applied as a blanket policy to everyone. I prefet a "default" (not blanket) ban with exception/whitelist process in place. And this ,only for data sensitive departments. The response to lateral movement via USB mass storage should be measured to restrict that specific attack vector(execution from mass storage). It is not an excuse to recommend a policy that solves problems outside the scope of the incident. If there are data loss concerns,the policy should be made after proper risk analysis,available solutions and user+business impact. IMO,How you do these things tends to be more important than whether they get done or not(process>practice).