Re: Disabling USB mass storage

From: Allan S (nullconnect_at_gmail.com)
Date: 03/04/05

  • Next message: Jens Mickerts: "AW: Disabling USB mass storage" 
    Date: Thu, 3 Mar 2005 16:55:20 -0700
To: focus-ms@securityfocus.com

    We've taken the step of disabling the USB controllers in device
    manager on our clients' machines.

    Not an ideal solution, as with everything coming on USB nowdays, we
    spend an inordinate amount of time re-enabling these devices - which
    leaves them open for use with USB drives.

    While I'm on the subject. . . why all the FUD regarding USB drives?
    We have a policy at my current job that prevents the use of USB
    drives. This was a policy implemented around the same time that we
    deployed new clients to our users. . . clients that came with CD
    burners and floppy drives. . . which aren't disabled.

    The result has become the archtypical example of users finding
    creative ways around bad rules. One user went and purchased his own
    USB hub for use in the one open port we gave him. Another user, more
    leery of breaking the established rules, will email his briefings home
    to himself and puts them on his flashdrive there - simply because he
    doesn't want to have deal with the hassle of CDs while on road trips.

    A google comes back with several hits regarding various options on how
    to disable USB ports but is very thin on the rationale behind the act.
      Even a search on securityfocus.com returns a lot of wheres and hows.
    . . but is not so good on the whys.

    The best I've been able to find is that some people were worried about
    the efficiency of USB drives, putting forth the argument that the
    greater ease of the technology comes with increased risks. Granted. .
    . but if high efficiency leads to high risk why allow other effecient
    technologies as well, technologies like email or the web?
    Or even CD burners. . .
         or PDAs. . .
              or floppy drives. . .

    All of these have vulnerabilities that ultimately can only be
    addressed with company and administrative policies. Policies that
    should also cover (or can easily be adapted to) USB drives.

    It may sound like my mind is made up on this - but it isn't - not
    completely. I'm just frustrated by having to _daily_ defend what is a
    very unpopular policy. A typical exchange goes along the lines of:
    -We have <pick one> CD burners / floppy drives / Iron clad NDAs /
    security clearances but we can't use a thumbdrive?
    Um. . . yeah. . . it's something that the security office pushed down.
    -That's pretty stupid. Why?
    Um . . . not a clue.
    -I mean I can use the CD / floppy / email / web / network printer /
    fax machine / photocopier to get files / information out there.
    Yeah. . . well . . it's not the only policy that we've got that hasn't
    really been thought through.*
    (5-30 minutes of general ranting follows, depending on the fortitude
    of the person and how fast I can do what needs to be done and escape.
    The above line is wonderful for getting the user to leave me alone and
    off ranting against /them/ what inhabit security. It is,
    unfortunatly, not a very team-oriented nor professional phrase. But
    it's an honest one).

    This happens daily.

    I kid you not.

    Okay. To be honest I'd only just heard the fax machine argument today.

    But. I would be appreciative if anyone could point me towards a good
    reason for disabling USB drives, so that I can start defending this
    policy with some form of conviction.

    Or am I correct in my belief that this emperor is buck naked?

    Now - if you'll excuse me - I have a DVD burner to install for a user.

    Allan Seyberth

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jens Mickerts: "AW: Disabling USB mass storage"

    Relevant Pages

    • ~~~~~~~~~~~~~~ USB BOOT ~~~~~~~~~~~~~~
      ... boot external sata on usb ... usb boot disk download ... which usb drives will boot dell ...
      (sci.psychology.personality)
    • Re: Cant access usb
      ... everything on /home/robin to an external hard drive which connects to my PC through a usb port. ... I had planned to copy it back to my hdd after the Debian install was complete. ... I myself noticed that usb drives, and similar storage devices would just show up on my desktop when I plugged them in and turned them on. ... I messed around with debian-backports, then I tried to upgrade to Etch. ...
      (Debian-User)
    • Re: Best Linux To Install on 2 GB USB Drive
      ... A gift of a 2 GB Transcend USB drive was presented to me, ... not a Pocket or Tiny Linux any longer. ... It isn't really necessary to be minimalist with a 2G fob. ... reports on various distributions of Linux that fit on flash USB drives ...
      (comp.os.linux.misc)
    • Re: Win2k install on IBM TransNote
      ... > Win2k OS), that has stopped working because of what I'm ... > means I'll need to install the Win2k OS on the new HD. ... it uses external USB drives for both ... will any brand of USB drives ...
      (microsoft.public.win2000.setup)
    • Re: HELP - Major Security Risk - USB Flash Memory!!
      ... If you are worried about users absconding with information on USB drives, ... infrared port or network transfer to other computers ... rethink the focus of your security policy. ...
      (microsoft.public.windowsxp.security_admin)