Removable Devices: The Menace Within
Handheld USB devices have been a godsend to anyone who wants to take information from one PC to another, but their ease of use also has created a new type of security headache for companies. The recent explosion in sales of devices such as USB sticks, iPods and PDAs mean they are a common sight in most offices.
Where’s the harm in an iPod, you might ask. Surely the most offensive thing about an iPod is the often dodgy choice of music coming from it? But when you consider that these tiny portable media devices can just as easily be used to remove confidential customer files, there is a clear menace behind the shiny chrome exterior.
So what steps should businesses take to protect themselves against the risks associated with such devices?
Keep your enemies close. Keep your workforce closer.
The biggest threat to the integrity of a company’s IT security is not some sinister hacker trying to break into the corporate network, but employees and partners with easy access to business information.
With removable media devices such as MP3 players, digital cameras, and PDAs commonplace in companies, uncontrolled use of them carries a number of risks, from the simple nuisance factor of the network being used to store personal files and the risks associated with software theft, to the consequences of a deliberate attack on the network.
The storage device is also a simple way for malware to propagate within your network; a user can unwittingly infect the network with a virus that has been transferred from his home PC by such a device.
The right security strategy
It’s a worrying fact that around 80% of IT security incidents occur inside an organisation, and yet an estimated 80% of security spend still goes outside on perimeter defences such as firewalls, anti-virus, intrusions detection and content filtering. Businesses need a formalised control mechanism in place in order to protect critical business systems and databases for data and IP theft.
If you decide to outlaw USB devices, good luck. This is a difficult proposition, and there’s no foolproof method. Windows 2003 will block USB port access, but critically, will also stop USB keyboards, mice and other legitimate USB devices being used – a move that will not be popular with employees.
Simply disabling USB ports is therefore not the answer, as it inevitably has an adverse effect on business productivity and flexibility.
Striking the right balance
It’s important to have an Acceptable Usage Policy (AUP) in place, so that employees are aware of what they may and may not use in the workplace.
However, relying on AUPs alone is insufficient – organisations need to back up any policy with robust enforcement capabilities. A wholesale ban on portable media devices is not the answer. Certain employees across an organisation will have a perfectly legitimate need to use removable media, be it a USB stick to transfer data or a PDA to synchronise diaries. Not all employees will need such access, so a flexible solution is needed for permissible usage and blocking unauthorised connections.