Removable Devices: The Menace Within
by David Beesley - Network Defence - Tuesday, 16 October 2007.
Handheld USB devices have been a godsend to anyone who wants to take information from one PC to another, but their ease of use also has created a new type of security headache for companies. The recent explosion in sales of devices such as USB sticks, iPods and PDAs mean they are a common sight in most offices.

Whereís the harm in an iPod, you might ask. Surely the most offensive thing about an iPod is the often dodgy choice of music coming from it? But when you consider that these tiny portable media devices can just as easily be used to remove confidential customer files, there is a clear menace behind the shiny chrome exterior.

So what steps should businesses take to protect themselves against the risks associated with such devices?

Keep your enemies close. Keep your workforce closer.

The biggest threat to the integrity of a companyís IT security is not some sinister hacker trying to break into the corporate network, but employees and partners with easy access to business information.

With removable media devices such as MP3 players, digital cameras, and PDAs commonplace in companies, uncontrolled use of them carries a number of risks, from the simple nuisance factor of the network being used to store personal files and the risks associated with software theft, to the consequences of a deliberate attack on the network.

The storage device is also a simple way for malware to propagate within your network; a user can unwittingly infect the network with a virus that has been transferred from his home PC by such a device.

The right security strategy

Itís a worrying fact that around 80% of IT security incidents occur inside an organisation, and yet an estimated 80% of security spend still goes outside on perimeter defences such as firewalls, anti-virus, intrusions detection and content filtering. Businesses need a formalised control mechanism in place in order to protect critical business systems and databases for data and IP theft.

If you decide to outlaw USB devices, good luck. This is a difficult proposition, and there's no foolproof method. Windows 2003 will block USB port access, but critically, will also stop USB keyboards, mice and other legitimate USB devices being used Ė a move that will not be popular with employees.

Simply disabling USB ports is therefore not the answer, as it inevitably has an adverse effect on business productivity and flexibility.

Striking the right balance

Itís important to have an Acceptable Usage Policy (AUP) in place, so that employees are aware of what they may and may not use in the workplace.

However, relying on AUPs alone is insufficient Ė organisations need to back up any policy with robust enforcement capabilities. A wholesale ban on portable media devices is not the answer. Certain employees across an organisation will have a perfectly legitimate need to use removable media, be it a USB stick to transfer data or a PDA to synchronise diaries. Not all employees will need such access, so a flexible solution is needed for permissible usage and blocking unauthorised connections.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th