Some IT managers have taken a "cast a wide net" approach by completely disabling the Windows "Plug and Play" setup options on deployed machines after their initial configuration. This creates additional work for the PC support group when authorized hardware needs to be installed later, but it is effective in controlling what users can and cannot add to their machines.

At the very minimum an organization needs to implement an automatic PC "lock down" policy which ensures that unattended PCs drop into "password required" mode after some defined period of activity. That "defined" period is open to interpretation, but the shorter the period of time, the better.

Beyond the physical "Lock and Key" approach

If organizations that are subject to SOX or other federal requirements must issue portable storage devices to key personnel in order for them to fulfil their job responsibilities, then there are devices which come equipped with internal security protection available such as biometrics identification, secure password schemes and encryption methodologies.


Get it in writing

While a written data security policy won't do much for stopping willful illegal activity, and it won't make any of your users smarter when it comes to installing protection on their home computers, it does give you a leg to stand on when it comes to taking either disciplinary or legal action against violators when warranted.

At a minimum, your portable storage security policy should address these issues:

• Define who is permitted to use portable data storage devices and what types of data are permitted to be stored on these devices.
• Establish rules for vendors and visitors who want to attach devices during presentations or visits to the organization.
• Establish virus and spyware protection standards for employees who use home or off-premise computers.
• Establish password and data encryption standards for portable storage devices.
• Establish a reporting procedure for notifying a responsible party in the event that a portable data storage device is lost or stolen.