USB drives and other portable storage devices pose a number of information security threats to organizations – here’s what IT can do about it.
For example, one recent study found that out of a random selection of 50 USB thumb drives, two-thirds of them contained malware.
Companies can also lose data if an unencrypted portable drive is misplaced by an employee or stolen. Or, a malicious insider could use a thumb drive to secretly take confidential data out of the organization.
To prevent USB drives from creating those security problems, here are some steps IT can take:
1. Offer encrypted drives to some users
Most IT managers can probably assume some users in their companies are going to use USB thumb drives to carry data, no matter what IT’s policies say. So it might make sense for IT to invest in secure, encrypted drives to provide for users who deal with sensitive data.
2. Block USB ports on some machines
In some cases, companies will need to make sure an employee isn’t carrying data around on any portable device, whether it’s secure or not. For those situations, IT can disable USB ports on users’ computers.
3. Disable autorun and keep antivirus software up to date
Many portable drives, especially the free ones that are given out at trade shows and other events, contain malware that can infect a user’s computer. IT can prevent that by keeping antivirus software up to date and making sure AutoRun is disabled on Windows machines. USB malware often exploits that feature to launch a virus without requiring any action from the user other than plugging the drive in.
4. Monitor and manage devices
Device management software can help IT keep track of what drives are being connected to users’ machines, so policies can be enforced accordingly.
5. Train users
One reason USB thumb drives cause problems is that the devices are so small and inexpensive, many users might be careless with them. But IT can train users to understand that while the drives may be cheap, the data contained on them may have a big price tag.