There should be a Removable Media Policy in place that governs the acceptable use of removable media devices and specifies procedures for handling unknown/suspect removable devices.
Control Type: Administrative
Control Function: Preventive
Description: Removable storage devices such as USB flash drives, external hard drives, and SD cards remain one of the most popular ways to transport data from one device the another. However, if not properly vetted, removable media can be a huge security risk, as adversaries can plant malicious payloads on the removable devices and await a user to come and take the bait. Some of the most common payloads delivered via removable media are keyloggers, autorun malware, and killswitches. All of these exploits can occur covertly, with the victim not even knowing that the device they plugged in has compromised their system. Penetration testing/ethical hacker hobbyist websites such as Hak5 offer real examples of these attacks, showcasing how powerful a simple USB drive can become.
To help mitigate the risks posed by removable media, a Removable Media Policy should be developed, outlining the security expectations and requirements in place regarding specified removable media devices. The policy should contain:
- Scope: What constitutes removable media. Usually this would include USB flash drives, external hard drives, SD cards, and optical media. The policy should apply to all employees, as removable media is common at all levels of most organizations.
- Acceptable Activities: Which pieces and categories of company data is allowed on removable media, and for what purposes data can be stored on the removable media.
- Boundaries: Restrictions on where the data stored on the removable media can be moved to. In most cases, the data should be restricted to systems within the organization at a minimum. Optimally, the data should be kept within departmental boundaries. However, there may be cases when users should be allowed to move data into external networks, such as their own home network that they use for remote working.
- Controls: There should be technical controls in place to further reduce the risk posed by removable media. The two most popular are usually Data Loss Prevention (DLP and encryption). DLP is a centrally managed logic that detects sensitive data being exfiltrated and blocks/alerts on the activity. DLP can be placed on removable media as well as network/cloud storage locations. Encryption for removable media can be implemented through solutions like BitLocker Drive Encryption on Windows, and VeraCrypt for Linux. Windows Group Policy can be configured to mandate encryption of removable media before use is permitted. Another recommended Group Policy setting to enable is disabling autorun for external devices, so payloads are not launched immediately upon connection.
- Unknown Devices: Employees should know what to do in cases where unknown removable devices are discovered. Adversaries can drop malicious USB drives in the vicinity of the organization's facilities with the hopes of an employee retrieving it and connecting it to their system. The policy should specifically forbid detecting unknown removable devices to company devices. There should be a clear escalation path for reporting and handing over the unknown device.
- Disposal of Removable Media: just like with hard disk drives, removable media devices can contain sensitive company data that persists even upon deletion. Since removable media devices tend to be small, there is an even greater chance of users losing track of them, resulting in the media falling into the hands of adversaries. Data recovery tools such as Autopsy and Recuvra can be used by adversaries to retrieve data that has been deleted from the media. Thus, organizations need to track removable media devices throughout the data lifecycle. Issued devices should be cataloged to track who has them and for what purposes. The policy should specify that removable media needs to be returned to the IT department when no longer needed. The devices then need to be subject to the organization's Media Sanitization/Data Disposal Policy.