USB Flash Drives: Useful Device or Security Threat?

The Dark Side
As Alfred Nobel found out, whatever can be used for good can also be used for evil. And in this case, the USB Flash Drives small size and large storage capacity can make it a dangerous tool in the wrong hands. You don't have to be an administrator to install one of these devices in Windows 2000/XP, and you can't manage USB devices via Group Policy. These devices present two primary threats to your network: the introduction of malicious software and data theft/loss. And short of disabling all of the USB ports in your environment, they are impossible to defend against. 

• Viruses
  In the 1980's, floppy disks where the primary vector for spreading computer viruses because that is how most people shared data. In the late 80's and early 90's, Bulletin Board Systems (BBS) became the primary source for infections. After 1995, almost all new viruses where being spread via e-mail, or by sharing files over the web. Network administrators have been able to respond to this threat by installing antivirus software on their e-mail servers and restricting internet sites on their firewalls, but the use of USB Flash Drives can bypass these safeguards entirely. Users can either bring in infected documents from home, or take home a business document to an infected PC, update it, and return it to a corporate file server. Unless your antivirus policies are very aggressive, and you actively scan all files stored on your network, Flash Drives can present a new vector for computer viruses that is nearly impossible to defend against. Most AntiVirus software operates "reactively" to threats and can only identify viruses that have been previously identified.  A virus writer could theoretically "seed" a corporate environment with a few of these devices preloaded with a new virus in the hopes that a curious user will pick it up, and look at (open) the files on it making your company company ground zero for the next worldwide outbreak.
  
• Malicious software
  In addition to viruses, users could bring in unauthorized software or data files from home that didn't previously fit on a floppy disk. This includes shareware programs, software pranks, MP3 files, video clips, pornography, and other inappropriate files that affect productivity and violate corporate policies. Even worse is the prospect of spyware or keystroke loggers that could enable users (or worse hackers) to capture passwords or other sensitive information.
    
• Data Theft
  Corporate espionage is a largely underreported problem in the United States and Europe, and your company doesn't have to be a defense contractor to be a target. Hackers, corporate spies, and disgruntled employees steal data everyday, and in many cases these are crimes of opportunity. With a Flash Drive, an opportunity becomes any unattended and unlocked PC with a USB port. A little social engineering can give a hacker physical access to a corporate PC long enough to steal data, or plant spyware. Disgruntled employees can take home client lists, sales forecasts,  or research data in a few minutes. (At 1/Mb per second, a user can copy a 120Mb file to a flash drive in 2 minutes.) 

• Educate your users
  Flash Drives are already the "must have" toy for the gadget junkies, and as prices continue to fall, they'll probably become the premium corporate promotional giveaway of choice. You can't stop the tide, but you can educate your users early on as to the risks these devices can present, and establish a policy for taking data out of the office, or bringing files in from home. 
• Educate your security personnel
  If your security guards caught an unauthorized person walking through your corporate offices, would they know what to look for? Flash Drives are so small and unobtrusive, they are easily concealed and could even slip by unnoticed in plain sight. The people in charge of physical security for your environment need to know what these devices look like, how they work, and what risks they present. You may also wish to consult your legal department as to the legalities of searching and seizing these devices if found.
• Enforce the lock desktop policy 
  Many companies already configure their desktops to automatically lock when unattended for a few minutes, but often this interval is set anywhere from 10 - 20 minutes. In higher risk environments this should be 5 minutes or less. Yes, it's annoying and your users will hate it for the first few months, but it's essential for any workstation where a user account has access to sensitive data. 
• Update the antivirus policy
  You should configure antivirus software to scan all attached drives and removable media, and get your users into the habit of scanning files before opening them.
• Use only secure devices
  If your company issues these devices to employees or approved them for purchase, make sure you include devices with security features for users that have access to potentially sensitive data. (accounting, payroll, legal, sales, R&D, etc.) Make sure to use encrypted usb drives for crucial data. Be sure to enforce the use of the security features in these devices and train your users if necessary. 
• Include return information
  In the event your flash drive is lost or misplaced, including a small readable text file that includes return information could help you get it back. You may want to consider NOT including your company name in the file, and simply refer to a phone number or P.O. Box. You may also want to include a legal disclaimer that clearly identifies the information on the drive as confidential and protected by law.
• Restrict the USB ports on desktops
  You can't manage USB devices using Group Policy in Windows 2000/XP, but you can disable the USB ports or use a 3rd party tool called SecureNT. When disabling USB ports, you'll need to make sure any peripherals in use (such as keyboards, mice, PDAs, and scanners) use legacy ports instead of USB ports. In most corporate networks, printers are assigned to specialized network print servers and may not be an issue. A more feasible compromise would be to only lock out desktops that have access to sensitive data, or are in areas accessible to the public.  (i.e. a bank's branch office PCs should have USB ports disabled, but the secured corporate office is less of a risk.) SecureWave's SecureNT software allows businesses to control end-user access to I/O devices such as the floppy drive, Memory-sticks, PDAs, USB external storage, CD-ROM, serial and parallel ports, as well as many other Plug and Play devices.