USB And SMB Is A Risky Mix - InformationWeek
Government // Mobile & Wireless
01:12 PM
Keith Ferrell
Keith Ferrell

USB And SMB Is A Risky Mix

Drive-based threats may pose a larger risk to your business than drive-by attacks -- and USB drives may pose the largest threat of all.

Drive-based threats may pose a larger risk to your business than drive-by attacks -- and USB drives may pose the largest threat of all.Threats carried by USB drives, and brought inside your network by employees -- either deliberately or, more likely, in complete ignorance of the risk -- continue to worsen.

Panda reported recently that malware launched from USB drives accounted for a quarter of SMB infections last year.

Big organizations are getting flash-drive slammed too, including the biggest of all -- a recently revealed 2008 attack on U.S. military networks was launched from a USB flash drive.

It's easy to see why the crooks are taking the USB route to your material. Flash drives are cheap, increasingly powerful and absurdly easy to use: plug in the drive and you're ready to go.

Unfortunately, with Auto-Run malware, the crooks are ready to go too.

The Pentagon's solution to its flash drive problem was to ban the drives for a year. Not a bad solution -- and one every business should consider, at least for as long as it takes to put into place a proper removable storage device policy and monitoring tools.

That policy should include:

Clear and straight forward delineations of what drives can and cannot be plugged into your system. In addition to flash drives, removable memory in cameras, phones, as well as music players and other USB devices should be included in the policy.

Auto-Run and Auto-Play should be disabled (although hackers are on the lookout for ways around even disabled auto-run features.

Under no circumstances should unfamiliar USB drives and devices be introduced into the network. Even if the drive comes from a seemingly reputable source, it can carry malware, as recipients of an infected IBM flash drive tchotchke learned to their dismay.

Finally, give some serious thought and budget consideration to implementing business-wide port and device monitoring. You and your security manager should know every time a device is introduced into a port, whether in compliance with your USB device policy or not.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
How Enterprises Are Attacking the IT Security Enterprise
How Enterprises Are Attacking the IT Security Enterprise
To learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Register for InformationWeek Newsletters
White Papers
Current Issue
2017 State of the Cloud Report
As the use of public cloud becomes a given, IT leaders must navigate the transition and advocate for management tools or architectures that allow them to realize the benefits they seek. Download this report to explore the issues and how to best leverage the cloud moving forward.
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on for the week of November 6, 2016. We'll be talking with the editors and correspondents who brought you the top stories of the week to get the "story behind the story."
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Flash Poll