RE: Flash Drive Policy

["Steve Armstrong" <stevearmstrong () logicallysecure com>]

Jon,

But now you have expanded the argument as Users should not be operating
CIS equipment as administrators.  USB is not at fault here it is the
risk owners not actually getting a grip and reducing the risks they own.
I too have seen systems where users are logging on as Admin (and we were
even asked to undertake penetration testing against the internal LAN!),
but these are not LANs that can be secured.

However, the software we use (on correctly configured networks) is
http://www.becrypt.com/uk/solutions/connect_protect.php  which works
very nicely, and on the Gov systems that we advise on we implement
encryption on the USB sticks too - that way we don't care what happens
to them; if they connect they are encrypted and if the user is not
authorised to use that device or it is not encrypted, then it is not
accessible.  

Steve 

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
On Behalf Of Jon Kibler
Sent: Sunday, October 12, 2008 2:39 PM
To: Steve Armstrong
Cc: Steven Bonici; security-basics () securityfocus com
Subject: Re: Flash Drive Policy

* PGP Signed by an unknown key

Steve Armstrong wrote:
> I mus ttake issue with your 2nd point as I believe the 'head in the
> sand' approach to USB devices is so 1990's. USB is used in most
> businesses and it will continue to increase with the demise of open
> network shares on Corp lans (aka the swap share) and the introduction
of
> desktops to the Corp environment without ps/2 interfaces.
>
> I agree that policy and appropriate software can reduce the risk from
> USB devices but that is not our call (security advisors) it's the risk
> owners - who in my experieance are some of those asking  for them in
the
> first place.

Steve,

The problem I have is that most risk owners do not understand security
and the regulatory and business policies that drive them. That is why
security develops and deploys security policy. So, I would argue that it
IS the place of security to set policy for USB devices.

Regarding network shares, a lot of organizations are moving to all
network based storage, and either thin clients or no data stored on
local desktops. In such an environment, sharing data simply becomes a
matter of setting the correct access permissions. Collaboration software
suites (sharepoint, zimbra, etc.) are also being used to accomplish such
sharing.

Then, at least here in the states, we have regulatory issues that come
into play when you look at removable media issues. When you have to have
full audits of "who did what to this data, how, when, and from where",
the use of USB or other removable media simply makes these types of
audit trails impossible. So, I stick with my original statement that
there is no place for USB or other removable media in the workplace.

Finally, you indicated that there is 'appropriate software' that can
reduce the risks associated with USB drives. Please give some examples!
I have not seen any type of USB management software that cannot be
easily defeated by the typical desktop user -- especially if they have
local admin rights (which I find over 95% of all corporate desktop users
have!). I have yet to find a USB management package that would prevent
an attack as simple as plugging in a USB hub and using it to share your
rodent and a USB drive.

So, bottom line... I have to disagree. I stick by my argument that you
should not allow any USB or other removable media in the workplace.

Jon
--
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC  USA
o: 843-849-8214
c: 843-224-2494
s: 843-564-4224
http://www.linkedin.com/in/jonrkibler

My PGP Fingerprint is:
BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253


* Unknown Key
* 0xCF394253(L)





==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.


The information contained in this e-Mail and any subsequent correspondence is private and is intended solely for the 
intended recipient(s). The information in this communication may be confidential and/or legally privileged. Nothing in 
this e-mail is intended to conclude a contract on behalf of Logically Secure Ltd or make Logically Secure Ltd subject 
to any other legally binding commitments, unless the e-mail contains an express statement to the contrary or 
incorporates a formal Purchase Order.  For persons other than the intended recipient any disclosure, copying, 
distribution, or any action taken or omitted to be taken in reliance on such information is prohibited and may be 
unlawful.

Registered in England and Wales No: 05967368.  Registered Office: 36 Tudor Road, Lincoln, LN6 3LL.