Security has always been a catch 22 suitation.............
Ease of work (Increased Productivity) versus Restrictions (Against potential
security threats)

Well we do not have a policy specific for USB Drives, but we have a policy
which covers all removable media etc.

Moreover there are innumerable products available in the market that provide
control for USB ports and devices.

You could have a default policy that blocks access to all USB ports for
everybody or user based or PC based.

This is one Risk that has all Security Professionals thinking.............

On a Similar lines is the infiltration of Mobile Phones with
camera.......Funny I have seen people walk by with Camera Phones in areas
restricted for Photography...
Would love to hear the groups take on that...

Regards

Samir Pawaskar
CISSP, SBCI, BS7799 LA, CCNP, MCSE

----- Original Message -----
From: "Kosala Atapattu" <kosalaa (at) carcumb (dot) com [email concealed]>
To: <bs7799 (at) securityfocus (dot) com [email concealed]>
Sent: Tuesday, June 06, 2006 7:30 AM
Subject: USB pen drive policy

Hi all,

Is there any one use a USB pendrive policy? I was just wondering how to
handle USB pendrives since there capacities are increasing by day and
becoming a potential threat of Information leakage.

At the same time USB pendrive have become some thing we can't get rid
of, there uses overwhelm user productivity in some cases (people take
work home..:)).

Has any one come across similar Policy regarding USB pen drives. Any
comment highly appreciated.

Kosala Atapattu

[ reply ]