USB Drives and Removable Media: Risks and Policies

TL;DR

USB drives combine three risk classes: malware infiltration, uncontrolled data exfiltration, and physical attacks such as BadUSB.
A complete ban on USB devices is impractical in most companies. A risk-based policy with technical enforcement is the better approach.
Device control software can manage USB devices by type, class, and even serial number: only approved devices work.
The policy must cover both company-owned and personal USB devices and transparently define exceptions.
Mandatory encryption for all company-owned USB storage devices reduces the risk in case of loss to a minimum.

Small, convenient, and dangerous

A USB drive fits in any pocket, costs a few euros, and can store 256 gigabytes or more. These very properties make it one of the most persistent security risks in organizations. The same features that make USB drives so convenient also make them ideal tools for data loss, malware infiltration, and targeted attacks.

The topic of USB security has not lost its relevance, even though cloud storage and collaboration tools have replaced many use cases for USB drives. On the contrary: precisely because USB drives no longer play an official role in many organizations, there is often no current policy and no technical control. The USB ports on laptops and workstations are open, and nobody monitors what gets connected.

The three risk classes

Risk class 1: Malware infiltration

USB drives are a proven vector for malicious software. The infection paths are varied:

Autorun malware: Classic but still prevalent. The USB drive contains malware that executes automatically or through user action when connected. Modern operating systems have disabled autorun for USB devices by default, but many users still click on files they find on a USB drive.

Prepared documents: The USB drive contains seemingly harmless Office documents or PDFs with embedded macros or exploits. An employee finds the drive in the parking lot (a classic social engineering scenario that works surprisingly often), plugs it in, and opens the file "Salary_Table_2026.xlsx." The macros download malware.

Firmware manipulation: The USB drive has been manipulated at the firmware level and presents itself to the operating system as a keyboard (BadUSB). It automatically types commands that download malware or compromise systems. Since the operating system recognizes an HID device (Human Interface Device) rather than a storage device, traditional antivirus solutions don't catch it.

Supply chain attacks: USB devices are compromised at the manufacturer or in the distribution chain. Cases where promotional USB drives contained malware from the factory are documented.

Risk class 2: Uncontrolled data exfiltration

An employee can copy gigabytes of data to a USB drive within minutes and walk out of the building. Without technical controls, there's no way to detect or prevent this:

Customer databases, contract documents, financial data
Source code, technical documentation, construction plans
Personnel data, salary information
Trade secrets, strategy papers

This data exfiltration can be intentional (a disgruntled employee taking data to a new employer) or unintentional (an employee copies data to a USB drive to work from home and loses the drive on the train).

Both scenarios are problematic: one is a security incident, the other a data protection incident. And when personal data is involved, there may be a notification obligation under DSGVO (GDPR).

Risk class 3: Physical attacks

Beyond software-based attacks, there are physical threats from manipulated USB devices:

BadUSB: A USB device that impersonates another device — typically a keyboard. It can enter arbitrary commands in seconds: execute PowerShell scripts, install backdoors, exfiltrate data. BadUSB devices look like normal USB drives and are indistinguishable to the naked eye.

USB Killer: A USB device that delivers a high-voltage pulse through the USB interface, physically destroying the computer. Rare in practice but a real threat.

USB-based keyloggers: Small devices inserted between keyboard and computer that record all keystrokes. They can remain undetected for weeks or months.

Real-world incidents and their lessons

The Stuxnet worm

The most famous example of a USB-based attack is Stuxnet, which sabotaged Iranian nuclear facilities in 2010. The worm was introduced via USB drives into a network isolated from the internet (air gap). It demonstrates that even physically isolated systems can be compromised via USB drives.

The parking lot test

Multiple studies have shown that prepared USB drives "lost" in company parking lots or public areas are plugged in and opened by finders in 45 to 98 percent of cases. Curiosity regularly overrides security awareness.

Data loss from lost USB drives

In the UK, the National Health Service (NHS) lost several USB drives containing unencrypted patient data. The data breach led to significant fines and reputational damage. Similar cases exist in Germany, often involving personnel data or customer databases.

The USB policy: Structure and content

Fundamental decision: Ban or controlled use?

The first decision concerns the organization's fundamental stance on USB storage devices:

Option A: Complete ban. No employee may connect USB storage devices to company computers. USB ports are technically blocked (with exceptions for mouse, keyboard, and other non-storage devices).

Option B: Controlled use. USB storage devices may be used under defined conditions: only company-owned, encrypted devices, only for specific purposes, with technical monitoring.

Option C: Risk-based approach. Different rules depending on the area and protection requirements. In areas with high protection requirements (development, finance, HR), use is prohibited or severely restricted. In areas with normal protection requirements, controlled use is permitted.

For most companies, Option C is the most practical approach. A complete ban produces workarounds (employees use personal cloud services instead of USB drives, creating a new problem), and uncontrolled use is not an option.

Policy content

A USB and removable media policy should cover the following points:

Scope: Who does the policy apply to? All employees, contractors, interns? Which devices are covered (USB drives, external hard drives, SD cards, smartphones as storage devices)?

General regulation: May USB storage devices be used? If yes, under what conditions? If no, what exceptions exist?

Company-owned devices:

Only approved, encrypted USB storage devices may be used.
Devices are issued and inventoried by IT.
Lost devices must be reported immediately.
Devices may not be given to third parties.

Personal devices:

Personal USB storage devices may not be connected to company computers.
This also applies to USB drives received as promotional gifts or at trade shows.
Exceptions only with CISO (Information Security Officer) approval.

Data classification:

Which data classes may be transported on USB storage devices?
Confidential and strictly confidential data (per the classification policy) may only be transported on encrypted, company-owned devices.
Personal data is subject to additional requirements (GDPR).

Found USB devices:

Found USB drives and removable media must under no circumstances be connected to company computers.
Found devices must be handed in to IT or the CISO.

Violations and consequences:

Violations of the policy are documented and may have employment law consequences.

Technical enforcement

Device control software

A policy without technical enforcement is a paper tiger. Device control software enables granular management of USB devices:

Control device classes: Allow HID devices (mouse, keyboard) but block mass storage. This way, employees can still use their peripheral devices without USB storage functioning.

Whitelist approach: Only explicitly approved devices (identified by serial number) function. All others are blocked. This gives you exact control over which USB storage devices are used in the organization.

Logging and alerting: Log every attempt to connect a USB storage device. Alert the CISO on repeated attempts or attempts in high-security areas.

File shadowing: Create a copy of every file copied to a USB device. This feature is sensitive from a data protection perspective and requires coordination with the works council, but can be used when there's a concrete suspicion of data exfiltration.

Group policies (GPO)

In Windows environments, you can use group policies to control access to removable media:

Deny write access: Employees can read data from USB drives but not write to them. This prevents data exfiltration while still allowing receipt of data (e.g., from customers).
Deny read and write access: USB storage devices don't work at all. The strictest option.
Prevent installation of new device classes: Prevents BadUSB devices from being installed as new device classes.

GPOs are free but less granular than specialized device control software. For organizations with a small budget, they're a good starting point.

Enforcing encryption

For company-owned USB storage devices, mandatory encryption is recommended. There are two approaches:

Hardware-encrypted USB drives: Devices with built-in hardware encryption and PIN or fingerprint authentication. The encryption is always active and cannot be bypassed. More expensive than regular USB drives, but the most secure approach.

Software-based encryption: Tools like BitLocker To Go (Windows) encrypt the USB drive's contents. Encryption can be enforced via group policy: a USB drive that isn't encrypted is mounted as read-only.

Special cases and exceptions

Production and manufacturing

In production environments, USB drives are often needed for transferring CNC programs, firmware updates, or measurement data. A complete ban is rarely practical here. Possible solutions:

Dedicated, permanently installed USB stations with malware scanning before transfer
Only specific, inventoried USB drives for the production area
Air-gapped networks for production systems so a USB infection doesn't reach the office network

Presentations and external meetings

Sales or consulting staff occasionally need to show presentations on unfamiliar computers. USB drives are still common for this purpose. Alternatives:

Cloud-based presentation tools (if internet access is available)
Bring your own laptop and connect via HDMI/USB-C
If USB is unavoidable: hardware-encrypted USB drive that is scanned by IT after use on an external computer

External contractors and visitors

External contractors working on company computers may bring their own USB devices. The policy must regulate whether and under what conditions this is permitted. In high-security environments, it's not; in normal environments, an exception with virus scanning and logging may be acceptable.

USB security in the ISMS

Relevant controls from ISO 27001

A.7.9 (Security of assets off-premises): Safeguards for devices and media outside the organization, including encrypted USB drives.
A.7.10 (Storage media): Management, transport, disposal, and destruction of storage media.
A.8.12 (Data leakage prevention): Measures against unauthorized data exfiltration, including device control.
A.8.1 (User endpoint devices): Security measures for endpoints, including control of peripheral devices.

Risk assessment

USB risks should be captured as separate scenarios in the risk assessment:

Scenario "Malware infiltration via USB drive": Likelihood medium to high, impact dependent on the malware (up to and including total ransomware loss).
Scenario "Data loss via USB drive": Likelihood dependent on technical controls, impact dependent on the type of data.
Scenario "BadUSB attack": Likelihood low (targeted attack), impact high (complete system compromise).

Secure disposal

USB drives and other removable media must be securely destroyed when decommissioned. Simple formatting is not sufficient because data can be reconstructed with recovery tools. Secure methods:

Physical destruction (media shredder)
Cryptographic erasure (for encrypted devices: destroy the key)
Multiple overwriting with certified erasure software

Destruction must be documented, particularly when personal data or other sensitive information is involved. More on this topic can be found in the article on secure disposal of hardware and documents.

Rolling out the USB policy: Communication and implementation

Bringing employees along

A USB policy sent by email and never mentioned again will remain ineffective. The introduction needs a well-thought-out rollout:

Announcement and explanation: Inform all employees at least two weeks before the policy takes effect. Explain the reasons — not as abstract security theory but with concrete examples: "A lost, unencrypted USB drive with customer data is a reportable data protection incident that could cost the company a six-figure amount."

Provide alternatives: Before you restrict USB drives, ensure there are working alternatives. Cloud storage for internal file sharing, secure file transfer solutions for external partners, encrypted company-owned USB drives for cases where USB is unavoidable. If you take something away without offering a replacement, you force workarounds.

Training: Integrate the topic into the next awareness training. In ISMS Lite, you can distribute policies including read acknowledgment and document the training evidence for the audit. Show a live demo of a BadUSB attack (the impact on participants is tremendous) and explain the parking lot scenario with found USB drives. Practical demonstrations stick in memory far better than lectures about policies.

Transition period: Allow a transition period of four to six weeks during which technical enforcement runs in monitoring mode (logging without blocking). This way, you identify which employees and departments still use USB devices and can offer targeted alternatives.

Regular review

The USB policy is not a one-time document. Review it at least annually:

Are the technical controls still effective? Are they being bypassed by new operating system versions or device types?
Are there new attack vectors that need to be addressed?
Are the alternatives to USB drives working? Or have new workarounds emerged?
Are the exceptions still needed, or can they be rolled back?
How many violations were registered, and what patterns emerge?

USB drives won't disappear, even though cloud services have taken over many of their use cases. As long as USB ports exist on computers, organizations must regulate the use of removable media, enforce it technically, and review it regularly. A pragmatic policy that balances security and productivity is far more effective than a theoretical total ban.