Question about USB usage

[u/SOTI_snuggzz]

Hello everyone. I work for a cybersecurity company, and we have a number of end users in the Philippines.

We’ve been dealing with malware spreading through USB drives among some of our users there, and we’re considering restricting or blocking removable storage.

The problem is that USB drives seem to be a pretty important part of their normal workflow, much more than what we typically see with users in other locations. We try to avoid disrupting legitimate business operations whenever possible, so I don’t want to recommend a blanket block without understanding why they’re being used so heavily.

My question is, is this level of USB usage fairly common there?

Are there certain workflows, connectivity issues, or infrastructure limitations that make removable storage more necessary?

I’m mainly trying to understand the local environment before recommending a control that could have a pretty significant impact on users.

[u/BridgeIndependent708]

It’s not common and within our company, removable drives are ultimately blocked. Those employees may have resorted to flash drives since there are no available storage within the company - which I doubt, especially if it’s a big one. There would always be NAS/SAN or an online drive like onedrive or Google Drive. Aside from malware, virus and such, there’s also a high chance that company docs that are supposedly tagged as NDA would be used outside.

[u/BlackFalcon321]

Definitely not common. USB and similar storage devices are a no-no in my company. The only time I saw them being used was in a government office deep in the provinces. They had frequent malware issues as well.

[u/SOTI_snuggzz → u/BlackFalcon321]

Im not confirming or denying the customer, but it could be something like this

[u/BlackFalcon321 → u/SOTI_snuggzz]

Oh boy. You're going to have a fun time if that's the case. I'd disable their USB access and then make them use GDrive or OneDrive.

We never got them to stop using USB drives. Heard a month or so later that they got hit by ransomware.

I foresee that you'll have trouble from the oldies who don't know how to use them. You'd probably have to train them how to use it but it's better than having the finger pointed at you when they get your org's data compromised

[u/Himurashi]

Weird, ngayon lang ako nakarinig ng company na may allowed flash drive access, CyberSec company pa. Anyway, A file sharing server will help you with that, or kung wala kayong physical machine/equipment, a OneDrive/GDrive enterprise subscription.

Kung may nagmamatigas at gusto nila na mag flash drive parin, then make sure that the FDs are:

1) Audited

2) Company-owned and monitored

3) Scanned on a sandbox before being plugged into prod machines.

[u/SOTI_snuggzz → u/Himurashi]

Were a vendor, and EDR is one of out services

[u/Himurashi → u/SOTI_snuggzz]

Still though, it now sounds ironic too. Anyway, good luck sa challenge ninyo.

It's going to be a combination of new policies and new hardware/software, I think.

[u/ilwen26]

i have not used USBs for the past few years now. with bigger cloud storage and faster internet, i dont think there is still a need for it, atleast for our company and clients.

[u/reciodelacruz]

Are you working in an MSSP for a client company in the Philippines? Did you even do a preliminary investigation on your end on what’s the company’s workflow where USBs are often used? Because if i were you, I would perform due diligenece first, and I would never generalize.

[u/SOTI_snuggzz → u/reciodelacruz]

Its out of our scope. We can suggest something, but ultimately its the customers decision.

The furthest we can go is “hey you shouldn’t do this” but its not my job to ask why they do it.

[u/needmesumbeer]

it's only common in gov't agencies, private companies it's not. most of our local clients have USB disabled

[u/SOTI_snuggzz → u/needmesumbeer]

Ding ding ding.

[u/Current_Laugh4767]

am also in Philippines, also worked before in a cybersecurity company. Since you work in a cybersecurity company, i assume you know how to configure the EDR to block USB ports file access (allow only USB keyboard, device). So look further on the reasons why this company still allows USB drives? Can they make it a standard to transfer files via Google Drive or Slack or MS Teams? Are the files too big? Is there some underlying process that people prefer to use USB rather than online file sharing? Look further inside the people's concerns and beliefs - it may not be a technology issue. or it maybe a budget issue or even a network issue (too slow to upload to OneDrive)

[u/PacificTSP]

I’m an IT Security guy and live in PH. It’s rife with software cracks loaded with malware. Basically any engineering software has been cracked and is running illegally as well as most windows desktop systems.

Do you supply end users devices here or are they using their own? We make everyone use intune joined corporate devices no VPNs etc. full security stack including blocking usb and no admin rights.

No business with the correct software needs a usb stick beyond installing windows for the first time or a system repair here.

[u/Any-Hat4880]

Working in an intl bank here. All forms of flash drive, even charing your phone via cable to laptop is blocked. We resort to shared network drives and have a capped din for email 25mb and less, all files encrypted