USB Drives and Corporate IT policy

U

UberSwank

Gawd
Joined
Oct 12, 2000
Messages
757
My company has recently had a fair amount of data stolen from internal servers - probably with a usb drive. Does anyone know of any software that will copy the contents of a usb drive to a folder on the hard drive upon insertion and silently? We're trying to determine who might have caused the leak, but since they are local admins it's a bit more of a pain. Any ideas?
 
There was something about this on one of the security focus mailing lists. Someone did put together a POC software that would do a USB grab of predefined folders. I do believe it's since become paid software only.

Edit:
Found it:
Vulnerability Development: reconsidering physical security: pod slurping
http://seclists.org/lists/vuln-dev/2005/Jun/0004.html
 
You can disable USB drives via a group policy if this is a Windows network. You might also want to look into enabling file access auditing.
 
I remember seeing that GFI has a product to lock down usb and other (firewire) drives.


http://www.gfi.com/lanpsc/

from their website:

GFI LANguard P.S.C. allows you to define which users can use removable media centrally from Active Directory – simply by making them a member of three pre-defined groups.
Click to expand...

note: I have never used this product.
 
Boscoh said:
You can disable USB drives via a group policy if this is a Windows network. You might also want to look into enabling file access auditing.
Click to expand...
I would enable auditing on your file servers. Then configure the directories to be audited for Full Controll/Success and Failure.

Depending on how much access the shares get, you may need to up your security event log size.

I do all of this through group policy so if an local administrator disabled or reconfigures it, it will get re-enabled the next time the machine refreshes policy.

Other thing you should do is limit the number administrators you have. We have several people who perform administrative functions on machines, but don't need full domain admin rights. For example: our SQL DBA has local admin rights to our SQL servers and nothing else.

I don't know how your environment is configured, but the less admins the better.
 
You must log in or register to reply here.
Back
Top