USB Blocking and Endpoint Protection with DLP

Introduction

What is Data Loss Prevention (DLP)?

Data Loss Prevention (DLP) refers to a range of measures, including strategies, tools, and processes, created with the purpose of averting the unauthorized disclosure, leakage, or loss of sensitive data within an organization. The fundamental objective of DLP solutions or Data Loss Prevention solutions is to safeguard data from being accessed, shared, or stored in an insecure manner, which could potentially result in security breaches, non-compliance with regulations, or harm to an organization’s reputation.

DLP systems typically encompass a blend of software, hardware, and policies that assist organizations in identifying, monitoring, and safeguarding sensitive data at every stage of their existence.

What is USB blocking or USB endpoint protection?

USB blocking or USB endpoint protection is a data loss prevention (DLP) technique which aims at preventing the loss or leakage of crucial organizational data from various devices connected to USB ports. DLP USB blocking essentially allows the controlling and blocking of unwarranted access to removable storage media and prevents data theft via USB devices. These devices include pen drives, USB drives, USB-tethered devices like laptops or mobile phones, scanners & printers, USB-C docking stations, USB-C display monitors, and more. The leakage of data from USB 2.0 as well as USB 3.0 ports is a critical security issue for any organization and hence calls for DLP software that can block data leaks or data loss from USB endpoints. USB data blocking and USB endpoint data protection covers many devices and all USB endpoints of a machine, and works towards protecting data integrity as a security measure for organizations globally. The working principle for USB data protection includes the definition of certain policies which will govern the behaviour of the USB data endpoints and set the rules for blocking data from these USB ports.

Why do organizations need DLP USB blocking?

Security is a huge concern in today’s world where data flows freely and governs our lives. Every actor in an organizational system is a potential risk, susceptible to hacks and loss of data either voluntarily or involuntarily. This is a growing cause for concern among organizations since leakage of potentially sensitive data can have devastating consequences on the integrity and business of an organization.

Even more so is the risk from insider threats and voluntary data breaches/leaks. People are the root cause, and at the heart, of insider threats. Yet most security tools only analyze computer, network, or system data. Statistically:

25% of all security incidents are caused by insider threats.
69% of organizations have experienced an attempted or successful threat or corruption of data in the last 12 months.
The time to contain an insider threat incident increased from 77 days to 85 days, leading organizations to spend the most on containment.
Threat incidents that took more than 90 days to contain cost organizations an average of $17.19 million on an annualized basis.

Among them, USB data leak/theft is the most common and easiest attack to carry out by an insider threat. Any inside attacker can carry out a USB data leak. This could be in the form of using USB peripheral devices to transfer critical or sensitive information from a corporate machine.

USB data leaks by insider threats can also be in the form of malicious attacks. An insider threat could carry out a BadUSB attack using an infected/malicious USB device to inject malicious payloads or carry out harmful commands.

USB data leaks can have serious ramifications in such cases, causing a lot of harm to an organization’s data integrity, structure, and security as well as bringing the organization to disrepute in some cases. It could require millions of dollars to repair all the damage done and take a long time to recover any other losses. Hence it is crucial to have efficient data leak prevention software in place that monitors both systems & data as well as potential insider threats.

The high-level use cases of USB blocking which could benefit organizations are as follows:

Audit removable storage: Track and analyze the usage of USB drives in your organization along with details on who accessed each device for what, when, and from where.
Detect USB usage anomalies: Trigger instant email notifications and block USB ports in response to high-risk events such as a sudden spike in file transfers to external storage devices.
Stop data theft/loss/leaks via USB: Restrict users from moving business-critical data to USB devices by blocking file copy actions to limit the possibility of a data leak.
Safe Mode Protection: Protects the machine operating in Safe Mode blocking unauthorized devices, while all authorized devices continue to get full access to your computer.
Malware entry prevention: Prevent the entry of malicious viruses that can be slipped into the systems via portable devices that can further infect your organizational network.
Data Protection: Ensures that sensitive data such as Personally Identifiable Information (PII) or Intellectual Property (IP) is not transferred to unauthorized portable devices.

How does USB blocking or USB data protection work?

USB blocking works in principle by establishing a set of governing policies within the USB blocking DLP software. These policies basically define the rules of how each USB endpoint on a machine behaves when an external USB device is connected to the machine on a particular USB port. The USB blocking or USB data protection policies govern whether or not a connected external USB device is authorized to access and share information between itself and the host computer. In other words, it controls and restricts access to transmission of data from the host computer.

Which endpoints are protected with USB blocking?

USB blocking can be done in two ways:

1. Port Blocking: This entails the complete restriction of access to USB ports, effectively preventing users from connecting any USB devices. This includes a wide range of peripherals such as USB drivers, external hard drives, printers, and other similar devices. When port blocking is implemented, users are unable to establish any form of connection or communication through the USB ports on their systems. This measure serves as a means to enhance security and control over the use of USB devices within a network or system environment. By blocking USB ports, organizations can mitigate potential risks associated with unauthorized data transfers, malware infections, or the introduction of malicious software through removable storage devices.

2. Access Restriction: This involves policy-based access restriction i.e. specific type of access to USB ports in accordance with the policy you set for the particular device. Access Restriction can be further categorized into multiple types:

Write Access Restriction: This type of restriction prevents users from copying, saving, or modifying data on USB drives or other USB storage devices. It ensures that data cannot be written or transferred from the computer to the USB device.
Read Access Restriction: In some cases, organizations may implement read access restrictions to prevent unauthorized data extraction from USB devices. This restriction limits or denies the ability to read data from USB devices, effectively blocking the transfer of data from the USB device to the computer.
Device Class Restriction: USB devices are classified into different categories based on their functionality, such as mass storage devices, printers, keyboards, etc. USB-blocking Data Loss Prevention solutions can restrict access to specific device classes to prevent the connection of certain types of USB devices. For example, an organization may choose to block access to mass storage devices to prevent data exfiltration.
Device Whitelisting: Whitelisting is a method where only approved USB devices are allowed to connect to a computer. USB-blocking DLP solutions can enforce a whitelist policy, allowing only authorized USB devices to be recognized and used. Any unauthorized device attempting to connect will be blocked.
Device Blacklisting: Blacklisting operates in the opposite way of whitelisting. In this case, specific USB devices or device identifiers are added to a blacklist, and any device matching those entries is blocked from connecting to the system. This approach is useful for blocking known problematic or unauthorized USB devices.
Time-Based Access Restrictions: USB-blocking DLP solutions may offer the capability to enforce time-based access restrictions. This allows organizations to define specific time periods during which USB devices are permitted or blocked, providing additional control over when and for how long USB access is allowed.

Conclusion

USB blocking is a crucial security measure in today’s digital landscape, and Data Loss Prevention (DLP) solutions provide an effective means of implementing this control.

USB devices, while convenient for data transfer and storage, can also serve as potential vectors for data breaches, malware infections, and unauthorized information infiltration.

USB blocking helps mitigate these risks by restricting the use of external storage devices and controlling data flow within an organization’s network. By implementing USB blocking through Data Loss Prevention solutions (DLP solutions), organizations can reduce the risk of insider threats, accidental data loss, and malicious activities. They gain greater visibility and control over the data leaving or entering their network through USB ports, enhancing overall security posture.

Furthermore, USB blocking can contribute to improved productivity by minimizing distractions, preventing the introduction of unauthorized software or files, and reducing the potential for system infections or disruptions caused by malware-infected USB devices.

However, it’s important to note that USB blocking should be implemented in a balanced manner, considering the organization’s specific needs and requirements. Striking the right balance between security and usability is crucial to avoid hindering legitimate business operations or causing unnecessary frustrations for employees.