How are you dealing with the use of USB drives?

Hi
Just a general query about how others approach the use of USB drives in school. We do not have a restriction on the use of USBs but I am noticing more and more virus-infected drives brought from home. Our anti-virus is quite good in catching the majority but no anti-virus will pick up 100%. I want to tighten up the security of the network but it is not practical to put a blanket ban on their use. The options available seem to be:
adjust group policies; third-party software - are there any out there actually as good as they say they are?; partial or complete bans on their use.

It would be good to hear what sort of approach other schools are taking.

Most antivirus products have an option to disable USB pens but not powered USB Hard Drives. I know ESET does this

Shaun Dibble
VSP MCP

"adjust group policies" - This but we dont block USB! I have added a software restriction policy that will stop users running exe files etc... from USB drives so they cant run them then sophos will delete any infected files it finds.

"third-party software" - Never tried any!

"partial or complete bans on their use" - Would need to be enforced, possibly with Group Policy or they will just ignore it, may impact on devices such as dig cams that are seen as removable media? But on the plus side if you are a secondary less worry about kids bringing in files they shouldnt have in school...

Sophos Enterprise Control v4 seems to have fairly comprehensive Device Control and Application Control policies. I'm currently trying out a few more restrictions on our wayward pupils to try to put a stop on their pesky USB devices.

If you have Vista or above the policies allow you to allow or restrict certain device IDs from being installed, this would let you allow cameras and other school certified device types but disallow any others or block specific problematic ones.

Computer Config\ Admin Templates \ System \ Device installation \ Device installation restrictions

Most of the viruses on USB memory pens are activated by the autorun procedure, so if you diable autorun on external drives this goes some way to stopping a lot of the problems.

We just make sure our antivirus is absolutely up-to-date, other than banning their use completely I can't see any other way round the potential risk of viruses on them. We did evaluate this quite in depth and decided the risk was small providing we invest in a good virus checker, so we did just that.

Mike.

Thanks to all who have replied so far -your feedback has been useful. Seems so far that the way to go is group policy in conjunction with tweaking antivirus. I would be interested to hear if anybody is using any good third-party products.

I use a combination of:

Software Restrictions (Using GPO & disables Autorun!)
USBDLM (Restricts Drive Letters and runs a script to show our USB AUP when USB inserted).
Sophos Device Control (either disables/restricts USB, more importantly stops the CD-ROM partition being mounted on U3 drives that software can also be installed run from).

Although I don't lock down USB drives, as others have said, I was thinking of doing so for student accounts, more to stop the fact that we have a couple of students who come in and like to print off rather large documents. Now, we've just got PaperCut NG in place and I'm trying to convince the staff that we need to put the students on a print and release setup, but that would mean more staff involvement and they'd rather leave them to it.

But now, I can't lock down USB drives for students as I've just been informed that I need to provide USB drives to a large number of our students as they need to learn how to use them as part of their functional skills.

ARGH! Catch 22!

[/RANT]

Sorry .. that turned more into a rant than anything useful. I think that so long as you have in place a decent AV solution, you can get away with blocking certain files from running (.exe etc) which should hopefully lock things down enough, but I guess it depends on your reasons for doing it. If your AV is good and updated then you should, on the most, be ok, but if you have a number of want to be hackers, then it's another issue.

Other than the usual removal of autorun ability for USB drives, I also create a folder on any teacher USB drive I get hold of called autorun.inf and give it +R +S +H attributes and remove permissions for anyone but administrator. Double whammy for the school systems and offers a level of protection at home for them too, however that may be moot very soon as I start a drive to get Truecrypt in use in as many places as possible.

Has anyone any ideas on how I can block exe's etc from pens ie only allow data?
We got hit with the conficker over the summer and it was a major pain to remove. I have blocked removable media at the mo, but i am getting pressure to unlock them again for staff (kids it will remain blocked).
I vaigly remember some software that scanns you pen and if it finds any programs etc on it . it locks it out. It will only allow data to be on the pen. Does anyone know of such software?
Alan

Anything plugged into the USB slot does not get registered due to us disabling them via GPO (for the back ones) and disconnecting the front ones. Win win for us here.

We allow the use of usb drives with some of the restrictions listed above (no autorun, no exe from usb drive) but our biggest way forward is to get students to upload work to our Sharepoint VLE - this cuts the issue out to large extent. We are working with staff and students to encourage them to use My Site - it's early days but people are starting to use it.

Quote:

---

Originally Posted by jcollings

We allow the use of usb drives with some of the restrictions listed above (no autorun, no exe from usb drive)

---

How do you do the 'no exe's'?
Alan

Quote:

---

Originally Posted by salan

Has anyone any ideas on how I can block exe's etc from pens ie only allow data?
We got hit with the conficker over the summer and it was a major pain to remove. I have blocked removable media at the mo, but i am getting pressure to unlock them again for staff (kids it will remain blocked).
I vaigly remember some software that scanns you pen and if it finds any programs etc on it . it locks it out. It will only allow data to be on the pen. Does anyone know of such software?
Alan

---

The answer is here Go to post number 19. I implemented this solution and it works great also blocks cd-rom drives from running exe's and any other file types if you wish.

Kili