USB block Advise please

[lionsl2005]

Hi

 

USB is open to all students and teachers and we don't have any encryption methods in place for the USB.

what is your advise on Blocking USB for students and teachers. how do you do it in your school. is there any legal / Ofsted requirements.

 

We have Citrix Virtual desktop access for the students and teachers.

 

Thanks

[shadowx]

We dont and I personally wouldn't want to.

 

All staff sign AUPs and have policies in place to either prevent them taking confidential data outside the school (by any means) or to ensure that it's encrypted. Failure to do that = goodbye.

 

As for students I dont know what you'd gain. Arguably you make the system more secure as there are less ways for malware to get into the system but in reality a properly configured student account with permissions would prevent 99.9% of malware getting beyond that users AppData/Home folders. Given the correct permissions it would be unable to install itself to the machine or spread through the network. At worst it runs until the machine is rebooted at which point RAM is cleared and it's gone. In terms of confidential data, the kids shouldn't have anything confidential on the school network.

 

Personally I think blocking USBs makes things harder, particularly for the students who may want to do work at home. Even if you have a way for them to access stuff from home it's never ideal. If you use a microsoft solution it likely requires the student to have Windows at home, if you go for something web based it's usually a lot slower, a lot more difficult and a lot more awkward. If you are relying on email attachments you have malware issues anyway and it's also slower and more awkward than a USB. You're also teaching the kids vendor lock-in if it's vendor specific and bad practices (IE, dont backup your stuff to a USB because you cant, lulz).

 

A better solution is to either educate all users (mostly staff) or provide encrypted USBs to staff and enforce their use from management down. Failure to secure data is a breach of professional standards as well as the law (DPA) and thus you're out. If in doubt, dont copy it.

[caffrey]

I use usbdlm here and assign certain drive letters, then file restriction policies on those drive letters.

[shadowx]

+1 to usbdlm, though we dont use file restrictions but probably should now I think about it...