Badaz52 Posted April 20, 2018 Posted April 20, 2018 Hi, We are currently looking into USB encryption and I've been asked to look into software that can do this rather than buying a bulk load of memory sticks that will be given out to staff. I've had a quick look and there is a lot of software (free or bought) that can do this but it requires the user to effectively do it whenever they connect a new USB or bring them to us to be encrypted (which they won't do). I've been asked to see if there is any software that will automatically encrypt USB but I didn't think this would be possible? Does anyone know of any?
djrscally Posted April 20, 2018 Posted April 20, 2018 (edited) Hi, We are currently looking into USB encryption and I've been asked to look into software that can do this rather than buying a bulk load of memory sticks that will be given out to staff. I've had a quick look and there is a lot of software (free or bought) that can do this but it requires the user to effectively do it whenever they connect a new USB or bring them to us to be encrypted (which they won't do). I've been asked to see if there is any software that will automatically encrypt USB but I didn't think this would be possible? Does anyone know of any? Closest thing to that is Bitlocker as far as I know. It will not automatically encrypt them but you can configure it to a) deny write access unless they are encrypted and b) open the "encrypt this usb" wizard when they're plugged in. I would argue automatically encrypting them is a bad idea anyway; your probably looking at a world of hurt if they get anxious about the weird dialog and progress bar and pull the stick and lose all their personal files or something. It's sufficient to have a policy that states staff must bring them to IT to be encrypted. Edit: Actually maybe it will automatically encrypt them, without even giving them a dialog if you configure it to. The language is a bit ambiguous so not sure on that but: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj679890(v=ws.11) Edited April 20, 2018 by djrscally 2
ThatBoringBloke Posted April 20, 2018 Posted April 20, 2018 Some words of advise - Don't give out BitLocker encrypted devices to folks who use Mac's at home...
MartinT Posted April 20, 2018 Posted April 20, 2018 I don't care, they get a Windows laptop so if their Mac can't read our Bitlocker'd USB drives it's tough!
thimon Posted April 20, 2018 Posted April 20, 2018 We use Safend. Not free, but a pretty good bit of software. The USB devices aren't usable on Macs after they have been encrypted, however they're a very small % of devices here so not an issue. Plus, OneDrive for the win!
Norphy Posted April 20, 2018 Posted April 20, 2018 Or Mac users could try this: https://m3datarecovery.com/mac-bitlocker/purchase.html 20% discount to edu.
Zoom7000 Posted April 20, 2018 Posted April 20, 2018 Why not simply block USB Flash Drives altogether and insist that all staff use a GDPR compliant cloud storage facility like Google Drive? Saves a ton of cash and no compatibility issues.
thimon Posted April 20, 2018 Posted April 20, 2018 Why not simply block USB Flash Drives altogether So tempting. How do external guests and speakers react when you tell them you don't accept USB sticks? For files larger than a standard PowerPoint file (for example) which can be easily emailed.
djrscally Posted April 20, 2018 Posted April 20, 2018 So tempting. How do external guests and speakers react when you tell them you don't accept USB sticks? For files larger than a standard PowerPoint file (for example) which can be easily emailed. We just made them read-only. Speakers can still bring their USBs and read presentations off them, you just can't write to them unless they're encyrpted.
thimon Posted April 20, 2018 Posted April 20, 2018 We just made them read-only. Ah same, I thought you COMPLETELY blocked them
AlexB Posted April 20, 2018 Posted April 20, 2018 You could use something like USBDLM (we use it for other reasons, but it can also do this) to mount all USB sticks/drives as read only. Allows externals and gives staff a transition period
MartinT Posted April 20, 2018 Posted April 20, 2018 You have to have an exception machine or two for mandatory USB encryption. For instance, our Kyocera copier PaperCut apps are updated from the USB socket and there is no way to get one to read a Bitlocker'd USB drive. Don't make your own machine the exception, though. It's important for staff to see that we follow the same rules as everyone else.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now