How are you dealing with the use of USB drives?

[fred54]

Hi

Just a general query about how others approach the use of USB drives in school. We do not have a restriction on the use of USBs but I am noticing more and more virus-infected drives brought from home. Our anti-virus is quite good in catching the majority but no anti-virus will pick up 100%. I want to tighten up the security of the network but it is not practical to put a blanket ban on their use. The options available seem to be:

adjust group policies; third-party software - are there any out there actually as good as they say they are?; partial or complete bans on their use.

 

It would be good to hear what sort of approach other schools are taking.

[BIST]

Most antivirus products have an option to disable USB pens but not powered USB Hard Drives. I know ESET does this

 

Shaun Dibble

VSP MCP

[ToyHeartsFan]

"adjust group policies" - This but we dont block USB! I have added a software restriction policy that will stop users running exe files etc... from USB drives so they cant run them then sophos will delete any infected files it finds.

 

"third-party software" - Never tried any!

 

"partial or complete bans on their use" - Would need to be enforced, possibly with Group Policy or they will just ignore it, may impact on devices such as dig cams that are seen as removable media? But on the plus side if you are a secondary less worry about kids bringing in files they shouldnt have in school...

[timzim]

Sophos Enterprise Control v4 seems to have fairly comprehensive Device Control and Application Control policies. I'm currently trying out a few more restrictions on our wayward pupils to try to put a stop on their pesky USB devices.

[SYNACK]

If you have Vista or above the policies allow you to allow or restrict certain device IDs from being installed, this would let you allow cameras and other school certified device types but disallow any others or block specific problematic ones.

 

Computer Config\ Admin Templates \ System \ Device installation \ Device installation restrictions

[maniac]

Most of the viruses on USB memory pens are activated by the autorun procedure, so if you diable autorun on external drives this goes some way to stopping a lot of the problems.

 

We just make sure our antivirus is absolutely up-to-date, other than banning their use completely I can't see any other way round the potential risk of viruses on them. We did evaluate this quite in depth and decided the risk was small providing we invest in a good virus checker, so we did just that.

 

Mike.

[fred54]

Thanks to all who have replied so far -your feedback has been useful. Seems so far that the way to go is group policy in conjunction with tweaking antivirus. I would be interested to hear if anybody is using any good third-party products.

[MYK-IT]

I use a combination of:

 

Software Restrictions (Using GPO & disables Autorun!)

USBDLM (Restricts Drive Letters and runs a script to show our USB AUP when USB inserted).

Sophos Device Control (either disables/restricts USB, more importantly stops the CD-ROM partition being mounted on U3 drives that software can also be installed run from).

[soveryapt]

Although I don't lock down USB drives, as others have said, I was thinking of doing so for student accounts, more to stop the fact that we have a couple of students who come in and like to print off rather large documents. Now, we've just got PaperCut NG in place and I'm trying to convince the staff that we need to put the students on a print and release setup, but that would mean more staff involvement and they'd rather leave them to it.

 

But now, I can't lock down USB drives for students as I've just been informed that I need to provide USB drives to a large number of our students as they need to learn how to use them as part of their functional skills.

 

ARGH! Catch 22!

 

[/RANT]

 

Sorry .. that turned more into a rant than anything useful. I think that so long as you have in place a decent AV solution, you can get away with blocking certain files from running (.exe etc) which should hopefully lock things down enough, but I guess it depends on your reasons for doing it. If your AV is good and updated then you should, on the most, be ok, but if you have a number of want to be hackers, then it's another issue.

[synaesthesia]

Other than the usual removal of autorun ability for USB drives, I also create a folder on any teacher USB drive I get hold of called autorun.inf and give it +R +S +H attributes and remove permissions for anyone but administrator. Double whammy for the school systems and offers a level of protection at home for them too, however that may be moot very soon as I start a drive to get Truecrypt in use in as many places as possible.

[Guest salan]

Has anyone any ideas on how I can block exe's etc from pens ie only allow data?

We got hit with the conficker over the summer and it was a major pain to remove. I have blocked removable media at the mo, but i am getting pressure to unlock them again for staff (kids it will remain blocked).

I vaigly remember some software that scanns you pen and if it finds any programs etc on it . it locks it out. It will only allow data to be on the pen. Does anyone know of such software?

Alan

[featured_spectre]

Anything plugged into the USB slot does not get registered due to us disabling them via GPO (for the back ones) and disconnecting the front ones. Win win for us here.

[jcollings]

We allow the use of usb drives with some of the restrictions listed above (no autorun, no exe from usb drive) but our biggest way forward is to get students to upload work to our Sharepoint VLE - this cuts the issue out to large extent. We are working with staff and students to encourage them to use My Site - it's early days but people are starting to use it.

[Guest salan]

We allow the use of usb drives with some of the restrictions listed above (no autorun, no exe from usb drive)

How do you do the 'no exe's'?

Alan

[kili]

Has anyone any ideas on how I can block exe's etc from pens ie only allow data?

We got hit with the conficker over the summer and it was a major pain to remove. I have blocked removable media at the mo, but i am getting pressure to unlock them again for staff (kids it will remain blocked).

I vaigly remember some software that scanns you pen and if it finds any programs etc on it . it locks it out. It will only allow data to be on the pen. Does anyone know of such software?

Alan

 

 

The answer is here Go to post number 19. I implemented this solution and it works great also blocks cd-rom drives from running exe's and any other file types if you wish.

 

Kili

[SimpleSi]

At one school where conficker ran wild I banned drives/cameras/anything with RW memory and cleaned everything (took 3 goes!). I then disabled autorun on any devices and only allowed school pen drives that had been personally cleared by me.

 

I think disabling autorun will stop most bad virus from circulating and I hope/trust that Sophos could catch any infected word documents etc.

 

And banned hotmail etc so any incoming edocs come via the county email system only.

 

regards

 

Simon

[fedora_explorer]

I've tried to request that they be disabled. I do realise how students and staff use them to transfer work around but with the portal being implemented across my schools, with home access, they can easily copy their work to that. Unfortunately I was over ruled by the powers that be. I have set Group policy to stop EXE files from being run from removable media but it doesn't stop the potential for viruses to get in on memory sticks

[andy_whitlock]

We've had conficker here also. Manual clean, staff informed only to use cleaned pens. We've got autorun disabled and USBDLM on all workstations. All exes are blocked for users off pen drives.

 

Mandatory encryption will be in place for staff soon (I hope). Would prefer to ban them - but staff would be lost without them. Need an alternative solution before they're banned (hopefully get there some day)!

[Ashers]

We use the GP to restrict drive letters and then we use all of those that were available. We then use Sophos endpoint to block all removable data devices, but other USB devices are OK. We also block the front USB ports in the Students PC's in the PC BIOS. Basically USB data devices are banned from students PC's. Students need to use email or the VLE to get work in to the school.

 

For staff, we use Sophos endpoint to authorise USB devices and then ensure that these can only be read if they are encrypted, we authorise other USB devices, cameras and audio recorders, but as read only. I am hoping to ban USB data devices next year altogether, we have installed Barracuda SSL VPN for drive access for staff (and network server access for support) and once we have had it cleared by the exam body, we will extend the drive access to students.

[JamesG]

you cant just block USB ports or pens at schools anymore, nearly all students use them to save work onto.

[Guest Podge]

you cant just block USB ports or pens at schools anymore, nearly all students use them to save work onto.

 

But thats the point some people are trying to make in this thread. People are pushing the students to their VLE's, Email systems to transfer work to and from home, or other sites in their schools. As far as i am aware there is not policy in place that stops Network Admins blocking the use of USB devices for students and staff, i think its just to their own discression on how they want to look after their systems from Virus'.

 

I know the school i look after, Memory Keys are not blocked in anyway and we have a number of issues with some machines being infected with a usb device virus which is a pain to remove, and transfers from usb pen to usb pen. I have tried to get something done about it by giving members of staff their own encrypted usb pens from school, but they are still bringing them in from home, so I am wanting to impliment Sophos to do all the USB and Device Controling, guess its just a matter of time before something major happens.

[Guest salan]

We had Conficker over the summer and what a pain it was!

Now the usb ports are blocked for the pupils (they have to use the VLE) but open for Staff, but they have to get their pens checked by us first.

Not ideal but its such a pain. The staff have remote access now so usb's are not getting used as much now at all.

Alan