Access to USB Drives for Admin Staff?

[jonatkinson]

We are having a little discussion about whether we should allow access to Pen Drives for our Admin Staff. We have 2 logically seperate networks, one for Admin and one for Curric. At the moment, they dont have access to Pen Drives at all, (they can plug them in, but have not read permissions, and they are hidden in My computer)

 

members of the Curric network do.

 

This is causing us some grief at the moment and we are discussing the potential AV risks of letting them use them. We get that there is a risk of virus's etc on pendrives, but how serious is it, with uptodate machines (win7, all updates) and updated antivirus on all machines and servers. (Avast Business)

 

Do we allow them access to use Pen Drives, which will make life easier?

How much of a risk is there, really?

 

Any thoughts??

 

Jon

[ToyHeartsFan]

All of our users can use USB sticks, if your anti virus is working ok and you dont allow them to run software from removable media then the risk isnt that high.

 

Stopping them putting anything on a memory stick that is covered by the data protection act is another matter all together, so is them dumping their music / photo collection etc from the memory sticks into their home dirs...

 

PS when you say autoupdates unless you have set up a wsus server then you have no way of knowing if the wokstations are actually up to date...

[jonatkinson]

PS when you say autoupdates unless you have set up a wsus server then you have no way of knowing if the wokstations are actually up to date...

 

Cheers, Should have said that the updates are managed through WSUS, so I know they are getting them.

 

Also, not too worried about the Music and Photos stuff as we have File Server Resource Manager running

[Michael]

Yes, you should allow users to use memory sticks, but make sure you disable Autorun or AutoPlay as it's known. You can do this via GPO. This is the root cause of viruses spreading from machine to machine in a network environment.

 

The alternative is some form of remote access - ideally VPN, which allows data to remain in school. VPN of course is encrypted and there's nothing to plug in either. This is my preferred approach.

 

Eventually USB memory sticks will go the same way as floppy disks, with the exception of memory sticks in cameras or other devices. That is a little different.

[kernewek-sam]

Yes, you should allow users to use memory sticks, but make sure you disable Autorun or AutoPlay as it's known.

 

In addition to that, in the BIOS set a password or disable USB booting. Yes we had to do this!

[mavhc]

What do they need to use UFDs for in the first place?

[ijk]

Eventually USB memory sticks will go the same way as floppy disks, with the exception of memory sticks in cameras or other devices. That is a little different.

What are memory sticks going to be replaced with?

Edited June 12, 2012 by ijk

[FN-GM]

What are memory sticks going to be replaced with?

 

Online storage

[ijk]

Online storage

 

How soon?

[Michael]

What are memory sticks going to be replaced with?

 

There's no set time-line, but over time users will prefer central/cloud storage. Although memory sticks easily exceed the capacity of floppy disks - they break easily, they get lost or stolen and it's more difficult to back data up.

 

If data is stored centrally on a server for example, it can be easily backed up and with RAID technologies and there's an additional layer of protection minimising data loss.

Edited June 13, 2012 by Michael

[Dos_Box]

Online storage

 

Agreed. I use a mixture of Dropbox and SkyDrive now so much so that I very rarely use USB sticks unless it's for very large files (2GB+). Dropbox correctly setup and encrypted via TruCrypt is very useful and to have your work 'everywhere' makes life so much easier.