USB Storage Device Exception

Why is Access to USB Storage Devices Restricted?

USB storage devices, especially USB Flash Drives are notorious among hackers due to inexpensive cost and portability. Plugging a USB Storage Device in CSUN-owned workstations can jeopardize the security posture of a CSUN workstation and the data contained within it. USB storage devices are one of the easiest channels to spread an infection to a workstation and network. Disabling USB storage devices also discourages use and the storing of unencrypted Level 1 or Level 2 data on flash drives and external hard drives. USB drives are small and easy to lose. If data is unencrypted, the data is easily accessible to non-authorized individuals. The USB Storage Devices used in CSUN workstations must be encrypted.

Abuse of USB Storage Devices

Abuse is defined as, but not limited to:

• Transferring CSUN owned data to personal USB Flash or External hard drives.
• Storing unencrypted Level 1 data on USB Flash or External hard drives.
• Inadvertently transferring malicious files to a CSUN-owned workstation.
• Plugging in USB Storage Devices found on the ground or handed out for free.

Dangers of USB Storage Devices

USB Storage Devices, especially the ones found on the ground or handed out for free can contain malware that can infect a workstation. It is common for hackers to use this method to install malware on victim’s workstation. Once installed, the malware can perform a variety of malicious acts such as capturing keystrokes on your keyboard and encrypting your hard drive. The hacker can ask for ransom or spread the malware from one computer to the next, gradually infecting many, if not all, workstations.

How to Request a USB Storage Device Exception

For audit purposes, CSUN must retain documentation showing that a USB storage device exception has been approved. To request an exception, CSUN employees must follow these steps:

1. Read this USB Storage Device exception and understand the responsibilities of being granted access to the USB ports on your computer.
2. Complete the USB Storage Device Exception form.