Skip to main content

Pro audit program · v1.0

Removable Media & USB Control

USB drives, SD cards and external SSDs are the easiest exfil and infection vector. A focused control set.

  • General target area
  • CIS Controls framework
  • 5 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

USB drives, SD cards and external SSDs are the easiest exfil and infection vector. A focused control set.

Risks addressed

  • High Malware introduced via USB into the network
  • High Confidential data copied to unencrypted USB
  • Medium Found-and-plugged USB social engineering attack

Controls (5)

  1. USB mass-storage blocked by default

    High

    This control enforces the blocking of USB mass-storage devices (e.g., flash drives, external hard drives) by default across endpoints to prevent unauthorized data exfiltration and malware introduction. Implementation typically involves Group Policy Objects (GPO), endpoint detection and response (EDR) agents,…

    How to test + evidence

    Testing procedure: Endpoint policy disables removable storage unless explicitly approved.

    Evidence to collect: GPO / MDM policy.

  2. Approved USB devices use encryption

    High

    This control requires that all USB storage devices approved for organizational use employ hardware-based or software-enforced encryption to protect data at rest. Implementation typically involves maintaining an approved device list, enforcing device registration through endpoint management tools, and blocking unencrypted…

    How to test + evidence

    Testing procedure: Where allowed, hardware-encrypted drives only.

    Evidence to collect: Approved-device register.

  3. DLP inspects writes to removable media

    High

    Data Loss Prevention (DLP) systems monitor and inspect all data being written to removable media devices such as USB drives, external hard drives, and optical media in real time. When a user attempts to copy files to removable media, the…

    How to test + evidence

    Testing procedure: DLP scans files copied to USB; blocks confidential / restricted labels.

    Evidence to collect: DLP policy + sample alert.

  4. Auto-run disabled on all endpoints

    Medium

    This control ensures that Windows AutoRun and AutoPlay features are disabled across all endpoint devices to prevent automatic execution of code from removable media, network shares, and external devices. AutoRun automatically executes commands from an autorun.inf file when media is…

    How to test + evidence

    Testing procedure: Auto-play / auto-run disabled tenant-wide.

    Evidence to collect: GPO export.

  5. Security-awareness covers USB threats

    Low

    This control ensures that organizational security awareness training explicitly addresses threats posed by USB devices, including malware delivery, data exfiltration, and unauthorized software installation. Training content must educate users on risks such as BadUSB attacks, infected removable media, social engineering…

    How to test + evidence

    Testing procedure: Annual training includes USB / removable media risks.

    Evidence to collect: Training content + completion.