Slashdot Mirror
IBM Bans Staff From Using Removable Storage Devices (theregister.co.uk)
An anonymous reader shares a report: In an advisory to employees, IBM global chief Information security officer Shamla Naidoo said the company "is expanding the practise of prohibiting data transfer to all removable portable storage devices (eg: USB, SD card, flash drive)." The advisory stated some pockets of IBM have had this policy for a while, but "over the next few weeks we are implementing this policy worldwide." Big Blue's doing this because "the possible financial and reputational damage from misplaced, lost or misused removable portable storage devices must be minimised." IBMers are advised to use Big Blue's preferred sync 'n' share service to move data around.
No one under 40 does anyway!
But how much productivity is lost because I need to use my personal laptop to transfer screenshots from a spectrum analyzer (USB port only!) via emailing to myself? My company does basically the same thing, and as an electronics engineer that spends a bunch of time at a test bench, this SUCKS!
(((dB)))
about wi-fi enabled portable hard drives and NFS or Samba shares. or FUSE or SSHFS.
You phone's internal storage is good enough for all your industrial espionage needs anyhow.
Has anybody written a 'Rubber Ducky' app for Android yet?
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
Tighten that noose of security more tightly around your own neck, oh thrashing blue dinosaur.
Have they considered device-level encryption?
Knowing IBM they still use these on a regular basis.
I'm in IT. If I'm blocked from using USB devices, getting files to/from new servers, new laptops, etc. that aren't yet on the network becomes extremely problematic. And what about systems that have problems and can't currently get on the network?
What about setting up USB drives for Windows/Linux/etc. installation media?
What about all the times I needed to copy data to/from a USB drive for legal discovery purposes? (E.g., we were sued)
There are *MANY* completely legitimate reasons for using usb flash/hard drives to transfer/copy data.
at all of their locations. No way would this policy work for us since we still have several locations on dial-up.
What ever happened to leaving work at work? When did we even need to start using removable storage devices to take work with us out of the office?
I wonder if this ban is to prevent casual idiocy from happening (someone losing an unencrypted USB flesh drive with their documents on it), or if it is a measure against people trying to slurp confidential documents.
If this is intended to prevent deliberate intrusions, good luck. I've seen people get around this by shoveling data via iTunes or another sync program, or just plug in an Android device and use MTP (which presents itself differently than a mounted drive.) Worst case, there is popping photos of the screen and making QR codes of encoded binary files.
If a company has to worry about deliberate espionage, they need to get with HR and start cleaning house. No amount of tech is going to stop someone determined to take info. Instead, there needs to be separation of duties and limits to what people can access... basic stuff, but with the idea of "running thin" so just a few employees can wind up with a lot of confidential stuff they really don't have a need for.
If IBM is worried, perhaps they need to hire more employees and rely less on vendors/contractors, so they get more loyal people, not people who will bail when there is some job that offers better benefits out there.
So what do external USB DVD/CD writer drives look like? Are they included?
Extremely common especially considering most laptops don't include them any more, despite being widely needed.
For example: I sometimes deal with Raspberry PIs being used for organizational purposes, and in order to set them up I need to format and image a SD card. I have a number of environmental controllers whose only network interface is a Serial port, and the procedure to kick off a firmware update is to load the new .BIN file onto a SD card, and then boot up the controller with the card containing a new firmware file, And also, system logfiles, and some test equipment's log data is written to SD.
There are plenty such use cases where "Portable media" is the only viable option to accomplish vital tasks.
Part of my job is managing suppliers. The corporate IT departments of all of the companies all have different policies regarding how data is to be moved. Often times, it's just easiest to have an liaison engineer come over with a flash drive to move the data. Email can't handle large enough files, getting IT to setup an FTP server takes weeks, and is still clunky. I have had some success using box.com for one project.
I realize there has to be a trade off between getting work done, and security. I'm not sure this is worth the cost.
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
News Flash: IBM's IT department does what every other IT department does! Film at at 11!
(Except I can't seem to copy it to my flash drive... lemme try DropBox... blocked, ummmm... how about my old university FTP sit... oh that's down... )
I've worked for a couple of very large financial institutions, and they disabled USB drives 5+ years ago. It not only curtails the threat of pilfering information, but shuts down a hole in security. "hey, I found this thumb drive in the parking lot, I'll just plug it in and see what's on it"
It was a pain at first, but you quickly learn that for MOST work, it's not necessary. If it is, you can usually get an exemption.
I am surprised this made the "news" though.
My beliefs do not require that you agree with them.
Ban there staff from being pakistani's.
Hey, IBM.... Welcome to 2009!
___ I don't respond to Anonymous Cowards, and I Never Mod them UP.
From the featured article:
I guess those who work in the field will end up seeing a lot more cellular data bills attributable to use of "Big Blue’s preferred sync ‘n’ share service".
Things are looking CLOUDY.
My employer has done this for years. If you want to use external storage you can get one approved for use in an office environment by demonstrating a need. As far as the lab environment goes, you can *borrow* one of the lab's own specially approved, encrypted, and regularly inspected and cleaned drives for pulling data off of lab computers and equipment. Why any large IP-handling company would allow any old employee to tote around their own personal attack/leak vector is beyond me.
I worked as a software dev at a bank, and they had this policy as well. It's painful, and I'm glad I don't work there anymore :)
The HPIC (Head Pajeet In Charge) here at my company has mandated the same thing. We are supposed to get access to some Microsoft tool ("OneDrive," I think it is?) to allow short-lived file sharing, since we cannot open up shares on our PCs due to lack of local admin rights. I cannot wait to try it!
I suspect this is not about security at all, but rather about forcing employees (and suppliers and customers) to use IBM's cloud services. If IBM made flash drives, I guarantee the policy would be exactly the opposite.
Support Right To Repair Legislation.
So you're saying carrying a USB drive is the same as carrying $40000 cash -- they can't track it!
This has been enforced policy where I work for more than a year. If I plug in a removable device alerts are generated, messages on my workstation pop up, and it doesn't work.
I haven't tried to get past this, since group polices on my work machine are mostly impenetrable. It's OK, we have s very good file sharing system to do the needful.
deleting the extra space after periods so i can stay relevant, yeah.
If it works, it isn't secure enough, and conversely it isn't secure until it doesn't work anymore.
Equilibrium is a barely working, barely secure organisation.
IBM's announcement is not out of the ordinary. Years ago (late 90s/early 2000s) I worked for a company that offered an automated hardware/software inventory solution for PCs. When we sold to Goldman Sachs we were surprised to discover that they had disabled all USB ports on their PCs so as to prevent removable storage devices from being attached to any machine. They used PS/2 mice and keyboards.
Pretty sure switching to Mac already accomplished this for them.
https://www.cio.com/article/31...
Maybe there's a dongle for that?
And no tape backups. Can't have those travelling off site!!!
...that your silly "encryption" will be effective.
I'm not allowed USB drives at work. If I plug one in, it's blocked.
If I really need one to do my job, I get given an encrypted usb drive that requires a pin code.
The news here should be IBM is late to the party and has been lax about information security.
I worked for a company that disabled the USB ports in all computers _after_ multiple instances of their employees downloading their customer lists and starting their own competing companies.
I've abandoned my search for truth; now I'm just looking for some useful delusions.
How will they be able to do the needfuls if they R having one doubt and wish 2 revert the same?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
All this nitpicking about device transfer and no one raised the important question:
What does IBM have to lose in reputation and financial standing at this point?
except for a few vanity projects like Big Blue. They're mostly a consultancy company now (and most of that is Indians). They everybody in the states who wasn't a salesperson back in the mid 2000s. It made /. when they announced it. End of an era and all that rot.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
this is meant to stop morons who find a USB drive in the parking lot and plug it into their work computer. And yes, there have been several data breaches traced back to this rather lame method...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
USB, and other external storaqge media, have long been recognized as security risks. This may not be a cure-all, but it is a needed 1st step
There have been suggestions of obscure FTP sites, sharepoints (whatever that is), etc. but they all require both sender and recipient creating new "accounts" (like we don't have enough usernames and passwords to keep track of already), and probably haven't been maintained for years. Also some of our projects, while not secret, are for customers who are working on top secret projects, and are export restricted. My understanding is we shouldn't put anything regarding those projects on the network (company or Internet) because we have to assume servers, data centers, etc. have been outsourced. It's far better to just use USB memory sticks, if we can get away with it.
There are annoying procedures to request temporary exemptions to the USB policy. I think my boss has managed to get our whole department an indefinite exemption (yay!).
I used to work for VBC(commercial electronics). There, it was known that all our computers had tons of corporate spyware which among other things would alert our boss about access to USB memory sticks. We did it all the time though, damn the consequences, especially when dealing with lab test equipment. Much of that lab equipment ran Windows XP or Windows 2000, and their ethernet ports were often physically plugged due to {donotfix} security holes, leaving USB memory sticks as the only way to get data off.
{getoffmylawn}I'm still shocked at most test equipment running Windows.{/getoffmylawn}
Lots of apps and some phones have this built in..
I think I might have heard of them in a history elective.
Did they get started by Franklin or Edison?
An innovative thing here might be writing a good eulogy for that sad, pathetic company.