3.3USB drives & removable media
The essentials in 30 seconds
- Unknown drive = suspect parcel: never plug it in, hand it to IT for isolated analysis.
- Inbound and outbound: every received drive is scanned before opening; all sensitive data leaving is encrypted.
- Prefer the cloud link: the drive gets lost, the controlled link is revoked and leaves a trace.
Running mini-case — Karim and the car-park drive
Karim, an office employee in Algiers, finds an unnamed USB drive in the office car park. Curious, he is about to plug it in to identify the owner — then applies the rule: an unknown drive is never plugged in. He hands it to IT, which will analyse it in an isolated environment, and shares the expected document via the corporate cloud link. No malware in, no data out.
This same case returns in the lesson, the diagram, the script and the 48h challenge.
1. A found drive is not a gift
A found USB drive is never a gift: it is the classic abandoned-drive attack — infected drives left in a car park, some of which get plugged in out of curiosity. The drive can auto-run or emulate a keyboard and compromise the workstation as soon as it is plugged in.
Absolute rule: a drive of unknown origin is never plugged in; hand it to IT, which can analyse it in an isolated environment.
2. Scan, encrypt, prefer the cloud
Scan every received drive before opening anything (right-click → scan with antivirus); encrypt drives carrying sensitive data. A drive is easily lost: encrypted, it is a lost object; in cleartext, it is a data leak.
Prefer sharing via the corporate cloud: the controlled link leaves a trace, applies antivirus and can be revoked — the drive just gets lost. And simple deletion erases nothing: full format at minimum before giving away a drive.
🔎 Concrete example — USB discipline in 4 rules
Karim neutralizes the vector, both ways.
1) Found drive → NEVER plugged in, handed to IT.
2) Received drive → scanned (antivirus) before opening.
3) Sensitive data → encrypted drive.
4) Sharing → cloud link rather than drive.Reading: no malware in, no data out.
Lesson: an unknown drive is a suspect parcel.
Section vocabulary
- Trapped USB drive
- Drive containing auto-running malware or trapped files: the found drive is a classic vector.
Simple example: Karim's car-park drive, potentially trapped.
What it is not: a new drive of known, verified origin.
Reflex: every unknown drive = handed to IT, never plugged in.
- Abandoned-drive attack
- Dropping infected drives so they get plugged in out of curiosity.
Simple example: Drives scattered in a corporate car park.
What it is not: an agreed exchange via a validated channel.
Reflex: resist curiosity: do not plug in.
- Removable media
- USB drives, external disks, SD cards: same rules of provenance, scanning and encryption.
Simple example: Karim's external backup drive.
What it is not: the workstation's internal disk.
Reflex: apply the 4 rules to every medium.
- Encrypted drive
- Drive protected by password/encryption: loss no longer becomes a leak.
Simple example: A password-encrypted transport drive.
What it is not: a cleartext drive with sensitive data.
Reflex: encrypt before copying sensitive data onto it.
- Cloud-link sharing
- Sharing via the corporate cloud: trace, antivirus, revocation — replaces the drive in most cases.
Simple example: Karim sends a controlled link instead of the drive.
What it is not: an unencrypted drive handed to a courier.
Reflex: link rather than drive whenever possible.
In practice — USB discipline in 4 rules
- Rule 1: a found drive is NEVER plugged in — hand it to IT (which can analyse it in an isolated environment).
- Rule 2: scan every received drive (right-click → scan with antivirus) before opening anything.
- Rule 3: encrypt drives carrying sensitive data (BitLocker To Go on Windows Pro: right-click → Turn on BitLocker).
- Rule 4: prefer validated channels (corporate cloud links) to drives for sharing — drives get lost, links are revoked.
Ready-to-say script — hand a found drive to IT (20 s)
“I found this USB drive in the car park, I did not plug it in. I am handing it to you for analysis — and for the document to share, I will send a corporate cloud link instead.”
Say to IT without plugging in the drive, even “just to look”.
Copy-paste template — USB checklist
FOUND DRIVE (plugged in? no / handed to IT? yes): _______________
RECEIVED DRIVE (scanned before opening? yes/no): _______________
SENSITIVE DATA (drive encrypted? yes/no): _______________
SHARING (cloud link rather than drive? yes/no): _______________Micro-business / freelancer
Without IT: never plug in the unknown, scan each received drive, encrypt every sensitive drive.
SME Algeria
Karim centralizes encrypted corporate drives and bans personal drives for business sharing.
Office / employee
If the workstation blocks USB, do not bypass it: use validated channels and request an exception if needed.
Beginner
This week: scan one received drive before opening and send one cloud link instead of a drive.
✓ Best practices
- Hand every unknown drive to IT, never plug it in.
- Encrypt drives carrying sensitive data.
- Prefer a controlled cloud link to a drive for sharing.
✗ Common pitfalls
- Plugging in a found drive “out of curiosity”.
- Carrying sensitive data on an unencrypted drive.
- Believing simple deletion really wipes a drive.
Key takeaways
- An unknown USB drive is a suspect parcel: do not plug it in, hand it to IT.
- Every incoming drive is scanned; every outgoing sensitive data is encrypted.
- A USB drive is easily lost: encrypted, it is a lost object; in cleartext, it is a data leak.
- Sharing via a controlled cloud link advantageously replaces the drive in most cases.
48h challenge — apply tomorrow
Replace 1 drive-based exchange with a corporate cloud link, and scan 1 medium before opening.
- I know what to do with a found drive.
- I know how to scan before opening.
- I shared once via link rather than drive.
Frequently asked questions
The corporate workstation blocks USB drives: why so strict?
Because the vector is real both ways (malware in, uncontrolled data out): many organizations restrict USB by policy. Legitimate needs go through validated channels.
How do I really wipe a drive before giving it away?
Simple deletion destroys nothing: use full format (not quick), or better, encrypt the whole drive before formatting. For highly sensitive data, physical destruction remains the reference.
Karim finds a USB drive in the car park. What to do?