How do you try and prevent viruses from USB stick in your business?

How many people here are using software restriction policy gpo settings out of interest?

In my experience I've found it a very underused feature considering it's 'free' (well, if you're running windows) and does a nice enough job of things.
 
Last edited:
Ev0 said:
How many people here are using software restriction policy gpo settings out of interest?

In my experience I've found it a very underused feature considering it's 'free' (well, if you're running windows) and does a nice enough job of things.
Click to expand...

I do, along with GPO's with lists of blocked exe names. It's pretty darn hard to even get foreign executables onto the machines though, let alone run them.
 
As long as you have all the loop holes covered, if they are knowledgeable enough and can use the registry it's not so good.

First, don’t give the user of the computer local Administrative privileges. There are only a few instances when this is required, and even in these cases it can be avoided. If the user does not have administrative privileges, they won’t be able to control the computer at the level required to modify the Registry and bypass security
 
paradigm said:
I do, along with GPO's with lists of blocked exe names. It's pretty darn hard to even get foreign executables onto the machines though, let alone run them.
Click to expand...

So you run it in an 'allow all' way and put exceptions in to block, or is that as well as a default deny policy?

Sadly we can't just say no usb devices so have to mitigate the risk as much as possible.

But as said our biggest worry with them was data leakage, not too worried about stuff running on them as got that side covered.
 
Ev0 said:
So you run it in an 'allow all' way and put exceptions in to block, or is that as well as a default deny policy?

Sadly we can't just say no usb devices so have to mitigate the risk as much as possible.

But as said our biggest worry with them was data leakage, not too worried about stuff running on them as got that side covered.
Click to expand...

No, it's locked down to only allow %programfiles%, %programfiles(x68)%, %systemroot% (and subdirectories thereof), but due to some bespoke software we have, there are also allowed folders in the root of C:\, and in the user's profile (don't ask, I've kicked off about this so-called "special" software a million times). So as a result there are folders that even a standard user has priviledges to write to. This means I've had to have a custom list of blocked exe's using "User Configuration > Administrative Templates > System > Don't run specified Windows applications".

"Normal" users are already blocked from downloading executables, compressed files, and potentially unsafe extensions through Forefront TMG, they are also denied external storage access (be that USB stick or Optical Media). Finally, file screening policies are in place on the file and profile servers, blocking users from being able to save music, video, executable, and custome blocklists of files on their network drives, or their local profile (which is folder redirected to the profile server), however as with all users hell-bent on finding ways around security, a few of them seem to take it upon themselves to attempt to source and configure portable apps within the directories that contain previously mentioned "special" software.

It's a constant battle. There are known loopholes (known by myself, and myself only thus far), but as of yet they haven't proven to be a problem.
 
Lots of restrictions in my workplace, autorun disabled for starters. Then we use Sophos which is quite useful in the sense that we have 2 groups for usb access.

One group has absolutely no USB storage access. We are notified if someone tries.

Across departments, certain "trusted" users have usb access enabled. Again, we are notified via sophos's messaging system. So users needing usb access simply take their stick to one of their colleagues. Has worked fine as the trusted employees generally have a bit more nous when it comes to basic computer security.

Generally speaking, a department has a ratio of 1 USB enabled user : 10 non-enabled. Average dept is 40-60 users so there's always someone around.
 
Sophos now comes with (at an extra cost) device control however it isnt very granular.

We currently use an old version of GFI Endpoint security which is far more granular and works well, access is given by AD groups.
 
paradigm said:
stuff
Click to expand...

That's cool, was worried for a minute you weren't running a default deny :p

I try to use hash rules where ever possible as path rules can be easily manipulated, but for something that's basically free with the os it's a great little feature.
 
Autorun disabled, though people are allowed to use USB sticks, Forefront catches anything on them when they are inserted.

Works really well.
 
We tend to just disable the Auto-run. The best thing to do is to make sure you educate the users as to why its a bad thing to just plug them in.
 
CooK1E said:
We tend to just disable the Auto-run. The best thing to do is to make sure you educate the users as to why its a bad thing to just plug them in.
Click to expand...

You're having a laugh right?

Sure, educate them all you want, but my network is a secure environment thanks, and as such I don't want unmetered foreign file access..
 
paradigm said:
You're having a laugh right?

Sure, educate them all you want, but my network is a secure environment thanks, and as such I don't want unmetered foreign file access..
Click to expand...

We aren't able to enforce strict rules like this as a number of influential directors don't like the fact that we like to get rid of them totally. Its not a decision I agree with personally. Eductation isn't by any means the best way to avoid any issues, however something must be working as we've not had a virus in the 2 years I've been at the company.
 
CooK1E said:
We aren't able to enforce strict rules like this as a number of influential directors don't like the fact that we like to get rid of them totally.
Click to expand...

In that case I'd be seriously looking into extra controls to help things, but all depends on budget and willingness from them up on high to do something.
 
Sadly you need buy in to get a lot of things off the ground, if you don't have that then you're pretty limited usually :(

However in those cases you just need to show them the risks and what you can do to mitigate them.

If they don't really care and are willing to accept the risk then fair enough, it's their call.
 
We were trying to get Symantec Endpoint Protection to do it but it can't. Might have to resort to the GPO plus see what 3rd party products can do this for us.
 
There's no way we could disable USB Access, far too many people need to move files from Cameras, work they've done at home, their own laptops etc. Being a school I guess we've a slightly different requirement though.

Sophos is on all PCs, and we run with a majority of thin client/citrix access anyhow. All of our citrix servers are well protected, and the SAN offloads virus scanning to a small cluster of servers for all file share based access.

We did get hurt with conficker last year, but since then we've been managing things a little more closely, adjusted our patching policy from 'only if we need to' to 'when they're released'
 
You must log in or register to reply here.
Back
Top Bottom