Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IBM bans USB, SD cards, flash drives and portable devices from every office

theregister.co.uk

Post reply on HN
Print view View original

31–40 of 202 posts

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#31

Post by ghaff »

rtkwe wrote: post #15
awakeasleep wrote: post #6

Within a business, security has to be understood in the context of risk analysis. Will the measures taken damage the company more than the benefit of the increased security? In my eyes, banning storage media without a practical replacement is on the wrong side of the risk analysis equation. Sure, it's not desirable that files can be moved without full access control and auditing, but if people don't have a tool that…

With the rise of VPNs, fast home internet, and fairly ubiquitous public wifi along with laptops gaining enough power for most applications the question is what's the real use case that requires removable media that can't be accomplished with an internal FTP/network drive/email and using company laptops?

>"fairly ubiquitous"

If I'm giving a presentation to hundreds or thousands of people in 30 minutes and a laptop goes down/won't connect to projector, presentation wasn't loaded or was corrupted on the speaker laptop, things go sideways in a bunch of other ways (and they do), I don't want to be in the position of depending on the network to pull down a presentation from somewhere. Especially if I don't have my own laptop with me as is at least sometimes the case.

There should be various other ways to get to a presentation and I even have a setup to present from my iPhone (which I've actually had to use as a fallback), but a USB stick is a good, simple backup that I've used more than once.

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#32

Post by jay-anderson »

xbryanx wrote: post #26
genericone wrote: post #17

This is common at many semiconductor companies. Not only is it a ban at one specific semiconductor oem I know of, the usb-ports are disabled and the usb-ports on new issue computers are epoxied to prevent trying to use them. Semiconductor technology is one of the areas of global-technological competition which surely benefit from secrecy. For example, several years ago one of the c-level executives at this specific O…

How do you connect a keyboard or mouse?

https://en.wikipedia.org/wiki/PS/2_port

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#33

Post by genericone »

xbryanx wrote: post #26
genericone wrote: post #17

This is common at many semiconductor companies. Not only is it a ban at one specific semiconductor oem I know of, the usb-ports are disabled and the usb-ports on new issue computers are epoxied to prevent trying to use them. Semiconductor technology is one of the areas of global-technological competition which surely benefit from secrecy. For example, several years ago one of the c-level executives at this specific O…

How do you connect a keyboard or mouse?

To be fair, they are not completely locked down like I may have made it sound.

The usb port restriction is absolutely true for laptops, but colo desktops probably do not have this restriction, or just a more lax restriction. Also, its not true for all laptops of the company, but usb access does require explicit permissions and a new-issue laptop, so they do have a list of people who have riskier laptops, and may need to be issued a different travel laptop vs engineering laptop.

The laptop's epoxied ports likely prevent distracted traveling workers from having their laptops hacked with usb-keys inserted when they aren't looking.

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#34

Post by stefan_ »

mc32 wrote: post #19

Don’t FB and Goog already do this in practice if not completely enforced (i.e. epoxying the connectors). What’s the news about this?

Since USB is how you debug on Android and even flash the software, that doesn't ring true. If the Uber case is any indication, they instead give you all the freedom but essentially rootkit the system and keep very comprehensive logs and access controls.

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#35

Post by Lev1a »

Ftuuky wrote: post #27
mc32 wrote: post #19

Don’t FB and Goog already do this in practice if not completely enforced (i.e. epoxying the connectors). What’s the news about this?

This is also something very common in banking.

And hospitals (not the glueing part, but the blocking of anything that's recognized as a USB storage medium).

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#36

Post by dogma1138 »

xbryanx wrote: post #26
genericone wrote: post #17

This is common at many semiconductor companies. Not only is it a ban at one specific semiconductor oem I know of, the usb-ports are disabled and the usb-ports on new issue computers are epoxied to prevent trying to use them. Semiconductor technology is one of the areas of global-technological competition which surely benefit from secrecy. For example, several years ago one of the c-level executives at this specific O…

How do you connect a keyboard or mouse?

An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence.

The keyboard and mouse were connected to a dock.

On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail.

The idea behind these like most other security controls is to prevent accidental leakage and to make it difficult enough that intentional leakage would likely be detecte on time.

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#37

Post by Lev1a »

rasz wrote: post #28

How will they work with no phones?

There's no reference to them intending to ban phones in the article, at least not that I could find.

The "portable devices" in the actual body of the article is phrased differently from the title, like so:

    portable storage devices like a USB, SD card, or flash drive

Re: IBM bans USB, SD cards, flash drives and portable devices from every office

#40

Post by mseebach »

dogma1138 wrote: post #36
xbryanx wrote: post #26

Earlier quoted context omitted.

How do you connect a keyboard or mouse?

An implementation I’ve seen had all ports locked down on the laptop itself and physically locked with a plastic plug that can’t be removed without leaving evidence. The keyboard and mouse were connected to a dock. On the OS level only HID devices were allowed via USB you could bypass this if you had admin rights but it would leave a trail. The idea behind these like most other security controls is to prevent accident…

> you could bypass this if you had admin rights but it would leave a trail

A move I've seen being put in place at several locations, is removing local admin rights from all users. Those with advanced needs, like developers, gets a VM which is limited to a specific VLAN, with no access to the production environments.

The principle is sound, implementation is ... difficult, to say the least.

Post reply on HN