Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

End of Bibblio RCM includes -->
5/14/2018
08:05 AM
Scott Ferguson
Scott Ferguson
News Analysis-Security Now

IBM's USB Ban Earns Some Praise, Some Skepticism

In a bold move that has security experts talking, IBM is reportedly looking to ban USB drives, as well as other portable storage devices, for its employees.

IBM is looking to create a more secure internal environment by reportedly banning all USB drives, as well as other portable storage devices, for its employees. The company is, instead, encouraging workers to use the company's cloud-based file and data sharing service to move data around internally.

The decision, first reported by The Register, is a bold move for IBM as the company looks to lock down its internal security at a time of heightened awareness around insider threats and the damage careless employees can cause. (See Insider Threats Cost Enterprises More Than $8M Every Year Report.)

Even IBM notes that the decision, which was made by Shamla Naidoo, the company's CISO, is bound to be disruptive for some employees as it rolls out company-wide over the next several weeks after being tried out in certain divisions first, according to the report.

Big. Blue. USB-Free\r\n(Source: IBM)\r\n
Big. Blue. USB-Free
\r\n(Source: IBM)\r\n

IBM itself is not confirming the specifics of the report, only that the company does review its internal security policies on a regular basis.

"We regularly review and enhance our security standards and practices to protect both IBM and our clients in an increasingly complex threat environment," a company spokesman wrote in an email to Security Now.

When a company as big as IBM makes an internal security shift, it will be noticed, and copied, by other companies. IBM's move reminds companies that the weakest link in the security chain could be the person in the next cubicle, whether or not he or she has malicious intent. (See Cybercriminals Increasingly Targeting 'Crown Jewels' Both Inside & Out.)

The havoc a small device such as a USB stick, SD card or flash drive can cause is not lost on other security watchers.

"Frankly, I find it funny that they still hand these out at security tradeshows," Mukul Kumar, the CISO and vice president of Cyber Practice at Santa Clara, Calif.-based Cavirin, wrote in an email. "IBM's move is a step in the right direction in that external USBs have, over time, been a major vector for malware."

Kumar notes that even if some exceptions are made, it's a step in the right direction, but banning certain devices is not enough. He writes:

However, the proof will be in how they "sign" these drives to be readable. Their move is part of a broader approach to security-in-depth to protect the overall cyber posture of an organization. This includes perimeter, network, OS, application, and data, spanning both hardware and software.

Nathan Wenzler, the chief security strategist at AsTech, a San Francisco-based security consulting company, noted that the banning of USB and other devices is a significant security change since these tools are a legitimate concern for CISOs.

However, is it worth adjusting an entire company culture?

"We've simply gotten used to having these easy tools around, and to now ban them out of a concern for security is going to be incredibly difficult to accomplish, as you're not just turning on new technical security controls, but you're now trying to change the culture of how people have operated for a very long time," Wenzler wrote in an email. "Ultimately, this sort of culture shift may not be worth the kind of ban IBM is putting in place in lieu of other security controls that could protect their intellectual property, critical data and corporate reputation without upending the way people are used to conducting business."


The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual Big Communications Event. There's still time to register and communications service providers get in free!

Wenzler went on to add that the cloud-based system that IBM wants employees to use brings its own share of security concerns:

Not to mention that the online file sharing tools that are being provided as an alternative come with a whole bevy of technical challenges that employees are already bringing up (i.e., "What do I do for a system that isn't connected to a network?").

However, Boris Vaynberg, CEO and co-founder of Solebit, an Israeli security firm, wrote that IBM is addressing a major concern for companies of any size: the endpoint -- a major weakness no matter how sophisticated the internal security of company is.

"The endpoint is the last layer of defense, and once you allow the ability to connect removable storage that may contain malware, you are skipping, by definition, any other security measures that you have on your network," Vaynberg wrote. "Today, organizations are investing a lot of efforts to deploy advanced network level security capabilities to do real prevention, all to avoid the heavy cost of the remediation process that usually takes place once the attack reaches the endpoint."

Related posts:

— Scott Ferguson is the managing editor of Light Reading and the editor of Security Now. Follow him on Twitter @sferguson_LR.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-35230
PUBLISHED: 2022-07-06
An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
CVE-2022-35229
PUBLISHED: 2022-07-06
An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
CVE-2021-23163
PUBLISHED: 2022-07-06
JFrog Artifactory prior to version 7.33.6 and 6.23.38, is vulnerable to CSRF ( Cross-Site Request Forgery) for specific endpoints. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.33.6 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions prior to 6...
CVE-2021-45721
PUBLISHED: 2022-07-06
JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting (XSS) through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to 7.29.8; JFrog Artifactory v...
CVE-2021-46687
PUBLISHED: 2022-07-06
JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Administrator REST API. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.31.10 versions prior to 7.x; JFrog Artifactory versions before 6.23.38 versions ...