DoD Preparing To Lift USB Ban

Via DarkReading.com -

The ban on USB drives that began late last year in the U.S. Defense Department will be lifted, but with a caveat: Only DoD-approved or procured devices will be allowed.

Robert Cary, CIO for the U.S. Navy, in a recent blog post said Defense officials are hashing out the final policy for allowing USBs back into the department. The Commander of the U.S. Strategic Command in November suspended the use of all USB flash and removable storage devices and camera flash cards from all DoD networks after a worm infection spread across some DoD networks.

"In the future, we expect that a government-owned and procured USB flash media that is uniquely and electronically identifiable for use in support of mission-essential functions on DoD networks will be permitted for use by authorized individuals," Cary said in his blog. "The bottom line is, the days of using personally owned flash media or using flash media collected at conferences or trade shows are long gone. What we connect to our home PCs is very different from what is and will be allowed to occur on DON [Department of Navy] networks."

The Navy is also reducing its reliance on USB flash media, Cary said. "...we are working on moving our access to information to the use of collaborative workspaces, file shares and portals within our protected enclaves. This will reduce our reliance on USB flash media, mitigate unnecessary risk to the GIG, and protect our data and information by keeping it stored within our network boundaries," he said.

Meanwhile, the DoD Removable Storage Media Tiger Team is coordinating a Defense USB policy that will be incorporated into USSTRATCOM guidelines, and the Navy and Marine Corps are working on their own organization-specific operational orders for when the ban is lifted.

Among other things, the Navy is upgrading its antivirus and malware detection, alerting, and remediation, Cary said, and improving controls that deny unauthorized USBs from the network.

Cary noted that although the DoD previously had policies in place for using USBs safely, "they were not being followed."

"Unfortunately, it was our bad IT hygiene that resulted in the ban of this all too flexible use of storage media," he said.