USB drives and removable media: risks and sensible rules for the office

Why a small plastic stick is a big deal

The obvious risk is loss. A USB drive with a client list, payroll export or scanned passport on it fits in a pocket and slips out of one just as easily. If it is not encrypted, whoever picks it up has the data. Under the Privacy Act 2020, losing personal information in that way can be a notifiable breach if serious harm is likely, which means telling the Privacy Commissioner and the people affected.

The second risk is malware. Drives passed between home computers, print shops, conference stands and client offices pick up infections. Some attacks rely on curiosity: a drive left in a car park with a tempting label. Others hide inside devices that look harmless, such as cheap promotional sticks or charging cables that act as keyboards when plugged in. Security testers have shown repeatedly that a fair share of people will plug in a drive they find, which is why awareness on its own is not enough.

The quiet data leak

Even honest staff move data in ways the business never sees. Someone copies a project folder to finish at home. A departing salesperson takes the customer spreadsheet on their last afternoon. A contractor plugs in a drive to back up their own work and copies more than they should. Without controls, none of this leaves a trace that you would ever notice.

Cloud tools have removed most legitimate reasons for USB transfers. OneDrive, SharePoint and Teams let people work from anywhere and share files with clients through links that can be set to expire, with a record of who opened what. That is better for the business and simpler for staff. Links can be revoked if they are sent to the wrong person, which is impossible once a drive has left the building.

Options for controlling removable media

Windows and macOS can both be configured, through Intune or Group Policy, to block USB storage entirely, allow read-only access, or allow only specific approved devices identified by their hardware ID. Most EDR products also include device control, with logging of every drive that is plugged in and every file copied to one.

A practical default is to block writing to removable storage for everyone, allow reading where needed for things like camera cards, and keep a short list of company-issued encrypted drives that can be written to. Keyboards, mice, headsets and phones charging over USB are unaffected, because the rules target storage devices specifically.

When you do need USB drives

Some businesses genuinely rely on removable media: photographers, surveyors moving large survey files, engineers handing over drawings on site, or medical practices exchanging imaging. In those cases, issue hardware-encrypted drives with a PIN pad or use BitLocker To Go, which encrypts a standard drive with a password, and allow only those drives through device control.

Keep a simple register of which drives exist, who has them and roughly what they are used for. When a drive is retired, wipe it securely or destroy it. A drawer of old sticks with unknown contents is a breach waiting to happen. Old external hard drives used for backups years ago are a common find during office moves, and they often hold complete copies of the business's files.

What to tell staff

Explain the rule and the reason in a sentence or two: drives get lost and spread malware, so we use OneDrive links instead. Tell people never to plug in a drive they found or were given by someone they do not know, and to bring it to IT instead. Give them an easy way to request an exception for genuine needs, so nobody is tempted to email files to a personal account as a workaround. Make the policy part of onboarding, and include a line about removable media in your acceptable use policy. When someone leaves, their exit checklist should include returning any company drives.

Bringing it in without disruption

Before switching to block mode, run device control in audit mode for a few weeks. The logs show which drives are actually used, by whom and for what, so you can approve legitimate cases in advance rather than discovering them when someone cannot do their job. Then announce a date, turn on blocking and handle the few remaining requests as they arrive. Most offices find that USB use drops to a handful of people within a month, and that nobody misses it. The result is fewer infection routes and a clearer picture of where your data lives.