Metromont Increases User Awareness of USB Security Risks

A USB security solution is essential for meeting a critical security control required by various cybersecurity insurance providers and cybersecurity compliance frameworks—Preventing users from inserting unauthorized removable media devices into company computers.

The importance of USB security came to the forefront for Metromont when they had an external security company perform a highly targeted USB drop attack on their employees.

In the attack, security researchers posing as potential threats used information gleaned from social media to target employees with seemingly harmless thumb drives.

Alarmingly, some of the employees plugged these drives into their work computers—A situation that otherwise could unknowingly grant threat actors access to sensitive information!

While a written removable media policy is important for communicating security responsibilities to staff, it must be combined with technical security measures to be effective.

Unfortunately, Metromont’s first USB security software vendor—ManageEngine Device Control Plus—failed to provide the support necessary to ensure their success with the platform.

Recognizing their need for a reliable security vendor, Metromont turned to CurrentWare’s data loss prevention solution, AccessPatrol, and the stellar support team that came with it. 

With the mission at hand, CurrentWare’s support team worked directly with the Metromont team to set up a proof-of-concept trial in their organization. Once deployed, blocking unauthorized portable storage devices was as easy as a few clicks.

Our cybersecurity insurance advised us on the importance of mitigating USB security risks, so we knew we needed to put a solution in place.

When our previous security software vendor wasn’t giving us the support we needed, we turned to CurrentWare; once we were ready to deploy, they were right there with us!

 

From there, Scottie and his team reiterated the importance of following their removable media policy by requiring all staff who need portable storage device access to submit requests to the IT department so they could be appropriately controlled as part of their cybersecurity insurance requirements.

Transitioning from ManageEngine to CurrentWare was a breeze. The CurrentWare support team set everything up perfectly, and the software is so user-friendly that I’m sure future IT employees will easily navigate it.

The ever-changing landscape of cyber threats demands constant vigilance. Employees are on the front lines of this battle, and ongoing security awareness training is critical.

By ensuring employees are aware of their security risks and responsibilities they’ll be better equipped to avoid falling victim to the latest phishing scams, malware, and other dangers.

To help emphasize removable media policies, AccessPatrol can optionally present a notification or dialogue box when USB devices are inserted into a managed computer.

The notification requires employees to acknowledge they will use authorized removable media devices according to the organization’s policies, providing a consistent reminder of their responsibilities. 

When discussing preventing employee data theft, the importance of preventing company data from leaving secure systems is often emphasized. However, data theft prevention is also the responsibility of the parties that would benefit from stolen data, such as in the case of corporate espionage.

It’s not uncommon for new hires to attempt to bring data from previous jobs, sometimes unintentionally.

By restricting and monitoring data transfers, Metromont prevents unwanted sensitive information from entering its secure systems. This protects them from legal issues arising from a breach of that data or the development of new business capabilities based on it.