Blocking USB storage with Intune: when an SME should lock down sticks and drives

Why USB storage is still an open door

Most SMEs have sorted out a lot in recent years: multifactor authentication, encrypted laptops, files in OneDrive and SharePoint. The USB port is often the one part still as open as it was in 2010. Anyone who plugs in a stick can take a full customer folder, the payroll records or an export from the customer relationship management system in a few seconds.

Usually that happens without any bad intent. An employee copies a presentation to a stick for a client, takes work home, or picks up a stick from a supplier at a trade fair. That stick gets lost on the train, or it brings malicious software with it. Either way, you cannot tell afterwards which data ended up where.

What you gain

A clear rule for USB storage improves three things. Company data stays in places you manage and can recover, such as OneDrive, SharePoint and Teams. A lost stick is no longer a reportable data breach, because there was no unencrypted copy on it. And when customers, insurers or your supply chain ask questions, for example around NIS2, you can show exactly how you handle removable media.

The biggest misunderstanding: “then my mouse will stop working.” It will not. The block targets storage devices. Keyboards, mice, headsets, webcams, printers and docking stations keep working as normal.

Three levels: block, read-only or approved sticks

You do not have to choose between all or nothing. In Microsoft Intune there are roughly three options:

• block completely: laptops no longer read or write anything on removable storage; suitable for finance, inside sales and most office roles;
• read-only: employees can open files from a stick but cannot write anything to it; useful when customers or suppliers still deliver on sticks;
• approved or encrypted sticks only: writing is only allowed to sticks encrypted with BitLocker To Go, or to specific devices you put on a list in advance; for technicians, field engineers or marketing who genuinely work with external media.

With Microsoft Defender for Business, part of Microsoft 365 Business Premium, you can set device control even more precisely: per group of employees, per type of device and with a log of what was attempted.

What to sort out this month

Keep the first step small enough to actually carry out:

• set USB storage to measure instead of block first, so you see for two to four weeks who uses which sticks and drives;
• discuss the results per department: what can go through OneDrive, SharePoint or a shared Teams folder, and what genuinely cannot;
• decide the level per group: block, read-only or approved, encrypted sticks only;
• provide an alternative before you block, for example a secure sharing link for customers instead of a stick;
• agree an exception route: who requests, who approves, and for how long it applies.

What not to do on day one: switch on the block for the whole company on a Friday afternoon without employees knowing why or what the alternative is. Announce it, explain why, and start with a pilot group.

How this fits with local admin rights and device compliance

A USB policy only works if employees cannot get around it themselves. That is why it belongs with removing local administrator rights: anyone who is administrator on their own laptop can undo settings. Also include the policy in device compliance, so only laptops that meet the agreements can reach company data.

Technology is only half of it. Security awareness training should also cover the unknown stick lying in the car park: do not plug it in, hand it in.

How Floor ICT rolls this out — and what you decide

Floor ICT first prepares a measuring policy in Microsoft Intune, discusses with you what is being used, and then sets the right level per group. Where sticks remain necessary, we set up BitLocker To Go or a list of approved devices. Exceptions go through the ticket portal, so there is a record of who is allowed what and until when.

You decide which roles get exceptions, whether customers may still deliver on sticks, and how employees hear the news. Technology without explanation leads to frustration; explanation without technology stays an intention.