search

ministryofjustice / itpolicycontent

Draft and review content for MoJ IT Policy.
10 stars 14 forks source link

USB Usage Guidance #92

Open ahmedrmoj opened 5 years ago

ahmedrmoj commented 5 years ago

(Some information on the use of USB's from a security viewpoint)

USB cables have two types of wiring: electrical charging wires and data wires. This is described in the following web page:

https://www.leadsdirect.co.uk/technical-library/pinouts-wiring-diagrams/usb-wiring/

Normal USB cables have all wires connected and are not therefore suitable for connecting personal USB devices to to MoJ systems.

Ideally people should have their own charging cables and transfers not plug into any MoJ systems, but the only exception of permitting personal USB devices to be attached should be if the data interface has been reliably isolated.

Unless the data interface on the USB device has been isolated from the MoJ system (2 possible hardware devices for doing this are listed below), it would not be appropriate to connect an personal USB device to any MoJ system as there are many ways in which malicious software on the personal USB device could present a threat to the MoJ system.

This guidance explains why it is not acceptable to connect personal USB devices to any MoJ systems using a normal cable which includes both the charging cables and the data interfaces.

warmanaMOJ commented 5 years ago

Nice summary of the guidance required!

ahmedrmoj commented 5 years ago

Once approved, I will add this under the 'Removable media' guidance section.

https://intranet.justice.gov.uk/guidance/security/it-computer-security/removable-media/