I'm looking for practical ways to manage removable USB storage in a business environment. We block USB storage through Intune on roughly 95% of our devices, but one part of the business needs to transfer diagnostic data from vehicles and aircraft and provide it to customers. Personal devices cannot access our Microsoft 365 services, so using someone's home computer is not a workable alternative.
At the moment, about five approved USB drives are whitelisted by serial number. They are controlled and checked in and out, but I'm still concerned that someone could take one off-site, copy infected or unauthorized data onto it, and then reconnect it to a corporate device. I'd like to find a reliable way to sanitize or scan the drives after use, although that introduces the challenge of ensuring the process actually happens.
Ideally, I would block USB storage entirely, but the business requirement makes that difficult. How do you balance this kind of operational need with the security risks?
5 Answers
If the business must permit the drives, get the risk formally accepted by the appropriate security or executive owner. IT can recommend controls and implement the technical restrictions, but management has to decide whether the operational need justifies the remaining risk. Documenting the purpose, ownership, review period, and response procedure makes that decision much clearer.
Some environments allow removable media only through a tightly controlled approval process. Endpoint protection can scan the media and monitor copying, but scanning should be treated as an additional layer rather than a guarantee. The long-term goal should be replacing USB transfers with a secure upload or vendor exchange process, while the current exception remains limited and monitored.
The safest approach is to block removable storage by default and make exceptions very specific, documented, and temporary. Approved drives should be company-owned, encrypted where the receiving equipment supports it, tracked by serial number, checked in and out, and removed from the allow list immediately if they go missing. Regular audits and manager approval help keep the exception from becoming permanent access for everyone.
There is no perfect technical control once a removable drive is allowed to move between unknown systems. A good process is to issue rugged, visibly numbered drives, keep them under stores or IT control, record who takes each one, limit their use to the approved purpose, and review the exception regularly. Users should also be trained not to connect the drives to personal or third-party computers.
For unavoidable transfers, use a dedicated workstation or isolated transfer station rather than allowing the drives on ordinary endpoints. Put it on a restricted network segment with no unnecessary access to internal systems, scan the media before copying anything, transfer only the required files, and reformat the drive afterward. If the vehicle equipment cannot read encrypted media, that limitation needs to be documented as an accepted risk.
That’s the main concern: the drives are already checked in and out, but that doesn’t prevent someone from using one on an infected third-party system before returning it. A dedicated transfer station and formal risk acceptance may be the most realistic combination for us.