A machine vendor needs a USB drive with maintenance software to calibrate equipment connected to one of our workstations. We approved the drive after our security controls blocked it, then noticed folders for other customers.
Does that create a meaningful risk for our workstation or our data? What would be a practical way to handle future visits?
Yes, a drive used across sites is a possible path for malware between environments. Another customer being compromised doesn't mean this drive is infected, but wiping it between visits wouldn't address every route. The vendor's own laptop or tools could also be exposed.
I'd involve your security team and agree on a transfer process with the vendor before the next visit. Keep the equipment workstation separated from the rest of your network where practical, and review both the media and the software being approved. That protects in both directions, from the business network to the equipment and back.
A separate inspection machine can help. Keep it off the internal network, scan the drive and review the files needed for the job before transferring them through an approved process. Reimaging the inspection machine regularly is worth considering too.
A clean scan is not proof that the drive or software is safe. You'll also need a controlled way to update the inspection machine and its malware definitions, otherwise the scan gets less useful over time.
Ask the vendor whether the technician can use their own laptop to interface with the equipment, if the machine supports it. That avoids plugging their drive into your workstation, though the laptop connection still needs review. Read-only media could be another option for software that doesn't need to write back.
Folders for other customers aren't automatically evidence of a breach or bad intent. They could contain machine configurations the technician needs. The distinction is what data is there, how sensitive it is, and whether it needs to travel between sites.
I'd ask what the vendor keeps on the drive, whether it's encrypted, and how they prevent your configurations or other files from being exposed at another site. Encryption helps protect a lost drive, but it doesn't stop a workstation from accessing files while the drive is unlocked.
Answers are reviewed before publication.
k302!overhang:
Folder names alone don't tell you much about the contents. The useful question is what leaves your site and where else that data might be accessible.