Cyber security threats: removable media

The idea

Removable media are storage devices that can be plugged in and taken out, such as USB flash drives, external hard drives, memory cards and optical discs. As a cyber security threat, they create risk in two directions. An infected device can introduce malware when connected to a trusted computer, and a device can be used to copy data out of an organisation, which is a data theft or insider threat. The risk grows because removable media are small, easy to lose and often bypass network security controls such as firewalls. Controls include disabling unused USB ports, scanning devices before use, encrypting removable drives, restricting who may connect them and training staff not to plug in unknown devices.

What earns the marks

• Identifies removable media as portable storage such as USB drives, external drives, memory cards or optical discs.
• Explains that an infected removable device can transfer malware to a computer when connected.
• Explains that removable media can be used to copy or steal data from a system.
• Recognises that removable media can bypass network security controls such as firewalls.
• Links controls to disabling ports, scanning devices, encryption, access restriction and staff training.

Common mistakes and how to put them right

• Treating removable media as a type of network connection.

  Put it right: It is physical portable storage, though it can carry malware.

• Assuming firewalls stop this threat.

  Put it right: A device plugged directly into a machine may avoid network filtering.

• Overlooking the data-theft direction.

  Put it right: Note that removable media can also be used to remove data, not only to introduce malware.

• Confusing removable media with cloud storage.

  Put it right: Cloud storage is accessed over a network, whereas removable media are physical devices.

Exam tips

• Look for physical portable storage wording such as USB drive or memory card in the options.
• Check whether the scenario describes malware coming in or data going out, as both fit removable media.
• Reject options about email attachments or network traffic, which are different threat routes.