Why do companies block writes to USB devices but allow reads?

[AviatorTom]

Several companies now require special permissions for an employee's company-provided computer to write to a USB device (disk drive, CD/DVD, memory stick/thumb drive) but allow the computer to read from those USB devices. Companies claim that writing to the USB is a risk.

From a security view, reading a USB can be risky because it could contain viruses or malware. Plus, since the company doesn't allow writes to USB, any reads from USB would be from a "foreign" device (outside the company's control), which increases the risk of it containing harmful data and/or software.

Using USB devices to transfer data between computers, and to backup data for safe-keeping is, and always has been, an efficient use of USB devices, but company policies now make that impossible... which forces people to find other "workaround" ways to do that, some of them pretty risky.

Can anyone explain the rationale behind companies establishing security policies that allow USB reads but not writes?

Any corporate IT people or cyber-security experts out there?

[jshm2]

They don't

Usually it's down to the system admin not setting the USB policy correctly that you get a "read, but no write" access. The proper policy in SharePoint and Azure is to block all unauthorised USB storage peripherals to all but authorised user accounts.

For any user wanting USB access they need to make a business case to get access. The device (s) will need to be registered on the account

In old Windows Server 2002 and older systems you will still come across dodgy policy settings which let users escalate privileges.

[OlderAndWiser]

Locking the doors on your house when you leave doesn't guarantee that criminals won't break in while you are gone, but you don't leave the doors unlocked because locked doors will stop SOME criminals.

[AviatorTom]

I agree that locking doors will stop some criminals. But if I'm having a plumber and electrician come to my housie and do work for me, I make sure they can get in.

[TroyDT2]

Trying to stop corporate espionage. Some companies go to great lengths in this area, and it makes sense. If you can find out what the competitors are bidding, you can easily underbid. If you know what they're paying key people, you might be able to hire them away by paying more, but less than you would have without that info. And of course seeing the planning, etc. would give a huge advantage.

[AviatorTom]

That may be the rationale, but there are holes in that. First, it requires that the employee be able to get access to the confidential information, and there are internal policies (access control lists, for example) to limit that. But if someone can get access to the data, they can just display it on their screen and snap a picture... no need to write to a USB to get the data.

[qwert1234]

Writing = chance of copying company materials, which is proprietary. It can be sold to a competitor or made public. Some may implicate the company; some may see a weakness and use that to bring companies down.

Reading = viruses can be isolated.

Also -

With the advent of cloud - most companies also block reading. There is really no more point on having a usb storage/external storage if things are on the cloud, secure.

[exitseven]

They do not want people to download data that is either on the computer hard drive or a local network drive.

[Adaeva]

I have no idea what you are talking about. I have never had a USB drive that I couldn't read and write too.

[AviatorTom]

You don't work for a company. Many companies are configuring their employees' computers to require admin rights to write to a USB, and then restrict admin rights to only some employees. So, for example, I am a typical employee with a company-provided laptop, and I cannot use that laptop to write to a USB... the software won't let me.

[Adaeva]

I didn't know that was possible if you actually have the computer and not just a terminal connected to a computer. If the employees actually have a computer, the company can just tell them not to copy to a flash drive. Otherwise, the software is near worthless because you can boot from a CD, or DVD or a flash drive and then copy whatever files you choose.

[AimeeKyle]

It’s usually done to try to prevent theft of intellectual property.