Removable media (USB): what it is and how it is attacked
Anything that carries data by being physically moved from one machine to another.
Also known as
- USB
- USB stick
- memory stick
- flash drive
- external drive
- SD card
- optical disc
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It is the crossing that survives every network control, which is why it matters most on exactly the diagrams that claim to have no crossings. It is also how data leaves without touching a firewall.
How it gets attacked, and what reduces it
How it gets attacked
- Carried in and plugged in, which needs no network path and no flaw
- Left in a car park or posted, on the reasonable assumption somebody will connect it
- Used to take data out, where no outbound rule applies
What reduces it
- Decide by policy which machines accept it at all, and enforce that on the machine rather than in a document
- Scan on an ingest host that is not the destination, so a hostile file meets something before it meets the target
- Log what was copied and by whom; without that an investigation has no starting point
Where it sits
- Group
- Endpoints and devices · The things people and processes touch directly.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- removable-media
Reviewed . CC BY 4.0.
Others in endpoints and devices
- Desktop computerworkstation · PC · desktopA computer somebody sits at to do their job.
- Laptopnotebook · mobile workstationA portable computer that leaves the building.
- Mobile phonesmartphone · mobile · handsetA pocket computer that reads company email.
- PrinterMFP · multifunction device · copierPrints, scans and often emails documents.
- Smart deviceIoT · internet of things · connected device · camera · CCTV · IP camera · security camera · sensor · door lock · smart TVEveryday equipment with a network connection: cameras, sensors, door locks, TVs.
- Plant equipmentOT · ICS · SCADA · operational technologyMachinery that runs a physical process: a pump, a valve, a production line.
- Machine controllerPLC · RTU · programmable logic controllerThe small computer that tells a piece of machinery what to do.
- Door access readercard reader · badge reader · access controlReads a badge to unlock a door.
The endpoints and devices group lists all 9 of them side by side.
Removable media on your own diagram
Open the editor, press N, and type USB. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker