search menu icon-carat-right cmu-wordmark

Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders

Technical Note
In this report, the authors present methods for auditing USB device use in a Microsoft Windows environment.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2013-TN-003
DOI (Digital Object Identifier)
10.1184/R1/6574493.v1

Abstract

Universal serial bus (USB) storage devices are useful for transferring information within an organization; however, they are a common threat vector through which data exfiltration can occur. Despite this, many organizations permit the use of USB devices on their systems. Implementing controls to track the use of these devices is necessary if organizations wish to retain situational awareness and auditing capabilities during a data theft incident.

This report presents methods to audit USB device use within a Microsoft Windows environment. Using various tools-the Windows Task Scheduler, batch scripts, Trend Micro's OSSEC host-based intrusion-detection system (HIDS), and the Splunk log analysis engine-we explore means by which information technology (IT) professionals can centrally log and monitor USB device use on Microsoft Windows hosts within an organization. In addition, we discuss how the central collection of audit logs can aid in determining whether sensitive data may have been copied from a system by a malicious insider.

Cite This Technical Note

Silowash, G., & Lewellen, T. (2013, January 1). Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders. (Technical Note CMU/SEI-2013-TN-003). Retrieved April 13, 2024, from https://doi.org/10.1184/R1/6574493.v1.

@techreport{silowash_2013,
author={Silowash, George and Lewellen, Todd},
title={Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders},
month={Jan},
year={2013},
number={CMU/SEI-2013-TN-003},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6574493.v1},
note={Accessed: 2024-Apr-13}
}

Silowash, George, and Todd Lewellen. "Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders." (CMU/SEI-2013-TN-003). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, January 1, 2013. https://doi.org/10.1184/R1/6574493.v1.

G. Silowash, and T. Lewellen, "Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-2013-TN-003, 1-Jan-2013 [Online]. Available: https://doi.org/10.1184/R1/6574493.v1. [Accessed: 13-Apr-2024].

Silowash, George, and Todd Lewellen. "Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders." (Technical Note CMU/SEI-2013-TN-003). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Jan. 2013. https://doi.org/10.1184/R1/6574493.v1. Accessed 13 Apr. 2024.

Silowash, George; & Lewellen, Todd. Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders. CMU/SEI-2013-TN-003. Software Engineering Institute. 2013. https://doi.org/10.1184/R1/6574493.v1