Unknown USB Device Risks: How to Protect Your Business

Unknown USB device risks are easy to underestimate. A flash drive, cable or gadget looks harmless, yet one plugged into a work computer can install malware, copy files or type commands faster than anyone could notice. Firewalls and email filters can’t see a device someone carries in through the front door.

This guide explains how USB attacks work, what a real campaign looked like, and nine practical steps to keep removable devices from becoming your weakest point.

Why unknown USB device risks still matter

USB attacks sound old-fashioned, but they keep working because they rely on curiosity and trust rather than clever code. A drive labelled “Salaries” or “Redundancies” left in a car park, or a branded gift in the mail, invites someone to see what’s on it.

That’s exactly what happened in a campaign the FBI warned about in 2022. The FIN7 cybercrime group posted USB sticks to US businesses in transport, insurance and defence, disguised as packages from Amazon or a health department. When plugged in, each stick pretended to be a keyboard and typed commands that installed malware, which was later used to deploy ransomware.

Reduce unknown USB device risks in nine steps

Select a step to jump to the detail.

Policy and technical controls for unknown USB device risks

1. Set a clear removable media policy

First, start with a short, plain policy. It should say who may use USB storage, which devices are approved, what data can go on them, how found or lost devices are reported and how old drives are wiped or destroyed. ASD’s Information Security Manual recommends every organisation keep a media management policy along these lines.

Above all, keep it practical. A one-page policy that staff actually read during onboarding beats a long document nobody opens.

2. Block unknown USB storage by default

Device control tools let IT decide which USB devices a computer accepts. For example, Microsoft Defender for Endpoint and Intune can block all removable storage, allow only company-issued drives, or allow read-only access. In addition, each connection can be logged.

As a result, a drive found in the car park simply won’t open on a work laptop, so the decision no longer depends on one person resisting temptation.

3. Stop devices that pretend to be keyboards

Some malicious devices don’t store files at all. Instead, they tell the computer they’re a keyboard and type commands at machine speed, which ordinary storage blocking won’t catch. Modern endpoint detection and response can spot and stop this behaviour.

In addition, application control, one of the Essential Eight strategies, stops unapproved programs from running even if a command tries to download them. Locking screens whenever staff step away also limits what a plugged-in device can do.

4. Turn off AutoPlay and keep systems patched

AutoPlay and AutoRun open content automatically when media is inserted. Windows no longer runs programs from USB drives automatically by default, but AutoPlay prompts still encourage people to click. Therefore, turn them off through group policy or device management.

Meanwhile, keep operating systems, browsers, Office and security tools up to date. Much USB-borne malware relies on known weaknesses that patches have already fixed.

5. Encrypt every approved drive

So if your business does use USB storage, encrypt it. ASD’s guidelines say data on media should be encrypted, and tools such as BitLocker To Go make this straightforward on Windows. Then a lost drive is an inconvenience rather than a data breach.

Likewise, keep personal and business drives separate. A personal stick that’s been used on a home or school computer has no place in a work laptop.

6. Give staff a better way to share files

People reach for a USB stick because it’s quick. So make the secure option quicker. OneDrive, SharePoint and other managed file sharing let staff move files between devices and send them to clients without anything physical changing hands.

Once secure sharing is the easy path, USB use drops on its own, and so do the unknown USB device risks that come with it.

Limit the damage from unknown USB device risks

7. Limit administrator rights

Generally, malware runs with the permissions of the person logged in. If staff work without local administrator rights, a malicious device has far less room to install software, change settings or switch off protection. Restricting admin privileges is another of the Essential Eight strategies.

8. Log USB activity and keep backups

Ideally, IT should be able to see which devices were connected, by whom, when, and whether they were allowed or blocked. Those logs turn a vague worry into a quick investigation. In addition, keep regular, tested backups stored away from the main network, so you can recover if something does get through.

9. Train staff and make reporting easy

Technology can’t cover every case, so staff need a simple rule: don’t plug in anything you can’t vouch for, and hand found devices to IT. For instance, short, realistic examples work best, such as a drive in the car park, a gift from a trade show or a contractor asking to plug in.

Just as important, make it safe to own up. Someone who reports plugging in a strange drive straight away gives you a chance to contain it; someone who stays quiet doesn’t.

How CAG helps reduce unknown USB device risks

Our cyber security services include EDR with automatic containment and 24/7 monitoring, so suspicious behaviour from a plugged-in device is caught and isolated quickly. We set up and manage Microsoft 365, and our help desk handles found devices and suspected incidents for your team.

Behind that, cyber security audits and Essential Eight assessments check application control, admin rights and patching, and we help map your existing controls to ASD Essentials. Security awareness training then turns “don’t plug it in” into a habit. If an incident has already happened, our computer forensics team can preserve evidence and work out what the device did.