cyberstrikeus Disable USB Storage
Description
USB storage provides a means to transfer and store files insuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment.
Note: An alternative solution to disabling the usb-storage module may be found in USBGuard. Use of USBGuard and construction of USB device policies should be done in alignment with site policy.
Rationale
Restricting USB access on the system will decrease the physical attack surface for a device and diminish the possible vectors to introduce malware.
Impact
None noted.
Audit Procedure
Command Line
# Run the following commands and verify the output is as indicated:
modprobe -n -v usb-storage
# install /bin/true
lsmod | grep usb-storage
# <No output>
Expected Result
install /bin/true
The lsmod command should return no output.
Remediation
Command Line
# Edit or create a file in the /etc/modprobe.d/ directory ending in .conf
# Example: vi /etc/modprobe.d/usb_storage.conf
# and add the following line:
install usb-storage /bin/true
# Run the following command to unload the usb-storage module:
rmmod usb-storage
Default Value
Not disabled by default.
References
- CIS Controls Version 7 - 8.4 Configure Anti-Malware Scanning of Removable Devices: Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected.
- CIS Controls Version 7 - 8.5 Configure Devices Not To Auto-run Content: Configure devices to not auto-run content from removable media.
Profile
Level 1 - Server / Level 2 - Workstation, Assessment: Automated