USB and phishing: practical safeguards

Why are USB drives and spam security-policy risks?

Unknown USB media can introduce malicious files, while a fraudulent email can persuade an employee to reveal a password or send company data. The security policy must define approved devices, email safeguards, reporting channels, evidence preservation and escalation to IT.

Definition: The security policy must be enforceable

The security policy is not just a document on the intranet. It is a set of rules, configurations, responsibilities and evidence that tells the user what is allowed and allows IT to enforce it. If a company bans private flash drives, but workstations accept any media without logging or scanning, the policy does not work operationally.

Talk to Virtline about USB drives and spam as security-policy risks

If unmanaged USB media is still used for business files or impersonation messages reach employee inboxes, call +48 12 200 27 10. Bring the endpoint policy, device-control settings, mail platform and one recent incident. We will determine whether the first fix belongs in endpoint control, mail authentication, user procedure or monitoring.

USB media: malware, data loss and audit evidence

A USB drive is a risk when the company does not control the source of the medium, encryption, scanning or permissions to copy data. It can introduce a malicious file to a workstation or move data outside systems that provide retention, DLP, backup and an access history.

• Only allow approved media, preferably encrypted, labelled and assigned to the owner.
• Block automatic file execution and control data copying from critical systems.
• Scan approved media under the agreed procedure; a file scan does not establish the safety of the whole device. Record exceptions in the exception register.
• Do not connect unknown media, even to scan it or identify its owner. Report found or lost media to IT; authorised specialists analyse it in a controlled environment.

Phishing and BEC bypass tools due to time pressure

Fake invoices, urgent transfer requests, login links and impersonating a supervisor are effective when a user acts under pressure. That's why email protection must go hand in hand with MFA, a confirmation procedure and a simple path to reporting suspicious messages. Confirm payment or bank-detail changes through an independent channel with a previously known contact, not a number or address from the suspicious message.

Beyond USB: Fake emails, OAuth consents, and out-of-process requests

In practice, USB drives and fraudulent messages are part of the same problem: the user is prompted to perform an action outside the standard process. That action may involve connecting media, downloading a file, clicking a link, entering a password or confirming a transfer.

• Teach users to recognise pressure, fake sign-ins and OAuth consent requests. Do not approve app permissions without checking scope and obtaining required administrator approval.
• Use MFA, preferring phishing-resistant methods. MFA does not validate a payment instruction; also review sessions and application consent.
• Provide a simple button or address to report suspicious messages.
• Check email redirection rules and unusual logins after any suspected phishing.

Tools alone are not enough without policies and owners

The policy owner should regularly check whether the rules still match working practices and device settings. After an incident or process change, update configurations, instructions and exception records, then explain the changes to employees.

• Specify which media is allowed and who approves exceptions.
• Enable encryption and scanning of media used in business processes.
• Determine how an employee reports a suspicious e-mail, lost media or accidental sending of data.
• Separate regular user accounts from administrative accounts.
• Practice BEC, phishing and data loss scenarios instead of limiting yourself to a once-a-year presentation.

What should be included in the minimum technical standard

The minimum standard includes endpoint protection, application and device control, updates, MFA, email filtering, backup and logs to determine what happened after the incident.

Audit evidence: what to show after an incident or audit

A good security policy leaves a trace: who accepted the exception, which medium was used, when a suspicious login was detected, how the helpdesk responded and whether the incident resulted in a configuration change. This approach is consistent with ISO 27001 practice and facilitates conversations with the management board, a client or an auditor.

• USB exception log, including owner, reason and date of review.
• Reports on email protection, phishing reports, unusual logins and mailbox redirection rules.
• MFA confirmation for user accounts, administrators, email, VPN and cloud applications.
• Backup test results and information about which user data can be restored.
• Conclusions after the incident: improved procedure, configuration change, short communication to employees.

How to check if your policy works in practice

It is worth conducting a short review: selecting a few processes, talking to users, testing the workstation configuration, checking email rules, analysing permissions and determining whether recent incidents resulted in corrective actions.

• Do employees know where to report suspicious messages?
• Can the company indicate the owner of the USB media policy?
• Do critical accounts have MFA and appropriately restricted permissions?
• Does the backup cover user data, not just servers?
• Are incidents documented and closed with specific changes?

How to reduce the risk? Training, procedures and technical security

Training does not replace technical checks, but helps employees understand when to stop the process and ask for confirmation. Good training works with examples from the company: email, media, file sharing, password reset, MFA and incident reporting.

How Virtline helps reduce risk to people, email and devices

Virtline can combine a policy review with a technical assessment of email, endpoints, MFA, permissions, backup and response procedures. Because our ISO/IEC 27001:2022 management system is certified by TÜV NORD, we approach security through evidence, accountable owners and periodic maintenance of controls.

Effect for the management and IT

The company receives a clear risk map, decision owners, time-bound priorities and evidence that the security policy is not just a document, but works in everyday work.

A short exercise that quickly exposes gaps

The most useful security-policy test does not need to be long. Walk through one realistic scenario from report to closure: one employee finds a USB drive, another receives an out-of-process payment request, and the helpdesk must secure the account and evidence. The result shows whether the procedure is understood, whether tools record the relevant events and whether decisions reach the right owners. Agree the exercise scope, owner and safe test materials. Do not use unknown USB devices, live malware or real payments.

• Measure the time from noticing the event to reporting it through the approved channel.
• Do not connect the device or circulate the suspicious message to colleagues. Report it through the approved button or IT channel while preserving the original and evidence.
• Verify that IT can locate email, MFA, endpoint, USB and mailbox-forwarding logs.
• Close the exercise with configuration changes, short user guidance and evidence for management or audit review.

Related guidance

Risks involving removable media, email and user behaviour should be managed together with phishing defences, account protection and the wider cybersecurity programme.

• Define which USB media are allowed, who approves exceptions and how data transfers are logged.
• Specify how users report phishing, suspicious attachments, QR codes and payment changes without unnecessary steps.
• Connect MFA, EDR, email protection, device control and backup to explicit policy requirements.
• Maintain evidence that is ready after an incident for management, a customer or an auditor.

USB drive, spam or lack of technology - what threatens security policy

The real threat is rarely one isolated tool. Risk grows when employees do not know which media are allowed, email requests are verified outside the procedure, and IT cannot prove which control worked during an incident. A useful policy connects user behaviour, workstation configuration, mail protection and evidence.

Which decisions must the policy make explicit?

A good policy does not discuss security in the abstract. It resolves situations that occur in daily work by defining when media may be used, who approves exceptions, how phishing is reported and which technical control actually enforces each rule.