In November 2008, the US Department of Defense banned the use of USB flash drives and other removable medial on all Defense Department networks, after a DoD network was infected by a USB flash drive that had an autorun malware on it.
Today, Navy Vice Admiral Carl Mauney, deputy commander of the United States Strategic Command said: “After extensive testing of mitigation measures, DoD decided to make this technology available again on a strictly controlled basis on DoD computers. Since the order restricting use of removable media, DoD developed capabilities and processes that allow safe use of these devices. Removable media use will be limited to mission-essential operations, and only after strict compliance requirements are met.”
An article at Government Info Security lists the requirements for using removable storage devices in the Department of Defense:
- Employing approved procedures and hardware that prevent unauthorized use, and scan, clean and wipe the devices removing malicious software.
- Restricting use to operational mission requirements
- Allowing only properly inventoried, government-procured and -owned devices for use in Defense Department information systems.
- Prohibiting personally owned devices on all military networks and computers.
- Banning use of DoD-procured and owned devices on non-government networks or computers without authorization from an approval authority.
- Using flash media only as a last resort to transfer data from one location to another and only when other authorized network resources are not available.
- Subjecting randomly selected users and drives to periodic audits.
- Requiring combatant commands, cervices, and agencies to establish their own approval authorities for determining whether selected flash media may be used within their individual organizations.
In an interview published by the Armed Forces Press Service today, Navy Vice Admiral Mauney said active operations in Afghanistan, Iraq and elsewhere will get priority in implementation of the new guidelines. “In terms of the mechanics, we’ve put together several small kits of the equipment that’s needed and we’ll be transitioning those to people out in the theater – in Afghanistan in particular – to help certain groups facilitate their use,” he said. The kits will contain hardware and software to ensure the safe use of removable media, including the required anti-malware scanning capabilities.
