Removable media represents one of the most enduring and most consistently underestimated information security governance challenges that the Security Consulting function encounters in its advisory engagements, because the physical portability that makes removable media operationally useful is precisely the characteristic that makes it security problematic, creating the data governance gap between the organisation’s controlled IT environment and the uncontrolled external environment that the media’s movement between the two creates every time a device leaves the organisational boundary. The USB drive, the external hard disk, the optical media, and the memory card that the workforce uses for the data transfer whose convenience justifies the risk in the individual’s operational assessment may carry the sensitive customer data, the proprietary intellectual property, or the financial information whose exposure creates the regulatory consequence, the competitive harm, and the reputational damage that the individual’s convenience calculation has not reflected with the accuracy that the full risk assessment would have produced.
The Security Consulting function must govern the removable media advisory with the risk-benefit analysis philosophy that the source material identifies as the appropriate governance approach, recognising that the complete prohibition of removable media that the maximum security posture would recommend is operationally impractical for the many legitimate use cases that the business genuinely requires removable media to serve, while the unrestricted use that the convenience preference would maintain creates the unacceptable risks whose management the governance framework must provide through the controls that are proportionate to the specific risk that the specific media use creates rather than the undifferentiated prohibition or permission that the binary governance approach produces.
Understanding the Removable Media Risk Profile #
The removable media risk profile that the Security Consulting function must advise on encompasses several distinct risk categories whose separate understanding enables the governance response to be calibrated to the specific risk that each category creates rather than the aggregate risk whose management the undifferentiated policy addresses without the precision that the category-specific control provides.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
