USB Drives are Risky—Here's What to Use Instead

Connecting an unapproved USB device to a Carilion workstation can put your information at risk—as well as your coworkers' information, patient information, and Carilion's network and technology system. That's why we have a policy about these devices and offer alternatives when you need to share files.

Why USB Devices are Risky

Personal or unapproved USB drives present a significant security risk, even when they appear to contain only familiar or work-related files. USB devices can carry hidden malware that runs automatically when the device is connected, without any visible warning to the user. This type of malware can bypass traditional security controls, install unauthorized software, capture keystrokes, or provide attackers with a foothold into the Carilion network. 

In addition to malware, unapproved USB drives can be lost, stolen, or accessed by unauthorized people—potentially leading to the disclosure of sensitive or confidential information. Because personal USB drives are not managed or monitored by Carilion, there's not a way to ensure they meet encryption, patching, or logging requirements. 

Recommendations

• If you need to share or transfer files, use OneDrive or email, which provide better security, auditing, and access controls.

• Don't use personal or unapproved USB drives on Carilion workstations.  

• If removable media is required for your job responsibilities, submit or ask your leader to submit a hardware request to obtain an approved Carilion-issued USB drive that meets our security standards. 

• Additional details are available in the Information Security Removable Media Policy.

For More Information

Read our Information Security Removable Media Policy. To view it, go to the Policies and Procedures hub and click on PageCenterX. Note that you need to be on the Carilion network to access PageCenterX. Log in to PageCenterX with your AD account, and enter Information Security Removable Media Policy in the search bar after you are logged in.