Trjtdtk

It seems to me that a startup script could check for mounted USBs and block the wifi/network if there is a USB mounted while showing a message.

A simple polling function could check for new USBs connected.

All this is possible in Powershell.

This would solve the problem of having the USBs mounted and would force the user to eject before using the laptop. This does not solve the problem of what the user does with the USB afterward. I can easily imagine users unplugging to start using the laptop, then plugging the USB back in "to store it" once they close the lid.

This might not be the nicest way to do it, and I cannot say that I endorse it, but I have seen it used in practice:

You could have security guards patrol by night, taking any USB key-or-token plugged into a computer with them and filling a security incident. If the next day the users go fetch their USB thingies, they get an official reprimand in person. If they do not, they get a stronger reprimand because they did not notice or report their missing thingy. Make the reprimands reflect badly on their paycheck, or fire the employees with too many reprimands.

If enforced, you can be sure this policy will be very unpopular, but effective.

Edit: You added in a comment that your scenario is for mobile users that are not on premises. I'm afraid my proposal cannot be applied in this case. I will still leave may answer as it might still be useful for others trying to enforce security policies on their premises.

I'm not that technical, but this seems possible:

The USB key must be doing certain things, such as responding to enumeration, or to requests via API to validate the key. So the first question is whether those can be used. You might need to check technical docs for that possibility:

• If the devices are company owned but mobile, you could install a script that tests this, and if a device remains enumerated or responsive for more than 2 mins after initial validation was accepted, the validation/access is terminated. That should ensure users develop an automatic habit of removing their keys - the device just won't let them work if they don't.




• If some devices are BYO (bring your own) then it's harder. Perhaps the access method or key itself, allows some kind of ongoing validation, which could be repurposed (if there is ongoing access beyond a few minutes, terminate). If needed, buy a type of key that allows this.




• If a server-side or unilaterally operated check is not possible, so that you can't do something server-side to check USB key status, then you are forced to fall back on client side software/script. If a person wants to bring their own device, there are often policies about this, and at times and in some companies, the user has to run or install a company-provided script/software/VPN/cert/whatever if they want to use their own device on the company's network, so perhaps this is an acceptable option.

Why do you think this USB token alone is securing the laptop?

This is a two-factor authorisation situation. For those who've not met the concept before, 2FA is described as "something you know, and something you have". The USB dongle is the "something you have", but the laptop is still protected by the "something you know", i.e. a password. 2FA is intended to add a layer which allows one factor to be redundant, so it doesn't make the system insecure if the attacker gets the security token, so long as the user doesn't also have the password written down. Of course it's better that they don't break one arm of the security, but the laptop should still be secure if they do.

For forcing the user to remove the key, that also has a major issue. Securing the laptop is an afterthought, to protect any local files the user might have hanging around, which is a small subset of your company data. The critically important part is securing the user's access to your network. Networks, especially VPNs, are only as good as their login security. So if you're concerned about security, your VPN should be checking that the Bitlocker token is present when the user logs into the VPN and that it never leaves the machine during that login session. Otherwise the user could have accidentally left themselves logged in when they closed the lid and thought the computer was shut down, or various similar scenarios. You can't make the assumption "they logged in OK at some point in the past, therefore that is still them using the machine".

In short, I think you're over-thinking one area and not considering the bigger picture of how it helps company data security.

The simplest answer for USB dongles of course is to insist that they live on the user's keyring with their house or car keys. More than one keyring? No problem - they can have as many dongles as they need. But this ensures the dongle is always removed from the laptop when the user leaves it, because they need the keyring to get home.

I come from Manufacturing technology world and using little jigs to enforce a certain manual behavior for both quality and safety is a standard accepted method. I disagree with the perspective that one cannot engineer human behavior by placing certain impediments, this is done for human safety and is taken as seriously as network security. One common approach is to use a Poka-yoke, but one also sees interlocks, and dead man's switch when lives are on the line.

The challenge is how to adapt these concepts to security. While I agree it would be difficult to code your way out of this in a reliable way, if you broaden your perspective to include hardware development it is certainly achievable.

If it is important to you or your employer, a custom dongle can be designed that would force this behavior, spit-balling one approach would be a timed cutoff where the dongle disables itself after a certain amount of time under power. Requiring re-plugging.

If you have a degree of control over the laptop users and policy, but you do not wish to play police, any number of other impediments can be employed to encourage compliance with your security policy.

Of course, to an enterprising user this is by-passable, so if you are designing a security product sold to customers it would not be enough.

But I believe the analogy to poka-yoke is appropriate as bypassing the engineering control by a co-worker would go against policy/procedure and subject to reprimand or warning.

You can make the USB multipurpose making it impossible to leave it on the PC. For example, they need to plug it in another device in order to begin their workday. You can say you want to know when they come to work and the start of their workday is marked by the USB connecting to this second device.

This is not applicable to every case, but I'm writing it with the hope that it might give a good idea to someone.

OK, so now you've ensured somehow that the owner of the laptop does not leave their token plugged in.

However they now take that laptop and token with them when going home, and get mugged by an industrial spy on the parking lot. Result is both token and laptop are how in the hands of an unauthorised person and worse, the same unauthorised person.

Result of course is exactly the same as it would be were the token plugged into the laptop, as the bad guy can just plug in the token.

Congratulations, you've just shifted the security boundary a little bit for no real gain whatsoever.

What you could do is install some software on the laptops that blocks the screen or even shuts them down if the token is found installed on the laptop after the operating system is done booting. Say something that's started as part of the OS startup and checks for the token every few minutes.
Would ensure that the token is removed after booting the machine, but wouldn't prevent both token and machine being stolen.

The only way to ensure that is a 4-eye principle, where the machine cannot be booted up without at least 2 people being present, one with the token and another with the password.

And that is a major PITA and, especially for remote workers, often impossible (as remote workers tend to be alone at a site).