Is disallowing write to USB actually an efficient way to prevent data leakage?

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do that, they would have no end of workarounds, up to printing QR codes on A4 sheets.

Rather, it is to prevent employees from saving sensitive information on USB drives in good faith, only to have those USB drives lost or stolen.

Often in such cases you'll find that it's OK to save data on specific encrypted thumb drives that can't be decrypted in case of theft or loss: e.g. biometric-lock drives(*) or encrypted file systems that will be "seen" as physical fixed hard drives instead of removable hard drives, thereby circumventing a "cannot write to removable drives" security policy.

Windows 7+ has explicit settings that enable treating BitLocked devices (possibly with corporate keys) differently from plain USB devices.

(In my case, that was Windows XP Pro SP3 some time ago, I had a USB key with a TrueCrypt volume on it, and I was allowed to take some work at home on it. I was under orders not to copy the files anywhere else and not to use the USB drive for any other purpose. This kind of precautions is clearly directed against accidental leaks, not intentional ones).

For the same reasons, some popular file sharing sites, or sites and apps that could allow file sharing, might be blocked by company firewalls. Again, not so much to stop espionage, but to prevent people from growing too careless (at least in the powers-that-be's opinion) with corporate information.

(*) Note

Biometric lock thumb drives and (especially) hard disks aren't necessarily secure - or even encrypted, or encrypted correctly. If the memory can be physically separated from the locking part (easy for most HDD enclosures, conceivable for many USB thumb drives) someone can try to read it directly, maybe just to "reclaim" the memory itself. After all, in case of failure the finder will have just lost some time. Once he or she has the hands on the readable memory, simple curiosity might be enough to take a peek and maybe even try and decrypt it before reformatting and repurposing. With luck, the device is vulnerable and just googling its make and model will allow someone to recover the necessary tools and/or knowledge.


In addition to what Iserni has said, memory sticks these days can hold huge amounts of data.

Shifting 64GB of sensitive data to a cloud provider could take a long time, and may well trigger firewall rules set to look for excessive uploads. In any case, the uploads will be logged.

Downloading 64GB to a USB3 memory stick will be a lot quicker, and won't go near any company firewall. When the memory stick is full, it can just be slipped into a pocket. The company won't even know what's been done until the data is used against them or their customers.