Detections
Analytics

1.72 UBTU-22-291010

Information

The operating system must disable automatic mounting of Universal Serial Bus (USB) mass storage driver.

GROUP ID: V-260540
RULE ID: SV-260540r986276

Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.

Peripherals include, but are not limited to, such devices as flash drives, external storage, and printers.

Solution

Configure the operating system to disable using the USB storage kernel module.

Create and/or append a custom file under "/etc/modprobe.d/" to contain the following:

$ sudo su -c "echo install usb-storage /bin/false >> /etc/modprobe.d/stig.conf"

Configure the operating system to disable the ability to use USB mass storage devices.

$ sudo su -c "echo blacklist usb-storage >> /etc/modprobe.d/stig.conf"

See Also

https://workbench.cisecurity.org/benchmarks/22168

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-3, CAT|II, CCI|CCI-001958, CCI|CCI-003959, CSCv7|13.7, Rule-ID|SV-260540r986276_rule, STIG-ID|UBTU-22-291010, Vuln-ID|V-260540

Plugin: Unix

Control ID: 1326f2b370d78965a33a26a4206cbb7ddb2a93b178d4217771e425d201b97a2a