Train all users on the secure use of removable media and storage devices, acceptable use policy, and approval process through use of user's guide, user's agreement, or training program.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22114	STO-ALL-050	SV-25621r1_rule		Low

Description
Written user guidance gives the users a place to learn about updated guidance on user responsibilities for safeguarding DoD information assets. Most security breaches occur when users violate security policy because they lack training.

STIG	Date
Removable Storage and External Connections Security Technical Implementation Guide	2017-03-02

Details

Check Text ( C-27101r1_chk )
Further policy details: Users will be trained to ensure devices are powered off for at least 60 seconds when disconnecting them from one system and connecting them to a different system to make sure enough time passes for all power to dissipate and the memory erased. Devices that contain volatile memory use the memory for temporary storage (e.g., page buffers in printers, image buffers in scanners, or cache buffers in removable storage devices like Zip drives). Special note should be made of USB hubs as they contain memory buffers even though it is not obvious. When power is removed from these devices by unplugging them from the port and unplugging them from a separate power supply if one is needed, their memory is erased. Because these devices are designed to withstand minor fluctuations in power, they contain some means of maintaining memory for short power interruptions. Check procedures: Inspect the relevant document. Verify the documentation or user agreement contains the following at a minimum. Volatile memory devices: 1. Acceptable use and approval process for the use of volatile memory devices. 2. Powering down volatile memory devices for 60 seconds before connecting to any end point. 3. Labeling and handling instructions in coordination with the Security Manager (SM). 4. Procedures for reporting lost/stolen devices. Persistent memory devices: 1. Acceptable use and approval process for the use of all USB devices. 2. Acceptable use and approval process for the use of flash media devices with the Windows OS. 3. An explanation of the restrictions placed on attaching non-government-owned USB devices to a government-owned system. 4. Use of authorized government-owned flash drives with personal or other unauthorized computers. 5. Data transfer and wiping procedures. 6. The prohibition against disguised USB drives. 7. Labeling and handling instructions in coordination with the Security Manager (SM). 8. Procedures for reporting lost or stolen devices.

Check Text ( C-27101r1_chk )

Further policy details:

Users will be trained to ensure devices are powered off for at least 60 seconds when disconnecting them from one system and connecting them to a different system to make sure enough time passes for all power to dissipate and the memory erased. Devices that contain volatile memory use the memory for temporary storage (e.g., page buffers in printers, image buffers in scanners, or cache buffers in removable storage devices like Zip drives). Special note should be made of USB hubs as they contain memory buffers even though it is not obvious. When power is removed from these devices by unplugging them from the port and unplugging them from a separate power supply if one is needed, their memory is erased. Because these devices are designed to withstand minor fluctuations in power, they contain some means of maintaining memory for short power interruptions.

Check procedures:

Inspect the relevant document. Verify the documentation or user agreement contains the following at a minimum.

Volatile memory devices:

1. Acceptable use and approval process for the use of volatile memory devices.
2. Powering down volatile memory devices for 60 seconds before connecting to any end point.
3. Labeling and handling instructions in coordination with the Security Manager (SM).
4. Procedures for reporting lost/stolen devices.

Persistent memory devices:

1. Acceptable use and approval process for the use of all USB devices.
2. Acceptable use and approval process for the use of flash media devices with the Windows OS.
3. An explanation of the restrictions placed on attaching non-government-owned USB devices to a government-owned system.
4. Use of authorized government-owned flash drives with personal or other unauthorized computers.
5. Data transfer and wiping procedures.
6. The prohibition against disguised USB drives.
7. Labeling and handling instructions in coordination with the Security Manager (SM).
8. Procedures for reporting lost or stolen devices.

Fix Text (F-23203r1_fix)
Train all users on the secure use of removable media and storage devices, acceptable use policy, and approval process through use of user's guide, user's agreement, or training program. .