Illinois - Peripherals

Securing USB Thumb Drives. Part I

2004-11-11T17:13:12Z

Hello Everyone, this is my first post and hopefully it will be one of great help to all of you. For the past three months our department has been trying to figure out which way to go with USB drives. We understand that USB thumb drives are becoming popular among our patrons and are a much attractive solution to floppy disks. However we realized there are some serious security risk that come along with having these benefits. Viruses, trojans, hacking programs and scanners are a major threat to any network, and these would easily be available to use by way of these thumb drives. We started searching for a solution that would allow are patrons to use these USB drives but prevent these risks to materialize. Unfortunately the only options we found were to disable the USB device completely by way of registry settings, BIOS settings, or by a third party software. The other option was to restrict writing to a USB thumb drive, but this would only work if you had XP SP2. We were not satisfied with these solutions. Luckily we found a way to allow our patrons to use their thumb drives and have access to their files but at the same time prevent them from running any executables, scripts, or batch files. After having successfully tested this on several of our public PCs and getting a positive feedback from our patrons and staff, we will be deploying this solution to all our PAC/Gates PCs in the next month.

In short, here is what we did to make this possible. We used the Security Restriction Policies found in Windows XP local security settings module. We created a couple of path rules that would disallow executables and other pre-defined extensions from running on certain drive letters and directories. Thus these policies effectively restricted any applications and scripts from running directly on the USB drive or from the desktop.

For those interested, I will be posting the complete instructions on how this was done in our system in a follow up post (Securing USB Thumb Drives. Part II).

If you are not aware of what software restriction policies are check out the following links below:

http://www.microsoft.com/technet/security/prodtech/winclnt/secwinxp/xpsgch06.mspx - Software Restriction Policies

http://www.microsoft.com/technet/security/prodtech/winclnt/secwinxp/default.mspx - Windows XP Security Guide.

http://www.jsiinc.com/SUBH/tip3600/rh3612.htm - Deploying Local Group Policies in a Non-AD Domain or Workgroups.

Kenji D'Aguiar
Brevard County Libraries

Re: Scanning for the public

2008-03-27T23:09:54Z

We offer a scanner in our Public Computer Center, but we offer VERY minimal help to go with it. We have 32 computers and one person on the desk, so most patrons understand. For the most part, folks who need to use the scanner have used one before and understand the basics, they just need a pointer to get started on our particular model.

Re: Scanning for the public

2008-03-27T20:23:57Z

We don't have a scanner for the public and suspect we won't. Rather, our next copier will have scanning capability (as they are all "digital" anyway) and will be able to send a scan to an e-mail address.

No timeline for this, though. We do have the very occasional request.

Re: Scanning for the public

2008-03-27T01:19:58Z

Thanks for the great question!

I'm making this the [url http://www.webjunction.org/forums/thread.jspa?threadID=7513]Question of the Week[/url]. People can respond to and discuss the topic in this discussion thread.

Scanning for the public

2008-03-20T21:53:43Z

I read the post about scanner recommendations, but would like to ask a more general question: how do libraries handle scanning? We have a scanner for staff (actually in my office, and I'm usually the only one to use it) but would like to put it out for the public, since we do get a few requests. So my question: if you offer scanning for the public, does staff do it, or is the scanner out and available for anyone to use? Do people seem to be able to manage, or does staff usually have to help? Any suggestions or guidelines? Thanks!

Re: Problems replacing DVD-ROM

2008-01-16T20:48:29Z

Might well have been the cable. As I recall the DVD and Zip are a bit far apart on these and it's easy for the connections to get just slightly pulled out and not work - it doesn't take much.

Re: Problems replacing DVD-ROM

2008-01-16T20:43:09Z

Should have been the first thing I checked. Thanks for reminding me.

When I was switching it out, I had looked and placed it in the same spot (CS) but the little thing was backwards. Would that make a difference? It was either that or the IDE cable was loose, because after pulling it back out, flipping the little thing around, then plugging everything back in, it works!

Thanks again for your expert help!

Message was edited by:
lakedaemon

Re: Problems replacing DVD-ROM

2008-01-16T19:12:05Z

Have you checked the Master/Slave jumper on the back of the drive? Because you have both the DVD and the Zip drive on the same IDE cable, this has to be set correctly. I am thinking that the DVD needs to be set to Slave, but check the one you took out first (since it's now been over 3 years since I touched one of these). The Jumper is a tiny black plastic piece that sits on a series of pins.

You should have no need for drivers for this - looking in the BIOS was a good idea, when you don't see a drive show up there, it tells you that the problem is hardware related, and nothing you do in Windows is going to help.

If it isn't the jumpers, definitely also double-check the IDE cable connection. If it continues not to show up in BIOS you can also:
- Unplug the Zip drive and see if the DVD now shows up.
- Try another IDE cable - either new or from a working pc.
- Finally, try putting this new DVD drive in another computer to make sure it is responding.

Dale

Problems replacing DVD-ROM

2008-01-16T17:11:39Z

I tried replacing the DVD-ROM that came with the Gates computer with a DVD/CD burner (The DVD burner is a Memorex MRX-525G) and the computer isn't seeing anything. I've looked in the BIOS and there isn't anything there, either.

When the computer is booted up, the light on the front of the drive blinks and when I push the eject button, it opens and closes, so I know it's getting power.

The computer was originally running 2000, then upgraded a few years ago to XP and has SP2.

I did remember to unlock the centurion guard before I started anything, and just in case, I also uninstalled all the computer profile restrictions, and logged in as the administrator.

I've tried having the computer scan few new hardware, with no results. Looking in the device manager, there's nothing listed for DVD/CD-ROM drives, so it just seems the computer isn't seeing this at all.

I've tried looking for drivers for this drive but memorex doesn't even list this particular model as one of their products, and google searching has not helped.

One other thing, while digging around I came across a message that says something like, no drivers installed for ata atapi devices. I've tried installing various ones I thought were generic to see if that would solve anything, but so far, nothing.

Any help will be greatly appreciated!

Re: screen protectors for LCD monitors

2008-01-08T15:10:05Z

What a great idea Chris! The husband of one of our employees works for a glass company, and I am sure we can talk him into making some for us.

Re: screen protectors for LCD monitors

2008-01-07T22:47:28Z

As long as you're not looking for a privacy screen, try this: we had our local window and glass supplier cut squares of their thinnest Plexiglas, then we attach them to the monitors with rubberized Velcro (I think made by 3M). They also look like they're a part of the monitor, they work just great, and they're only about $10 per monitor.

Chris

Re: RE: LCD monitors

2007-09-24T02:31:14Z

Since this last post is 3 years old, can anyone update recommendations for LCD flat screen monitors with more durable "harder" screens?

screen protectors for LCD monitors

2007-09-20T21:20:47Z

We need a workable screen protector for an LCD monitor. The ones we have on the Gates computers are ideal, like a picture frame that sits on (and around) the monitor. They look like part of the monitor so people don't take them off (an issue with another we tried) and they don't fall off (as do ones with velcro or tape fasteners). Can anyone recommend one?

Re: USB Flash Drives

2007-08-02T16:59:03Z

This blog talks about varying *write* speeds the author encountered while using a flash drive and some of the solutions/information he learned. YMMV, but some of the "TALKBACKS" might also be of interest.

Blog: "Flash drives: your mileage WILL vary" --
http://blogs.zdnet.com/storage/?p=166

Re: Floppy drive noise

2007-05-22T17:26:46Z

Sounds like something is intermittently trying to access the drives. Maybe antivirus software? If this is happening on all of them, is there some software you have recently installed or updated?

Floppy drive noise

2007-05-22T17:19:20Z

Our granted computers have started to make noise intermittently from the floppy drives. The floppy drive light goes on and it is as though the computer is trying to read the drive. Patrons using the machines are on the internet or other programs and are not trying to use the floppy drive. I have put in blank floppies in the drives to stop the noise and that works sometimes. What is happening?

Re: Allow to safely remove USB drives w2K

2007-05-17T19:44:26Z

Sure - it's one of those things that is so simple but so not what your hand wants to do - and of course it really sounds condescending to ask "are you sure you are left-clicking"?

Re: Allow to safely remove USB drives w2K

2007-05-17T18:05:20Z

Oh, I was right clicking... thanks!!!!

Message was edited by:
pcdltech

Re: Allow to safely remove USB drives w2K

2007-05-16T20:40:55Z

Hi -

Yes, this really should be in those instructions, as it's easy but a bit odd.

What you need to do is single left-click the "Safely Remove Hardware" icon in the system tray. Then it should open and allow you to stop the device.

If you either double-click or right-click, you will get an error and it won't work.

Dale

P.S. for others reading this - this applies to Windows 2000 models only. For XP, you shouldn't need to do this at all, just wait until all files are saved then pull out the drive.

Allow to safely remove USB drives w2K

2007-05-16T20:32:11Z

Hi, I'm sure this has already been address ,but ... I've found the info about the "adding one or more drive letters for USB devices connected to the gates library computer" but I can't seem to find any definite info about how to allow patrons to "safely remove hardware". What have I missed. I've looked and searched, but I can't seem to find it. Help!? T.I.A.!