EP-B-02Level 1 · Signal
Connects USB storage
A risky Behavior signal from endpoint protection (EDR, endpoint.usb.connected): this person plugged removable storage into a managed device.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.DS-01
- MITRE ATT&CK
-
- T1052.001
The definition, in detail
Definition
Data can leave and malware can arrive on a path no network control sees.
Example
A marketing coordinator copies a 4 GB campaign folder to a personal thumb drive to work on at home; the endpoint agent logs the device and the file count.
How it is measured
- Source
- Endpoint protection
- Subject
- Person
- Event
- endpoint.usb.connected
- Risk domain
- Endpoint and device
- Provenance
- Framework research
How it is used
Programs count "Connects USB storage" per person from Endpoint protection and read it beside the other Endpoint and device signals; it feeds 0 cohorts, 0 sequences and 3 breach scenarios.
A "connects USB storage" event is evidence of behavior under pressure. It is one observed action, and on its own it is no proof of compromise.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0104Signs into enterprise apps from unmanaged devices
- I.0116Downloads executable files from suspicious domains
- I.0184Disables endpoint security controls
- I.0186Delays software updates repeatedly
- I.0188Uses devices with unnecessary or risky software
- I.0190Runs files from suspicious or unrecognized USB devices
- I.0192Downloads and executes malicious files
- I.0195Runs unsupported legacy applications
- I.0196Delays reboots after patch installation
- I.0197Installs unapproved software
- I.0198Runs portable applications from external drives
- I.0199Uses personal devices for enterprise work without enrollment
- I.0200Connects to unknown USB peripherals
- I.0201Uses devices that boot from removable media
- I.0202Charges devices from untrusted USB sources
- I.0206Uses devices observed to frequently visit risky websites
- I.0207Disables screen lock or timeout
- I.0208Leaves devices unlocked in public or shared spaces
- I.0209Uses jailbroken or rooted mobile devices for work
- I.0210Installs remote access tools without approval
- I.0211Runs browser-based games or crypto mining on work devices
- I.0223Badges in without badging out
- I.0224Badges out without prior badge in
- I.0225Allows additional person to enter without authorization
- I.0226Holds secure door open beyond expected duration
- I.0227Attempts to access unauthorized areas with badge
- I.0228Accumulates excessive denied access attempts
- I.0229Accesses facilities more frequently than expected
- I.0230Accesses facilities outside expected hours
- I.0231Accesses facilities using unexpected badge
- I.0232Accesses facilities while on leave
- I.0233Accesses facilities after offboarding
- I.0234Accesses multiple facilities simultaneously
- I.0235Visits sensitive zones for unusually short durations
- I.0236Loiters in sensitive zones beyond expected durations
- I.0237Appears onsite while also appearing remote
- I.0238Fails to display badge when onsite
- I.0239Sponsors visitors more frequently than expected
- I.0240Attempts to sponsor unauthorized visitors
- I.0241Fails to respond appropriately during security drills
- I.0242Fails clean desk policy audit
- I.0294Uses shared home device to access corporate systems
- I.0298Fails device posture checks during remote access
- I.0299Rarely connects to device management platform
- I.0300Delays applying patches while remote
- I.0301Disables device encryption outside office environments
- I.0302Uses unmanaged personal device for corporate access
- I.0304Accesses work apps from consumer devices
- I.0305Installs unapproved remote access tools
- I.0311Works remotely without connecting to VPN
- I.0315Leaves work device unattended in public places
- I.0320Connects from geolocations inconsistent with work profile
- I.0321Uses open Wi-Fi networks without VPN
- I.0364Operates rooted or jailbroken mobile device
- I.0365Disables full-disk encryption on mobile device
- I.0366Connects mobile device to untrusted Wi-Fi
- I.0367Fails to maintain secure VPN tunnel on mobile device
- I.0368Installs sideloaded or unapproved applications on mobile device
- I.0369Grants excessive mobile app permissions
- I.0371Removes or tampers with MDM profile
- I.0372Operates mobile device from restricted geolocation
- I.0374Runs mobile device with preinstalled riskware
Continue exploring
"Connects USB storage" (EP-B-02), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/ep-b-02-connects-usb-storage
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.