IBM bans all removable storage, for all staff, everywhere
Risk of ‘financial and reputational damage’ is too high, says CISO
IBM has banned its staff from using removable storage devices.
In an advisory to employees, IBM global chief information security officer Shamla Naidoo said the company “is expanding the practice of prohibiting data transfer to all removable portable storage devices (eg: USB, SD card, flash drive).”
The advisory stated some pockets of IBM have had this policy for a while, but “over the next few weeks we are implementing this policy worldwide.”
Big Blue’s doing this because “the possible financial and reputational damage from misplaced, lost or misused removable portable storage devices must be minimised.”
IBMers are advised to use Big Blue’s preferred sync ‘n’ share service to move data around.
But the advisory also admitted that the move may be “disruptive for some.”
She’s not wrong: The Register understands that frontline IBM staff sometimes need to download patches so they can be installed on devices they manage for clients and that bootable USB drives are one means of installing those patches.
Indeed, IBM offers advice on how to install Linux on its own POWER 9 servers using a USB key. ®
UPDATE: Since publishing this story we've heard whispers that IBM has taken note of staff objections to the removable storage ban, especially when doing software updates, and is considering making a few exemptions.