DS-01: Removable Media Encryption

Control Description

Encryption technologies and physical asset protections are used for removable media such as USB drives and backup tapes.

This control requires organizations to protect sensitive data on removable media devices (like USB drives, external hard drives, and backup tapes) through encryption and physical security measures to prevent unauthorized access and data breaches.

Implementation

1. Removable Media Policy

Device Classification

Approved Devices: Company-issued encrypted USB drives
Restricted Devices: Personal USB drives (not allowed)
Backup Media: Encrypted backup tapes and drives
Mobile Devices: Encrypted laptops and tablets

Usage Guidelines

Only use company-approved encrypted devices
Never store sensitive data on unencrypted media
Physical security for all removable media
Regular inventory and tracking

2. USB Drive Encryption

BitLocker for Windows

# Enable BitLocker on USB drive
Enable-BitLocker -MountPoint "E:" -EncryptionMethod Aes256 -UsedSpaceOnly

# Check BitLocker status
Get-BitLockerVolume -MountPoint "E:"

# Suspend BitLocker (for maintenance)
Suspend-BitLocker -MountPoint "E:" -RebootCount 0

FileVault for macOS

# Encrypt USB drive on macOS
diskutil coreStorage convert /dev/disk2 -passphrase

# Check encryption status
diskutil coreStorage list

# Unlock encrypted drive
diskutil coreStorage unlockVolume /dev/disk3 -passphrase

LUKS for Linux

# Encrypt USB drive with LUKS
sudo cryptsetup luksFormat /dev/sdb1

# Open encrypted drive
sudo cryptsetup luksOpen /dev/sdb1 encrypted_usb

# Format and mount
sudo mkfs.ext4 /dev/mapper/encrypted_usb
sudo mount /dev/mapper/encrypted_usb /mnt/usb

# Close encrypted drive
sudo cryptsetup luksClose encrypted_usb

3. Automated Device Management

4. Physical Security Measures

5. Backup Tape Encryption

Key Success Factors

Policy Enforcement: Clear policies for removable media usage
Encryption: All sensitive data encrypted on removable media
Physical Security: Secure storage and access controls
Monitoring: Regular monitoring of device usage
Training: Employee awareness of security requirements

Common Pitfalls to Avoid

No Policy: Without clear policies, usage is inconsistent
No Encryption: Unencrypted data is vulnerable to theft
No Monitoring: Unauthorized devices go undetected
No Training: Employees don't understand security requirements

Data Security Controls

DS-03: Data Classification and Handling: Data classification policies and procedures
DS-04: Data Loss Prevention: DLP implementation and monitoring
DS-05: Secure Data Transmission: Encryption in transit requirements
DS-06: Data Retention and Disposal: Data lifecycle management

Encryption Controls

LS-01: Database Encryption at Rest: Database-level encryption implementation
BDR-09: Backup Encryption: Backup data encryption requirements

Access Management

LS-04: Access Authorization: Access control and authorization
LS-05: Access Review: Regular access reviews and audits
LS-07: Privileged Access Management: Privileged access controls

Physical Security

LS-21: Physical Access Controls: Physical security measures
LS-22: Asset Management: Asset tracking and management

Encryption Tools

Security Resources

Leadline Architecture Design

SSDLC Security Practices: Security toolchain and secure development practices for data protection
Observability & Monitoring: Monitoring and logging for data security and access tracking