Would You Plug an Unknown USB Drive Into Your Office PC?

No. An unknown USB drive should never go into an office PC, however harmless it looks. Singapore's Cyber Security Agency (CSA) warns that USB drives can introduce malicious software into an organisation's systems and let attackers get around network perimeter defences, and that some devices disguised as USB drives can run pre-programmed commands without anyone touching the keyboard. The safe habit is simple: hand a found or unexpected drive to IT, unopened.

Below: the risks, CSA's advice, and how to enforce a USB policy with Microsoft Defender device control, Intune and BitLocker, using Microsoft 365 Business Premium, Microsoft Defender for Endpoint Plan 1, the ASUS ExpertBook B1 and a company-issued SanDisk Professional G-DRIVE ArmorATD drive.

USB risks at a glance: what can go wrong and what stops it

Why is an unknown USB drive dangerous?

There are three broad problems. First, a drive can carry malware, and CSA notes that infected drives can carry it from one computer or network to another. Plugged in inside the office, it skips the firewall at the network edge. Second, not everything shaped like a flash drive is storage: CSA describes devices that act like a keyboard and run pre-programmed commands. The defence is to stop unapproved USB devices being accepted at all. Third, data leaks out: the Personal Data Protection Commission's (PDPC) guide to data protection practices for ICT systems notes that USB drives are more easily misplaced or stolen than desktop computers.

USB storage needs the same rules as email attachments: known source, approved device, encrypted when it holds anything sensitive. For the wider problem of devices nobody manages, read The Most Dangerous Device in Your Office Might Be the One Nobody Manages, and for how a forgotten device turns into an incident, see A Cyber Incident Can Start With a Forgotten Device in Your Office.

What does CSA recommend for USB devices?

CSA's advisory on malware spread through USB devices (24 April 2024) lists eight measures for organisations. In summary:

• Scan USB devices with updated antivirus before opening anything on them.
• Be cautious with unknown devices, including conference and exhibition giveaways.
• Allow only approved devices by hardware ID and block the rest; consider physical port blockers on public-space computers.
• Disable AutoRun and AutoPlay, or set them to prompt.
• Use drives with a hardware write-protection switch on untrusted computers.
• Run endpoint security that covers offline as well as online threats.
• Keep work and personal USB drives separate.
• Set device-security policies and make staff aware of USB risks.

Treat a found USB drive like a stranger's email attachment: interesting, and not yours to open.

How do you block USB storage on Windows PCs?

Microsoft Defender's device control lets IT decide which peripherals users can use. Microsoft's documentation says it can restrict Windows Portable Devices, removable media, CD/DVDs and printers, by device, device type, operation (read, write, execute), user group, network location or file type, with audit entries when a policy triggers. It applies to Defender for Endpoint Plan 1 and Plan 2 and to Microsoft Defender for Business, runs on Windows 10 and Windows 11, and can be managed from Microsoft Intune, the Microsoft Defender portal or Group Policy. Microsoft notes that servers are not currently supported.

In Intune, the attack surface reduction policy has a Device Control profile to "allow, block, and otherwise secure removable media", including allow and block lists by device identifier and setup class; where an allow list and a block list overlap, the device enforces the most restrictive setting. A practical starting policy for an SME looks like this:

• Block removable storage for everyone by default, or set it to read-only.
• Allow write access only for company-issued drives, identified by hardware ID, for the staff who need them.
• Audit first for a week or two to see who uses USB storage.
• Give people an alternative: OneDrive or SharePoint sharing links for files that used to travel on sticks.

For personal laptops, see Should Companies Ban Personal Laptops From Their Office Network?

Should company USB drives be encrypted?

Yes, if they ever hold customer, staff or financial data. The PDPC guide advises organisations to minimise personal data on removable storage, to protect it with appropriate measures including encryption, and gives disabling USB ports as an example of a measure against leakage. On Windows, Microsoft lists BitLocker as supported on Pro, Enterprise and Education editions. Note one detail: Microsoft states that the automatic "device encryption" feature encrypts only the operating system drive and fixed drives, not external or USB drives, so removable drives need BitLocker applied deliberately. BitLocker's removable-drive policies include a setting named "Deny write access to removable drives not protected by BitLocker", which lets IT require encryption before anyone can copy files to a stick.

For the laptop's own disk, see One Stolen Laptop. How Much Could It Really Cost Your Business?

What should staff do when they find a USB drive?

One line in the IT policy: do not plug it in anywhere; hand it to IT, who can dispose of it or examine it on an isolated machine. The same goes for event giveaways and visitors who "just need to show a file"; offer a sharing link instead. For reception, showroom and kiosk PCs, CSA's suggestion of physical port blockers is worth following, together with BIOS boot passwords so the PC cannot be started from an external drive, as the PDPC guide recommends for non-administrator users. For meeting rooms, Your Video Conference Is Confidential. But What About the Room Equipment? covers room kits and BYOD ports, and The Next Cybersecurity Incident Could Come Through Your Video Wall covers signage players.

Which licences and hardware help enforce a USB policy?

Microsoft 365 Business Premium (S$335.00 per user for 12 months) suits businesses of up to 300 users: Microsoft lists Intune Plan 1 and Defender for Business in the plan, covering the policies above. If you only need the endpoint protection layer, Microsoft Defender for Endpoint Plan 1 is listed at S$46.00 per user for 12 months (servers need separate licences, per the listing). Browse the full range in Microsoft 365 for Business.

The ASUS ExpertBook B1 B1403CVA-NJ1209X (S$1,499.00) ships with Windows 11 Pro, TPM 2.0 for BitLocker keys, BIOS setup and boot passwords and a fingerprint reader, with 3 years of onsite next-business-day warranty per the listing. For staff who must move large files offline, issue a company drive rather than allowing personal ones: the SanDisk Professional 1TB G-DRIVE ArmorATD (S$140.00, available to order) is a rugged USB-C drive; its listing does not mention hardware encryption, so format it for Windows and protect it with BitLocker before use. Hardware-encrypted or write-protect drives and port blockers are not currently listed; ask us if you need them. Backups still matter, as When Ransomware Strikes, Can Your Business Still Communicate? and our ransomware prevention guide explain.

Buying USB security tools in Singapore

SourceIT supplies Microsoft licences, ASUS business laptops and SanDisk storage with a GST invoice; Microsoft subscriptions are per user for a 12-month term and carry no hardware warranty. Prices are as listed on 24 Oct 2026. The Microsoft licences and the ExpertBook B1 were in stock at the time of writing, and the SanDisk drive is available to order. For a fleet rollout or policy plan, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or see our corporate sales page.

Frequently asked questions

Is it safe to plug in a USB drive I found? No. CSA warns that USB drives can introduce malware and that some devices disguised as drives run pre-programmed commands. Hand it to IT without connecting it.

Can Windows block USB storage but allow approved drives? Yes. Microsoft Defender device control and the Intune Device Control profile can block removable storage and allow specific devices by hardware or device ID, with read, write and execute controlled separately.

Which Microsoft licence includes device control? Microsoft's device control documentation applies to Defender for Endpoint Plan 1 and Plan 2 and to Defender for Business. Microsoft 365 Business Premium includes Defender for Business and Intune Plan 1.

Does Windows encrypt USB drives automatically? No. Microsoft states that device encryption covers the operating system drive and fixed drives, not external or USB drives. Apply BitLocker to removable drives, and consider the policy that denies write access to unprotected drives.

Should we disable AutoPlay? CSA suggests disabling AutoRun and AutoPlay or setting them to prompt for action, so nothing on a drive runs or opens automatically.

Can staff use personal USB drives at work? CSA advises keeping work and personal drives separate. Issue company drives for genuine needs and use cloud sharing links for everything else.