Questions: USB and Portable Device Security

Question 1

A colleague finds a USB drive in the company parking lot labeled 'HR Salaries Q4' and plugs it into their work computer to see what's on it. Which type of threat does this primarily illustrate?

• A. A software vulnerability in the USB protocol that attackers exploited remotely
• B. Social engineering — the attacker uses human curiosity as the attack vector, not a software exploit
• C. Weak file system permissions that allow unauthorized programs to run
• D. An unpatched operating system that cannot detect malicious storage devices

Answer: (B)

This is a classic 'baited drive' social engineering attack. The attacker deliberately leaves an infected drive in a plausible location with an enticing label. The attack exploits human behavior — curiosity and helpfulness — not any specific software vulnerability. Even if the computer is fully patched, plugging in the drive may trigger autorun execution or the user may manually open files. The safe rule is absolute: never plug in a drive you did not purchase or format yourself.

Question 2

An employee deletes sensitive files from a USB drive and then loses the drive. How secure is the deleted data?

• A. Fully secure — deletion permanently removes data from the drive's storage cells
• B. Not secure — deletion removes only the directory entry; recovery software can retrieve the actual file data
• C. Partially secure — files smaller than one cluster are irrecoverable, larger files are at risk
• D. Secure if the files were deleted more than 24 hours ago, as drives overwrite deleted sectors automatically

Answer: (B)

File deletion removes the pointer (directory entry) that tells the OS where the file is stored, but the actual data bytes remain on the drive until overwritten by new data. Standard file-recovery tools can reconstruct deleted files from these remaining bytes. To truly erase sensitive data, you must securely wipe the drive (overwrite every sector with random data) or use full-drive encryption from the start — so that even recovered bytes are unreadable without the decryption key.

Question 3

Disabling the autorun feature on your operating system eliminates most security risks from plugging in an unknown USB drive.

• T. True
• F. False

Answer: False

Disabling autorun closes one specific attack vector — the automatic execution of malware when a drive is connected. But it does not eliminate all risks. A user can still manually browse and open malicious files on the drive. Some firmware-level USB attacks (e.g., BadUSB) do not rely on the file system or autorun at all — they make the drive impersonate a keyboard and type commands. Social engineering remains effective regardless of autorun settings. The only safe approach for unknown drives is not to plug them in at all.

Question 4

Removing a USB drive without using the 'safely remove' procedure can corrupt not just the file being written at that moment but the entire directory structure on the drive.

• T. True
• F. False

Answer: True

Operating systems use a write cache — data intended for the drive may be held in memory and written in batches for performance. 'Safely remove' flushes this cache and waits for all pending writes to complete before releasing the device. If you yank the drive mid-write, the file system metadata (which tracks where files are stored) may be partially written, leaving the directory in an inconsistent state. This can render the entire drive unreadable, not just the one file being written — a risk that the safe-eject habit eliminates at zero cost.

Question 5

Why is encrypting the entire USB drive more effective than simply deleting sensitive files when you want to protect data on a potentially lost drive?

Model answer: Deletion only removes the directory pointer; the actual data remains on the drive and is recoverable with standard software. Encryption transforms every bit on the drive into ciphertext that is unreadable without the decryption key. A thief who finds an encrypted drive sees only random bytes — even if they use file-recovery tools, they recover only encrypted garbage. Encryption protects data before the drive is lost, not after; it makes the drive's physical possession irrelevant to data security.

This is the core principle of 'encrypt-at-rest': assume the physical device will eventually leave your control (lost, stolen, or discarded), and make the data unreadable without a key you control. Secure deletion (overwriting) can also work, but it requires active effort after each use and doesn't protect data if the drive is stolen before you wipe it. Encryption-first is the correct default for portable media containing sensitive data.