Universal Serial Bus (USB)

USB is a host-driven bus that supports hot-plugging. One host controller, usually the computer, manages up to 127 connected devices through a tiered star of hubs. Devices can be connected and removed without a reboot. The bus also delivers power, so the same cable that moves files can charge a phone.

The part that matters for security is enumeration. When a device connects, it reports a set of descriptors to the host: a vendor ID and product ID (together known as VID:PID), a serial number if the manufacturer assigned one, and a device class. The class tells the operating system what kind of device the hardware claims to be, such as storage, keyboard or phone, and a matching driver loads automatically. These attributes travel with the device, so device control policies can match against them.

Each USB version raises transfer speed and power delivery and stays backward compatible. An older device still works in a newer port, but at the older speed. For data leak planning, the signaling rate is what matters, because it sets how fast data can move. At USB 3 speeds, hundreds of gigabytes fit on hardware the size of a thumb.

Marketing names have changed over the years. USB 3.0, 3.1 Gen 1 and 3.2 Gen 1 all describe the same 5 Gbps tier.

USB is essential business infrastructure. It carries keyboards and headsets, receipt printers and scanners, dongles, phone tethering and charging. It also moves large files on removable media between disconnected networks. Blocking the bus outright is rarely practical.

The same port is a leading data exfiltration channel. A transfer to a flash drive leaves no network trace, works offline, and moves very large volumes quickly. The media is easy to hide or lose. An unencrypted drive left outside the office can become a reportable data leak. That is why USB control is usually about policy granularity, not an on/off switch.

The protocol and the plug are separate choices. One version can run over several connector shapes, which is why a drawer of cables rarely matches on the first try.

USB-C is becoming the single standard port on docks and chargers. Micro-B still appears on many compact devices.

• USB-A: the original rectangular host port. Not reversible, still common on desktops.
• USB-B, Mini-B, Micro-B: square and small connectors on printers, drives, and older phones.
• USB-C: a small reversible oval that carries data, up to 240 W of power and video through Alternate Modes.

Storage is not the only risk on the port. In a BadUSB attack, the controller inside a device is reprogrammed to enumerate as something else, usually a keyboard. The device then types commands on the host. The OS trusts HID input, so the injection is hard to tell apart from real typing. Code in the firmware can survive a reformat.

Related threats are more mechanical than technical. Infected drives are left where employees will find and plug them in, and public charging points can abuse the data lines. The defenses follow from the design: control which device classes may connect at all, judge devices by VID:PID and serial number rather than appearance, and treat an unknown device as unknown, however harmless it looks. Endpoint controls such as endpoint DLP apply these rules on each workstation.

The class reported during enumeration decides which driver loads, what the device can do and how much trust the operating system gives it. Flash drives and external disks are the portable storage devices most people picture, but the list is wider. CDC and vendor-specific classes are routinely legitimate, but occasionally they serve as a covert path.

In USB and external drive control, the administrator decides which devices can connect and what they may do. The first frame shows the device audit switches on an agent profile. The second frame shows a device with its vendor ID, product ID, and serial number, the identity that rules match against.

1 / 2

• 
• 

Start with the ports and device classes that carry the most data, then decide which ones need full access, read-only access or no access at all. A single rule for every port usually ends up blocking keyboards and printers, and then it gets switched off.

Keep the decision in policy rather than in habit: an approved drive should be recognized by its identity, and an unknown one should be refused until someone reviews it.

Further reading: How to prevent unauthorized access to your computer.