Removable Media Security and Access Control

Troy University manages the use of removable storage media as part of its information security and data protection program. This control supplements the requirements established by Troy University ePolicy 804.2, Encryption, which requires appropriate encryption safeguards for portable drives and other devices that may store or access TROY Protected data.

Information Technology uses centrally managed endpoint security controls, including ThreatDown, to monitor and manage access to USB storage devices on University-managed systems. Removable storage restrictions are applied based upon the security requirements, data sensitivity, and operational needs of the applicable systems and departments.

USB storage restrictions are implemented in areas where the sensitivity of information or associated risk warrants additional controls. These restrictions extend beyond financial operations and are not limited to a single department. However, universal prohibition of removable storage is not currently employed across all University systems because legitimate use of removable media may be necessary within TROY’s academic, instructional, research, and administrative environments.

Information Technology maintains the capability to restrict or limit removable storage access through centrally managed security controls. Access to removable storage may be granted based upon documented business, academic, instructional, research, or technical need. Requests for access are reviewed by appropriate Information Technology personnel, and access may be limited to specific users, systems, devices, or other appropriate parameters based upon the identified need and associated risk.

Removable media activity is subject to monitoring and audit through the University’s endpoint security environment. Information Technology may periodically review removable storage access and may modify or revoke access when the business or academic need no longer exists, when the security risk changes, or when use is inconsistent with University policy.

When removable media is used to store or access TROY Protected data, the encryption and data-protection requirements established by ePolicy 804.2 apply. University personnel are expected to use removable storage only for legitimate University purposes and in a manner consistent with applicable information security, data protection, and acceptable-use requirements.

These controls provide a risk-based approach to removable media security that balances protection of University information with the operational requirements of a diverse academic and instructional environment.