{"id":31628,"date":"2019-10-31T21:42:14","date_gmt":"2019-10-31T18:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\/"},"modified":"2019-10-31T21:42:14","modified_gmt":"2019-10-31T18:42:14","slug":"informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","title":{"rendered":"Information security of hardware solutions USB over IP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Recently shared <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/445094\/\">experience in searching for a solution to organize centralized access to electronic protection keys<\/a><\/noindex> in our organization. Comments raised serious concerns about the information security of hardware solutions for USB over IP, which also worries us.<\/p>\n<p>So, let's first clarify the initial conditions. <\/p>\n<ul>\n<li>A large number of electronic protection keys.<\/li>\n<li>Access to them is required from various geographical locations.<\/li>\n<li>We are only considering USB over IP hardware solutions and are trying to secure this solution by implementing additional organizational and technical measures (alternative options are not being considered for now).<\/li>\n<li>In this article, I will not detail the threats models we are considering (much can be seen in <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/422329\/\">the publication<\/a><\/noindex>), but I will briefly highlight two points. We exclude social engineering from the model and illegal actions by the users themselves. We consider the possibilities of unauthorized access to USB devices from any network without having standard credentials.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Information security of hardware solutions USB over IP\" src=\"\/wp-content\/uploads\/2019\/04\/19b201d89a6f7face278ad9e3159e388.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nTo ensure the security of access to USB devices, organizational and technical measures have been taken:<\/p>\n<p>1. Organizational security measures. <\/p>\n<p>The managed USB over IP hub is installed in a server cabinet that locks securely. Physical access to it is controlled (access control systems in the room, video surveillance, keys and access rights are held by a strictly limited group of individuals).<\/p>\n<p>All USB devices used in the organization are conditionally divided into 3 groups:<\/p>\n<ul>\n<li>Critical. Financial digital signatures \u2013 used according to banking recommendations (not through USB over IP)<\/li>\n<li>Important. Digital signatures for marketplaces, services, electronic document management, reporting, etc., several keys for software \u2013 used with the managed USB over IP hub.<\/li>\n<li>Non-critical. Several keys for software, cameras, a number of flash drives and disks containing non-critical information, USB modems \u2013 used with the managed USB over IP hub.<\/li>\n<\/ul>\n<p>\n2. Technical security measures.<\/p>\n<p>Network access to the managed USB over IP hub is only provided within an isolated subnet. Access to this isolated subnet is granted: <\/p>\n<ul>\n<li>from the terminal server farm, <\/li>\n<li>via VPN (certificate and password) to a limited number of computers and laptops, permanent addresses are granted through VPN.<\/li>\n<li>via VPN tunnels connecting regional offices.<\/li>\n<\/ul>\n<p>\nOn the fully managed USB over IP hub DistKontrolUSB, the following functions are configured using its native tools:<\/p>\n<ul>\n<li>Access to USB devices of the USB over IP hub employs encryption (encryption with SSL is enabled on the hub), although this may already be unnecessary.<\/li>\n<li>Configured 'IP address access restriction for USB devices.' Depending on the IP address, users are granted or denied access to designated USB devices.<\/li>\n<li>Configured 'USB port access restriction by username and password.' Accordingly, users are assigned rights to access USB devices. <\/li>\n<li>'Access restriction to USB devices by username and password' has not been implemented, as all USB keys are permanently connected to the USB over IP hub and are not rearranged from port to port. It makes more sense for us to give users access to the USB port with a device connected to it for an extended period.<\/li>\n<li>The physical turning on and off of USB ports is done:\n<ul>\n<li>For software and EDS keys \u2014 using the task scheduler and assigned tasks of the hub (a number of keys are programmed to turn on at 9:00 and off at 18:00, while others are from 13:00 to 16:00);<\/li>\n<li>For marketplace keys and certain software \u2013 by users with permissions through the WEB interface;<\/li>\n<li>Cameras, a number of flash drives and disks with non-critical information \u2013 are always turned on.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\n We believe that this organization of access to USB devices ensures their secure use:<\/p>\n<ul>\n<li>from regional offices (conditionally NET No. 1 \u2026\u2026 NET No. N), <\/li>\n<li>for a limited number of computers and laptops connecting USB devices through the global network, <\/li>\n<li>for users published on application terminal servers.<\/li>\n<\/ul>\n<p>\nIn the comments, I would like to hear concrete practical measures that enhance the information security of providing global access to USB devices.<br \/>\n<br \/>Source: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/448110\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0412 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u0431\u044b\u043b\u0438 \u043f\u043e\u0434\u043d\u044f\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0439 \u0432\u043e\u043f\u0440\u043e\u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u043d\u0430\u0441 \u0432\u0435\u0441\u044c\u043c\u0430 \u0431\u0435\u0441\u043f\u043e\u043a\u043e\u0438\u0442. \u0418\u0442\u0430\u043a, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u0441\u0435 \u0436\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043c\u0441\u044f \u0441 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u043c\u0438. \u0411\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043a\u043b\u044e\u0447\u0435\u0439 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u043d\u0438\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23546,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31628","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Information Security of USB over IP Hardware Solutions | ProHoster","description":"Recently, I shared my experience in searching for a solution to organize centralized access to electronic protection keys in our organization.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP | ProHoster","og:description":"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:14+00:00","article:modified_time":"2019-10-31T18:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31628","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:05:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:13:29","updated":"2026-01-21 07:05:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=31628"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/31628\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/23546"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=31628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=31628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=31628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}