Citadel / Controls / RemovableStorage

RemovableStorage Control

What does this control check?

The RemovableStorage control verifies that no USB storage devices (flash drives, external hard drives, USB SD card readers, etc.) are currently connected to your computer. This control helps prevent data loss and malware infections.

Important: USB storage devices pose two major security risks. First, they can introduce malware to your computer - even trusted-looking USB drives can be infected or deliberately weaponized to install malicious software when plugged in. Second, they make it easy to copy and remove sensitive company data, either accidentally or intentionally. A single USB drive can hold thousands of documents that could then be lost, stolen, or leaked.

Why is this important?

🦠

Malware Distribution

USB devices are a common malware distribution method. Infected drives can automatically run malicious code when connected, compromising your computer before you even open any files.

📤

Data Exfiltration

USB drives make it trivially easy to copy large amounts of sensitive data from your computer. Lost or stolen drives containing company data can lead to serious security breaches.

🔓

Unencrypted Storage

Unlike your encrypted hard drive, most USB drives are not encrypted. If lost or stolen, anyone can read the files on them without any password or authentication.

How to fix this

Removing USB Storage Devices on Windows

Step 1: Identify connected USB storage devices

  1. Click the Start button and select Settings
  2. Click System
  3. Click Storage
  4. Look under "Storage devices" for any external drives
  5. Note which drives are USB devices (they'll often show as "Removable Disk" or have a drive letter like D:, E:, etc.)

Step 2: Safely eject the USB device

  1. Click the Show hidden icons arrow in the system tray (bottom-right corner)
  2. Click the USB icon (Safely Remove Hardware)
  3. Click on the device you want to remove
  4. Wait for the "Safe to Remove Hardware" message
  5. Physically unplug the USB device from your computer
Alternative: You can also right-click on the drive in File Explorer and select Eject.
⚠️ Important notes:
  • Always eject USB devices properly before unplugging to avoid data corruption
  • Use cloud storage approved by your organisation (e.g. Google Drive, OneDrive, SharePoint) instead of USB drives for file transfer
  • If you must use a USB drive temporarily, remove it as soon as you're done
  • Never use unknown or found USB drives - they may be deliberately infected

Removing USB Storage Devices on macOS

Step 1: Identify connected USB storage devices

  1. Look at your Desktop - USB drives typically appear as icons
  2. Open Finder and check the sidebar under Locations
  3. External drives and USB devices will be listed there

Step 2: Safely eject the USB device

  1. In Finder, find the USB device in the sidebar
  2. Click the eject icon (⏏) next to the device name
  3. Wait for the device to disappear from the sidebar and desktop
  4. Physically unplug the USB device from your Mac
Alternative methods:
  • Right-click the device icon on the desktop and select Eject
  • Drag the device icon to the Trash (it will change to an eject symbol)
⚠️ Important notes:
  • Always eject USB devices properly before unplugging to avoid data corruption
  • Use cloud storage approved by your organisation instead of USB drives for file transfer
  • If you must use a USB drive temporarily, remove it as soon as you're done
  • Never use unknown or found USB drives - they may be deliberately infected
  • If you see "The disk wasn't ejected properly" warning, you unplugged too soon

Removing USB Storage Devices on Linux

Identify and unmount connected USB storage

lsblk -o NAME,TRAN,MOUNTPOINT

Devices with TRAN = usb are USB storage. Unmount and detach one cleanly with:

udisksctl unmount -b /dev/sdX1
udisksctl power-off -b /dev/sdX

then physically unplug it. Most desktop file managers also offer an "Eject" action for the same effect.

Enforcing this org-wide

If USB storage should be restricted for everyone rather than removed ad hoc, the standard Linux tool is USBGuard, which lets you allow/block USB devices by policy. Ask your IT/security team whether this is already deployed before installing it yourself.

⚠️ Important notes:
  • Always unmount before unplugging to avoid data corruption
  • Use organization-approved cloud storage instead of USB drives for file transfer
  • Never plug in unknown or found USB drives — they may be deliberately infected

Verifying the fix

After removing all USB storage devices, Citadel will automatically verify this control during its next check.

To verify no USB storage devices are connected:

  1. Open File Explorer
  2. Click This PC in the left sidebar
  3. Check under Devices and drives
  4. You should only see your main hard drive (usually C:)
  5. Any drives labeled as "Removable Disk" or external drives indicate connected USB storage

Alternative: Open Settings → System → Storage and check that no external storage devices are listed.

To verify no USB storage devices are connected:

  1. Check your Desktop - no external drive icons should be visible
  2. Open Finder
  3. Look at the sidebar under Locations
  4. Only your main hard drive (Macintosh HD) and network locations should appear
  5. If you see any external drives or USB devices, they need to be ejected

Alternative: Click the Apple menu → About This Mac → Storage (or System Report → Hardware → USB) to see all connected devices.

To verify no USB storage devices are connected:

lsblk -o NAME,TRAN,MOUNTPOINT

No device should show TRAN = usb.