Public servants allowed to use only authorised USB storage devices at work from July 25

SINGAPORE — From July 25, only authorised USB storage devices will be allowed for use at all public sector agencies as part of continuing efforts to beef up cyber security, the Government Technology Agency of Singapore (GovTech) said on Friday (July 14) in response to TODAY’s queries.

The agencies will be tapping on a bulk tender which has a list of portable storage devices that meet its security requirements. The devices will be distributed to public officers on a “working need basis”, a GovTech spokesperson said.

“Globally, USB storage devices continue to be a means to introduce malware and exfiltrate data, especially when they have the potential to be easily misplaced,” the spokesperson added.

The Government constantly reviews its IT security policies in response to emerging cyber threats, so that its information technology networks and data remain secure. In light of the latest move, GovTech said that several IT solutions, such as file transfer tools, have been deployed to Government agencies to “maintain public sector productivity”.

“We will continue to educate all public officers on the evolving cyber-risks and stay responsive and alert to the cyber threat landscape,” said the spokesperson.

Public servants told TODAY they were briefed by their superiors about the new measure a few weeks back. Some divisions within the ministries, for example, will get one USB device each, to be shared among the staff, they said.

TODAY understands that authorised USB storage devices are already in use by some public servants, especially those requiring high-level clearance because of the sensitive data which they are dealing with.

The latest measure comes two months after TODAY had reported that teachers will no longer be able to access certain government-wide applications on their work laptops.

Instead, they have to use separate terminals to tap into the government intranet, human resources portal and GeBiz, among others.

The Government has also implemented an Internet separation policy, where public servants would no longer be able to access the Internet from their work computers. They would have to use Internet-enabled devices - government-issued tablets or common computers - to go online.

On disallowing the use of unauthorised USB storage devices at work, Mr Tony Jarvis, chief strategist for threat prevention at cyber security firm Check Point Software Technologies, said this would reduce the public sector’s exposure to potential cyber threats given that these devices have been used as an “entry point” for major attacks.

He noted that people often use their personal USB devices to store music or movie files which may have been downloaded from unsecure avenues and contain malware. When the same personal USB devices are used at the office, the malware could be transferred to their work computers, he added.

“Most of us will use such devices as a quick and easy method of transporting or sharing files between systems, without giving much thought as to the potential hazards,” he said.

Some public servants - who declined to be named - said that while they understood the rationale for the new measure, it could slow down work processes even more. A civil servant, who declined to be named, said that he and some of his colleagues have to do “double work” because of the Internet separation policy.

“We can’t do research on our work computer... we download the research papers which we need to refer to from our personal laptops and transfer them to our work computers,” said the 30-year-old. “And soon, the use of personal USB devices won’t be allowed. I understand it’s for security, but it doesn’t make our job easier.”

A senior officer, who is working at the Ministry of Manpower, pointed out that the cyber security measures “can be quite of a hassle”, and require an “exercise of patience”.

Nevertheless, another officer from the Ministry of Education reiterated that the latest measure is necessary - there is “no point having Internet separation” if threats could be introduced via external devices, she pointed out.

“For the measures to be congruent, I think it’s necessary to make sure every single (preventive measure) is in place,” said the officer, who is in her late 20s.