Disable Autorun and Autoplay for Removable Media
Description
Disable autorun and autoplay auto-execute functionality for removable media.
Implementation Checklist
Tool Recommendations
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
Cloud-native endpoint protection platform with next-gen AV, EDR, threat intelligence, and managed hunting
CrowdStrike · Per-endpoint subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
USB-Based Malware Auto-Execution
IntegrityMalware-laden USB devices automatically execute malicious payloads when inserted into systems with autorun enabled, a technique used in targeted attacks (Stuxnet-style) and opportunistic campaigns where infected USB drives are distributed in public areas.
Removable Media Worm Propagation
AvailabilitySelf-propagating worms spread across the enterprise via removable media by leveraging autorun functionality to copy themselves to every USB device inserted, then executing automatically on each new system the device connects to.
Social Engineering via Dropped USB Devices
ConfidentialityAttackers deliberately leave infected USB drives in parking lots, lobbies, or conference rooms, and autorun functionality causes malicious payloads to execute immediately when curious employees insert the devices into their workstations.
Vulnerabilities (When Safeguard Absent)
Autorun and Autoplay Enabled on Enterprise Assets
Windows autorun and autoplay features remain enabled at default settings, allowing removable media to automatically execute programs, scripts, or installers without requiring explicit user action beyond inserting the device.
No Group Policy Enforcement Disabling Auto-Execute
Group policies or configuration management tools have not been configured to disable autorun and autoplay across all enterprise assets, leaving systems vulnerable to automatic execution of removable media content.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |