Data Security > Removable Media > USB DLP

USB Data Loss Prevention: Stop Unapproved Devices and Protect Approved Drives

USB security has two separate jobs. First, prevent unknown storage devices from reaching a computer. Second, protect confidential files placed on a drive that employees are allowed to use. This guide explains both layers and shows where USB Block and USB Secure fit.

Editorial Team • Updated: July 18, 2026 • 18 min read
Quick Answer

Can software stop USB data leakage? Yes, but one product rarely covers every route. USB Block is the relevant option when the goal is to deny unapproved removable devices on Windows computers. USB Secure addresses a different risk by protecting files carried on an approved USB drive or external disk. A stronger policy uses endpoint control and portable-data protection together.

USB security software protecting a Windows computer from unauthorized removable media

Inside this guide

USB DLP Starts by Separating Two Risks

A removable drive can create an outbound risk when someone copies company data to a personal device. It can also create an at-rest risk when an approved drive containing private files is lost, stolen, or borrowed. These scenarios need different controls.

Endpoint access control decides which devices the computer will accept. Portable-data protection controls who can open the information after it has been written to the drive. Confusing the two leads to gaps, such as encrypting an approved drive while leaving every unknown drive free to connect.

Office data loss scenario showing confidential files moving to removable media

Assess your USB data risk

USB flash drive used to assess removable media security risks

1. Can users currently connect personal storage devices to managed computers?

2. Are files on approved portable drives protected if the device is lost?

3. Are device access attempts reviewed or logged?

Calculating...

Four Practical Ways to Reduce USB Data Loss

The right method depends on whether the priority is blocking devices, protecting data on a permitted drive, or enforcing both.

Method 1

Windows Device Policies

Built-in Administration
Windows USB port blocked by an endpoint device policy

Windows administrators can restrict removable storage, deny write access, or disable selected device classes through policy. This is useful for domain-managed environments that already have centralized administration.

Trade-off: Policy settings control the computer but do not automatically protect files after they are copied to an allowed drive. Remote or unmanaged machines may also fall outside the policy boundary.

Method 2

USB Block for Endpoint Access Control

Windows Device Control
Unauthorized external storage devices restricted from a Windows computer

USB Block installs on the Windows computer and challenges unapproved storage devices before granting access. Trusted devices can be placed on an allow list, while removable storage, optical media, selected network locations, and non-system drives can be controlled by category.

Best fit: Homes, offices, labs, and small organizations that need a straightforward rule: approved devices work, unknown devices do not.

Method 3

USB Secure for Data Carried on Approved Drives

Portable Drive Protection
Secure virtual drive for opening protected files on portable media

USB Secure is placed on a flash drive, memory card, or external storage device. The user creates a password and protects the contents so ordinary browsing does not expose the secured files. A virtual-drive option allows access without fully returning all protected content to normal visibility.

Best fit: People who must carry private files between Windows computers and want the protection to remain with the drive.

Method 4

Full-Volume or Hardware Encryption

Encrypted Media
Locked removable drive representing full-volume and hardware encryption

BitLocker to Go and hardware-encrypted drives protect an entire removable volume. These options can be appropriate when formal key management, tamper-resistant hardware, or integration with an existing Microsoft environment matters more than simple portability.

Trade-off: Compatibility, recovery, procurement cost, and user training vary widely. Test the exact workflow before issuing drives at scale.

USB Block and USB Secure Solve Different Problems

They are complementary products, not interchangeable versions of the same control.

Protect the computer

USB Block

USB Block software boxshot for Windows endpoint device control

Designed for Windows endpoints where the owner or administrator needs to decide which connected devices may access the machine.

  • Prompts for authorization when an unknown device is accessed.
  • Remembers approved devices through an allow list.
  • Covers several drive categories beyond ordinary flash storage.
  • Records invalid password, removal, and uninstall attempts.
  • Includes Safe Mode protection and an optional hidden operating mode.

Important: Installation requires administrator privileges, and protection is tied to each Windows computer where the software is installed.

Explore USB Block →
Protect the portable data

USB Secure

USB Secure software boxshot for password-protected portable drives

Designed for approved portable media whose contents should remain private when the device is moved, misplaced, or used on another Windows computer.

  • Runs from the portable device after initial setup.
  • Uses password-controlled access for protected content.
  • Can present secured files through a virtual drive.
  • Does not require administrator rights on the Windows host used for access.
  • Offers optional owner information, autoplay settings, and a master key.

Important: It does not block other USB devices from connecting to a PC and should not be described as endpoint port control.

Explore USB Secure →

USB Security Options Compared

Choose according to the security outcome, not the product name.

USB Secure application interface for protecting files on portable drives
Decision Point USB Block USB Secure Windows Policy BitLocker to Go
Primary purpose Control device access to a PC Protect files on a portable drive Enforce operating-system rules Encrypt a removable volume
Where it operates Installed Windows endpoint Configured portable device Windows policy layer Encrypted drive volume
Unknown-device blocking Yes, by selected categories No Yes, when correctly configured No
Protects a lost approved drive No Yes, when locked No Yes, when locked
Admin rights Required for installation Not required on the Windows host Administrator-managed Administrator or policy dependent
Best use Allow-listing devices on PCs Carrying private files Managed Windows fleets Microsoft-centered encrypted media

Choose the Control That Matches the Risk

For a page focused on stopping USB data leakage from Windows computers, USB Block is the closer product match. For files that must legitimately travel on removable media, add USB Secure or another approved encryption method.

Approved USB drive shown on a trusted-device allow list

Layered USB Policy

ENDPOINT: Unknown storage denied

USB Block controls which devices may reach the Windows computer.

APPROVED DRIVE: Protected while mobile

USB Secure protects information on a permitted portable drive.

View USB Block → View USB Secure

Platform Support, Pricing, and Important Limits

Windows compatibility illustration for USB security software

Windows-Focused Products

The supplied documentation lists Windows 7, 8, 10, and 11 plus selected Windows Server releases from 2008 through 2019. Native macOS, Linux, Android, and iOS editions are not listed. Phones may appear as connected storage, but that does not make the software a mobile app.

File-System Claims Need Testing

USB Secure documentation consistently names FAT32 and NTFS, while some marketing material also refers to FAT and exFAT. Test the exact drive format, size, and Windows build before moving the only copy of important data.

Different Update Histories

The research snapshot records USB Secure version 3.0.0 in October 2025. USB Block's listed history reaches version 1.8.1 in April 2022. Organizations should confirm current Windows compatibility and support status before a large rollout.

Trial and Paid Editions

Both products are presented with evaluation access and a paid full version. The full edition removes trial restrictions. Because the provided material does not show a dependable checkout amount, publish a link to current pricing rather than a hard-coded figure.

Security boundary: USB Block is not a content-classification engine, and USB Secure is not a device-control platform. Neither replaces antivirus, endpoint detection, secure backups, or a documented incident process.

A Safer USB Deployment Checklist

Step-by-step USB security deployment and policy checklist
  1. Inventory the need. Identify who genuinely requires removable media and what types of information may be transferred.
  2. Deny by default where practical. Use Windows policy or USB Block to stop personal devices from becoming an unmonitored copy path.
  3. Approve named devices. Add only organization-owned drives to the trusted list and review that list after staff or hardware changes.
  4. Protect approved media. Configure USB Secure, BitLocker to Go, or an equivalent control before sensitive files are placed on the drive.
  5. Prepare recovery. Enable a master key where appropriate, store it separately, and document who may use it.
  6. Keep another copy. Password protection is not a backup. Maintain a verified copy in approved storage before changing protection settings or reformatting a drive.
  7. Review logs and exceptions. Investigate repeated password failures, uninstall attempts, and requests to authorize unfamiliar devices.

Threats These Controls Do and Do Not Address

Data Exfiltration

Blocking an unapproved storage device can stop an easy copy path. It does not stop someone from sending a file through email, cloud storage, messaging, screenshots, or another network channel. A full DLP program must cover those routes separately.

Lost or Stolen Media

Portable-drive protection reduces exposure only while the protected content remains locked. Once a user opens the files on a compromised computer, malware or another local user may still capture them.

BadUSB and Non-Storage Devices

A malicious USB device may pretend to be a keyboard, network adapter, or another trusted class instead of ordinary storage. Do not assume storage-drive controls alone stop every firmware-based USB attack. High-risk environments need broader device-class restrictions and endpoint monitoring.

USB malware prevention and removable-device threat protection

Layered Coverage

1. Device admission
2. Approved-device list
3. Portable-data protection
4. Malware defense
5. Logging and review
6. Backup and recovery

Common Product and Deployment Questions

USB Secure interface showing protected portable drive security options

USB Secure password is no longer available

Try the optional master key only if it was enabled in advance. Do not delete, format, or run recovery utilities against the drive until you have preserved a complete backup image and reviewed vendor guidance. A forgotten password is not the same as a lost registration key.

A trusted drive keeps triggering USB Block

Confirm that the exact device was added to the authorized list and that the relevant category remains enabled. Re-authorize the device after hardware replacement, major Windows changes, or a clean installation. Review the activity log for failed prompts or blocked access.

Protected files were left open before removing the drive

Close the files, return the protected area to its locked state, and eject the device through Windows before unplugging it. Sudden removal can damage open files even when access control is working correctly.

Frequently Asked Questions

USB Block protects a Windows computer by refusing access to removable devices and other selected drive categories unless they are approved. USB Secure protects information already stored on a configured portable drive by placing it behind password-controlled access.

No. USB Secure is designed for the contents of a specific portable drive. Preventing an unapproved drive from connecting to a computer is the role of USB Block, Windows device policy, or a broader endpoint-control platform.

No. Its main job is access control at the computer. Once an approved drive is allowed, files placed on that drive need a separate protection method such as USB Secure, BitLocker to Go, or a hardware-encrypted device.

The supplied product documentation lists Windows desktop and Windows Server editions. It does not present native macOS or Linux support, so mixed-platform teams should test another solution before standardizing.

USB Block needs administrative permission when it is installed on the protected computer. USB Secure is designed to run from the portable device without requiring administrator access on the Windows computer used to open it.

An optional master key can provide a second access path, but it must be configured before the primary password is lost. Keep that recovery credential outside the protected drive. Without a working password or prepared recovery method, the protected data may remain unavailable.

Both products are offered with evaluation access and paid full editions. The supplied research does not establish a fixed checkout amount, so confirm current pricing, taxes, and license terms on the official order page.

No. Device blocking and portable-drive protection solve specific parts of the problem. Malware scanning, content inspection, incident response, backups, and user policy still require separate controls.

Our Verdict

For preventing unknown drives from becoming a copy route on Windows PCs, USB Block is the more relevant recommendation. For securing files on organization-approved portable media, USB Secure fills the second layer. Teams with meaningful USB exposure should combine device control, protected media, backups, and monitoring rather than relying on one feature.

Review USB Block → Review USB Secure →