USB sticks and external drives
Updated 9 November 2026 · Security
Handy, easy to lose, and a classic way for malware to get in. When they are fine to use, when they are not, and the better alternatives.
USB sticks and portable hard drives have been in offices for twenty years, and they still cause more than their share of problems. They are small enough to lose, they are rarely encrypted, and they are a well-worn way of carrying malware from one computer to the next. A few habits reduce the risk a lot.
Do not plug in what you did not buy
A USB stick found in the car park, handed over at a trade show or sent in the post with a glossy brochure may have been planted. Attackers have used this trick for years because it works: people are curious. If you receive or find a USB device and do not know exactly where it came from, give it to us rather than plugging it in.
Sharing files: use a link instead
For moving files between colleagues, customers or suppliers, a sharing link from OneDrive or SharePoint is safer and more convenient than a stick: it cannot be lost on a train, you can see who opened it, and you can revoke it. Our article Sharing files safely from OneDrive and SharePoint explains how.
If you must use one
Use a drive your business bought new. Encrypt it: Windows Pro can do this with BitLocker To Go, and a Mac can encrypt an external drive in Disk Utility, so a lost drive is useless to whoever finds it. Keep business files on it only as long as the job needs, then move them back to OneDrive or SharePoint and remove them from the drive. Never keep the only copy of anything on a portable drive; they fail without warning and they are not backed up.
External drives as backup
A portable drive left plugged into a computer is not a safe backup. Ransomware encrypts it along with everything else, and a fire or theft takes both. If a local backup is part of your plan, we set it up properly, with a copy offsite as well; see The 3-2-1 backup rule.
Defender scans them
On managed computers, Microsoft Defender checks removable drives when they are connected. If it finds something, it quarantines the file and we see the alert. Tell us if that happens, and tell us where the drive came from.
Disposing of a drive
Deleting files does not remove them. When a drive is retired, give it to us: we wipe it securely or destroy it, and record that it was done. See Disposing of old computers, phones and drives.
Was this helpful?