<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Arial","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D">I want to give a +1 to Chad’s comment about running with a more open approach.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D">Here, we only lock down our computers enough to prevent the public from disabling/circumventing our time limit software and our deepfreeze-like software. I too have come to the
conclusion that it’s not worth the time and cost to try to lock out the one in 200 who is going to try to do something and annoy several of those other patrons in the meantime.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D">Besides that, even if they do get past our defenses and blow up the installation, I can reimage the computer and have it back in service in about 30 minutes, and only about 5
of those minutes require my presence.. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D">Have a good day.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D">Joe<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D">Joseph Knueven<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D">Director<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D">Germantown Public Library<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D">51 N. Plum St.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D">Germantown, OH 45327<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D">937-855-4001<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1F497D">joe@gtownlibrary.net<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> oplintech-bounces@lists.oplin.org [mailto:oplintech-bounces@lists.oplin.org]
<b>On Behalf Of </b>Chad Neeper<br>
<b>Sent:</b> Monday, August 17, 2015 11:18 AM<br>
<b>To:</b> OPLINTECH<br>
<b>Subject:</b> Re: [OPLINTECH] patron USB drive<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">It sounds like you're already doing pretty much all you can do. You've disabled boot from USB in the firmware config and disabled autorun in Windows. I'm not sure there's much more you can do without disallowing USB devices entirely.
I assume you Deep Freeze...<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I suppose one more thing you could do would be to make use of a white-list type manager that would disallow any executables from USB devices except what's white-listed. I think Faronics (makers of Deep Freeze) also has a white-list type
of tool. If you could prevent all executables from the USB devices, you might limit it to data storage only.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Personally, these days I tend to prefer a more open approach and let the patrons pretty much do what they will and rely on DF to restore the computer between patrons. For all the effort and money I might put into locking the computers down
and restricting usage to a completely controlled set of use cases, I could be driving dozens of patrons with legitimate needs away from the library for every one potentially malicious user I might prevent (or delay) from their nefarious doings...and then some
brilliant nine year old is going to negate the efforts in 30 seconds anyway. LOL!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<div>
<p class="MsoNormal">______________________________<br>
<b>Chad Neeper</b><br>
<span style="font-size:7.5pt">Senior Systems Engineer</span><br>
<br>
<b>Level 9 Networks</b><br>
<span style="font-size:7.5pt">740-548-8070 (voice)<br>
866-214-6607 (fax)</span><br>
<br>
<i><span style="font-size:7.5pt">Full IT/Computer consulting services -- Specialized in libraries and schools</span></i><o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Mon, Aug 17, 2015 at 8:47 AM, Kevin Jones <<a href="mailto:kjones@coshoctonlibrary.org" target="_blank">kjones@coshoctonlibrary.org</a>> wrote:<o:p></o:p></p>
<div>
<p class="MsoNormal">Hello everyone,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">A patron recently forgot a USB drive in one of our computers. After looking at it to discover the owner, I found that it was made into a portable gaming USB drive that had Technic Launcher on it for Minecraft. After reading about this,
it allows them to install and manage modpacks for Minecraft.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I don't allow the USB drives to be bootable at startup or to autorun in order to keep patrons from getting past PC Reservation without logging in. I am not very familiar with the online gaming stuff, so I was wondering if there was any
security issues with allowing patrons to continue using USB devices in this manner?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Is there a way to keep portable OS devices and game launching devices form working without stopping the use of USB drives for saving files or opening Word docs and the like? <br clear="all">
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><img border="0" id="_x0000_i1025" src="http://www.coshoctonlibrary.org/images/signature.jpg"><o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
OPLINTECH mailing list<br>
<a href="mailto:OPLINTECH@lists.oplin.org">OPLINTECH@lists.oplin.org</a><br>
<a href="http://lists.oplin.org/mailman/listinfo/oplintech" target="_blank">http://lists.oplin.org/mailman/listinfo/oplintech</a><br>
<br>
<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>