Educate your users Flash Drives are already the "must have" toy for the gadget junkies, and as prices continue to fall, they are becoming the premium corporate promotional giveaway of choice. You can't stop the tide, but you can educate your users early on as to the risks these devices can present, and establish a policy for taking data out of the office, or bringing files in from home.
Educate your security personnel If your security guards caught an unauthorized person walking through your corporate offices, would they know what to look for? Flash Drives are so small and unobtrusive, they are easily concealed and could even slip by unnoticed in plain sight. The people in charge of physical security for your environment need to know what these devices look like, how they work, and what risks they present. You may also wish to consult your legal department as to the legalities of searching and seizing these devices if found.
Enforce the lock desktop policy Many companies already configure their desktops to automatically lock when unattended for a few minutes, but often this interval is set anywhere from 10 - 20 minutes. In higher risk environments this should be 5 minutes or less. Yes, it's annoying and your users will hate it for the first few months, but it's essential for any workstation where a user account has access to sensitive data.
Update the antivirus policy You should configure antivirus software to scan all attached drives and removable media, and get your users into the habit of scanning files before opening them.
Use only secure devices
If your company issues these devices to employees or approved them for purchase, make sure you include devices with security features for users that have access to potentially sensitive data. (accounting, payroll, legal, sales, R&D, etc.) Be sure to enforce the use of the security features in these devices and train your users if necessary.
Include return information In the event your flash drive is lost or misplaced, including a small readable text file that includes return information could help you get it back. You may want to consider NOT including your company name in the file, and simply refer to a phone number or P.O. Box. You may also want to include a legal disclaimer that clearly identifies the information on the drive as confidential and protected by law.
Restrict the USB ports on desktops
You can't manage USB devices using Group Policy in Windows 2000/XP, but you can disable the USB ports or use 3rd party tools. When disabling USB ports, you'll need to make sure any peripherals in use (such as keyboards, mice, PDAs, and scanners) use legacy ports instead of USB ports. In most corporate networks, printers are assigned to specialized network print servers and may not be an issue. A more feasible compromise would be to only lock out desktops that have access to sensitive data, or are in areas accessible to the public. (i.e. a bank's branch office PCs should have USB ports disabled, but the secured corporate office is less of a risk.) 3rd party software allows businesses to control end-user access to I/O devices such as the floppy drive, Memory-sticks, PDAs, USB external storage, CD-ROM, serial and parallel ports, as well as many other Plug and Play devices.