The marketing department wants to distribute pens with embedded USB drives to clients. In the past this client has been victimized by social engineering attacks which led to a loss of sensitive…

USB drives can carry malware that auto-executes when plugged in, and can be used to copy and remove large volumes of sensitive data from an organization's systems. The concealable nature of USB drives means that clients or malicious insiders can use them to exfiltrate data without detection, which is especially concerning given this client's history of social engineering attacks that resulted in data loss. Distributing them widely increases the attack surface considerably.

The ongoing security costs of managing distributed USB drives are a minor operational consideration compared to the primary concern, which is the direct security risk they pose as data exfiltration or malware delivery vectors.

The financial cost of producing and distributing the USB pens is a marketing budget concern, not a security risk, and would not be a basis for a security administrator's advice.

Combining USB drives with cell phones on a network is not a recognized specific security threat; the actual risk is the standalone capability of USB drives to carry malware or exfiltrate data regardless of cell phone presence.