South African Higher Education has gone through various changes and challenges, one of these being the merger process. Various Universities and Technikons were forced to merge in an effort to aid the transformation and restructuring of the Higher Education landscape in the post-apartheid era. From an ICT point of view, the merged Institutions ended up with massive and distributed computing facilities. These facilities must be managed and secured and it can be appreciated that the complexity and magnitude of this task is compounded by the large and varied user population (i.e. students) using the facilities. With the exploding use of mobile consumer devices (such as cell phones, personal digital assistants, MP3 players, portable storage devices such as flash drives, etc), Higher Education Institutions are faced with the even more complex task of managing and securing the computing infrastructure, while large numbers of students can enter computer labs and use these devices at random. In some circles, portable devices are touted to be the next panacea in higher education. This, together with the popularity these devices enjoy under the student body, makes it a fait accompli that mobile consumer devices are “here to stay”. Therefore, banning these devices from campus computer labs, is not viable. Universities have to find ways to address security issues through the implementation of appropriate protective measures. This research focuses on finding a solution to mitigating the risks imposed on Higher Education Institutions in South Africa caused by the use of portable storage devices. The research proposes a framework which serves as an outline for the countermeasures that Universities must implement to mitigate the risks inherent to the use of portable storage devices. The scope of the research is limited to flash drives, smart phones and MP3 players.