1. In a computing device executing a hypervisor hosting a trusted virtual machine and a non-trusted virtual machine, a method for allocating a universal serial bus (USB) device to one of the trusted virtual machine and the non-trusted virtual machine, comprising: receiving, by a control program executed by a processor of a computing device, data indicating a USB port on the computing machine received a USB device; identifying, by the control program, at least one attribute of the USB device; selecting, by the control program based on application of a policy to the identified at least one device attribute, one of a trusted virtual machine executing on the computing device and a non-trusted virtual machine executing on the computing device; and granting, by the control program to the virtual machine selected by the control program, access to the USB device.