We would like to block write permissions to USB drives. We will allow user read-only permissions to the USB drive.
By doing that, do we still allow the Antivirus to scan the USB drive and delete, if needed, the potential virus found?
-
It might help to explain why you want to make the USBs read-only, and in particular is this for some "security driven" reason. From a "protect the PC/network" point-of-view, I can't see a positive benefit: your AV (probably) cannot delete any threat it finds, and being read-only won't stop an infection/threat spreading from the USB drive to the PC/network.– TripeHoundJul 18, 2019 at 9:30
-
The major purpose of the restriction is to prevent sensitive data extraction from employees. But we want to avoid generate other risks by doing so (exemple, virus propagation )– RokhoJul 18, 2019 at 10:02
Add a comment
|
1 Answer
No. If the USB port only allows reading, then Anti-virus cannot delete the file from the drive.
But it might not have to. AV can simply block the file from being run. The virus will still be there, but it will not infect the machine.
Alternatively, there is software that will block users from USB. So you could run AV as a permitted user.
answered Jul 18, 2019 at 11:38
-
2Some anti-virus solutions can do exactly that: USB filtering/ write-deny while being able to clean it up if needed.– OvermindJul 18, 2019 at 12:44