1

I want to blacklist all the external storage devices and only allow specific brand of device such as SanDisk. I had blacklisted the external storage devices by using USBSTOR* and whitelist all the SanDisk devices by using USBSTOR\DISK&VEN_SANDISK*

All the external storage devices are blocked successfully including the 3G/4G USB dongle which I don't wan it to be blocked.

In my case, what is the best practices for implementing a Device control policy?

  • Can you see your 3G/4G USB dongle in the Device Manager under Other Devices? – Daniel Jun 7 '15 at 10:11
  • Why only a specific brand? Note that there's nothing preventing the device from lying to you anyways. – Clockwork-Muse Jun 7 '15 at 10:17
  • @Clockwork-Muse: Its a mitigation technique, there are already proprietary solutions mainly designed for government and military environments, the question here being to what extend such measure can be implemented manually without requiring such third-party software... – WhiteWinterWolf Jun 7 '15 at 11:15
  • @WhiteWinterWolf - the thread you linked to was about VM use? I know blocking USB connections can help against malicious storage, but again, why by brand? I could understand specific models (although it'd still be possible to be lied to), and even better if the device itself has a unique id. – Clockwork-Muse Jun 7 '15 at 12:00
  • @Clockwork-Muse: Sorry, the link was erroneour, wrong copy-paste. The valid link is this one, the goal being to limit the type of device which can be plugged (no webcam, no USB keyboard to prevent Bad-USB, no networking device, etc) and limit to the model actually used and approved by the company policy (no personal USB taken from home, no unknown key offered by a third-party, no phone, no camera, etc.) – WhiteWinterWolf Jun 7 '15 at 12:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.