USB Drives - Encryption or banned?

[kennysarmy]

As I understand it, the sophos device control policies are machine policies. We have the enterprise console on a local server that links to AD, but it only allows us to sync computer OUs to Sophos groups.

It sounds like you have a slightly different setup, so you might have more user based options than us though.

 

Yes we're in the cloud!

 

Just reading up on an AD Sync utility you can stick on your DC which can map users/groups etc to the cloud - that might then allow us to be more granular in our policies.

[leeshellard]

Yes we're in the cloud!

 

Just reading up on an AD Sync utility you can stick on your DC which can map users/groups etc to the cloud - that might then allow us to be more granular in our policies.

 

We use cloud too and have the AD sync you can then set policies based on AD groups or users. Sync is easy to set up.

[kennysarmy]

We use cloud too and have the AD sync you can then set policies based on AD groups or users. Sync is easy to set up.

 

Think I've just sorted out.

 

Will do a bit of testing today with some policies but the groups are syncing.

 

Only issue is I've not used LDAP over SSL as I don't know how to sort out the certificate part - any help appreciated.

[korifugi]

We allow them, but use Bitlocker - applied by GP.

 

Quite often it throws members of staff saying "It's full but I've only just bought it" (and those that have Macs at home don't like it)

[gshaw]

Encrypted for now via GPO (for staff only, no restrictions for students). Eventually would prefer to drop completely but have to manage the process to avoid user outcry.

[Bev]

Encrypting USB or using Google Drive is fine in theory, but I'm worried about the personal laptops that the data is then downloaded onto a home. How do you control that?

[Rob_D]

Encrypting USB or using Google Drive is fine in theory, but I'm worried about the personal laptops that the data is then downloaded onto a home. How do you control that?

If you're using google or Onedrive you might be able to stop downloading (onedrive and rights management/ Azure information protection should be able to do this). But at some point it's got to just become a training policy issue.

[free780]

Windows Information Protection can prevent uploads to cloud services. It is not supported on shared devices only 1:1.

[enjay]

Encrypting USB or using Google Drive is fine in theory, but I'm worried about the personal laptops that the data is then downloaded onto a home. How do you control that?

 

Training and frequent reminders.

[korifugi]

Training and frequent reminders.

 

...and a mighty big 'clue bat'.