Blocking USBs

[howartp]

Hello.

 

Following a conversation on ransomware / spam / password security, I've been given permission out of the blue to block USB sticks completely.

 

Not just require encryption, but to not allow regular staff to use USB sticks at all.

 

All the threads I can find on Edugeek are about encrypting, but I know there are apps out there that deal with blocking USBs full stop, unless they're on an exceptions list.

 

Does anyone use any of them?

 

(I'm not on about physically disabling the USB ports, gluing them, frying them, removing them - I want a software management solution for them)

 

Peter

[Arthur]

I think this is the policy you need...

 

[b]All Removable Storage classes: Deny all access[/b] = Enabled
(Computer Configuration > Administrative Templates > System > Removable Storage Access)

 

Edit. There's some documentation at the link below that may be useful?

 

https://docs.microsoft.com/en-us/previous-versions/dotnet/articles/bb530324(v=msdn.10)#prevent-installation-of-all-devices

Edited May 1, 2019 by Arthur

[3s-gtech]

User Configuration/Policies/Administrative Templates/System/Removable Storage Access/All removable storage classes: Deny all access This should cover most bases, but not some HDDs. It will affect cameras. It may be a bit broad for you, but I haven't implemented this here to be sure about it. EDIT: ninja'd.

[PlantHead]

Use your AV (TrendMicro, Sophos, etc.) to block all removable storage devices and allow white listed USB devices - that is the easiest way.

[howartp]

Use your AV (TrendMicro, Sophos, etc.) to block all removable storage devices and allow white listed USB devices - that is the easiest way.

 

Great idea - we've just moved to Sophos Central and I hadn't even looked at that.

 

I've just turned on monitoring devices so I can see what's in use across school.

[Norphy]

If you use NetSupport DNA, you can control access to USB devices with that as well. I suspect Impero can do the same.

[synaesthesia]

Impero works well for it also, we whitelist a couple of devices (you'll need that option for things like transferring from camera, microbits etc) if you use that.

[LukeMoss]

Sophos works perfectly for this, like above peripheral control policy. Works very quickly and you can see the logs of who's trying to use what etc. If you need to unblock something then it's instantaneous.

[RPilkington]

What app in Sophos do you use to control this?

[howartp]

Sophos works perfectly for this, like above peripheral control policy. Works very quickly and you can see the logs of who's trying to use what etc. If you need to unblock something then it's instantaneous.

Yeah, so is blocking...

 

I had a play last night, and blocked out everyone's SanDisk!

[howartp]

What app in Sophos do you use to control this?

 

Endpoint Protection > Policies > Peripheral Control