For CrowdStrike customers check out the full details in the USB Device Policy guide in the console. It is also very helpful when enforcing specific corporate standards.Īfter a policy is created assign that policy to a group for simpler management and automatic assignment. This allows you to provide necessary functionality while maintaining control over user access. These exceptions can be done for specific devices or in larger groups using vendor and product information. Within the policy for each class, you also have the option to define exceptions.
For mass storage, “Read and write only” is often used to prevent the auto-execution of unwanted programs. “Read, write and execute” gives users full access. Device classes include imaging, printers and mass storage.For mass storage, you will see four options available. This gives you the granularity to define different policies for different types of devices.
Within each policy, you are presented with a list of different USB device classes. I’ll follow the path of creating a new policy.
The policies and options can be found under “Configuration > USB Device Policies”.įrom the policy list, you can choose to create a Windows or Mac policy, to edit an existing policy, or create a new policy. Falcon Prevent customers can also access similar visibility options via the Activity app.įalcon Device Control enables customers to use their existing management platform and lightweight agent to establish and enforce policies for USB devices on both Mac and Windows devices. This video provides a demonstration of the Falcon Device Control configuration as well as the USB device visibility available with Falcon Insight dashboards.
This document will outline how to use Falcon Device Control to create and enforce USB device policy in your environment to minimize the attack surface and risk of incidents.
0 kommentar(er)
