Can We block Mass Storage Devices Using HIPS in EPO 4.5 ??

[someshsawhney]

Can We block Mass Storage Devices Using HIPS in EPO 4.5 ??

[bgable]

HIP 8.0 will have this functionality and is scheduled to release in late Q4 2010.

If you are running a locked down COE image, it should also possible to create a custom signature in HIP 7.0.

You need to be on a standard image though as you would need to specify a drive letter etc. in the custom signature.

[kenobe]

Why not use DLP to block mass storage?

v/r

Ken

[rc-uk]

I have used a combination of HIPS signature (to block access to USB Mass Storage) and VSE Access Protection rules (to block access to all drives other than C: - this prevents access to CD, DVD, floppy etc) to protect my devices.

Admittedly this doesn't cover all scenarios - e.g. bluetooth, wireless, firewire etc but it is a good starting point.

I agree with Ken that the best way to prevent all storage devices is via use of DLP.

Russ

[suhayl]

Russ!

could you please elaborate how did you achieve -  HIPS signature (to block access to USB Mass Storage) and VSE Access Protection rules (to block access to all drives other than C:

[toddunger]

IPS Signature 1157:  USB Storage Device Inserted.  Set to Prevent.  However, make sure to read the Description tab for the caveat.