Endpoint Device Control in Windows 7 and Beyond

Endpoint Device Control in Windows 7 and Beyond

© 2010 Monterey Technology Group Inc.

Commissioned by:

UltimateWindowsSecurity.com

Brought to you by

Speakers Chris Chevalier, Senior Product Manager Chris Merritt, Director of Solution Marketing


UltimateWindowsSecurity.com Preview of Key Points

Device Control Device Installation Restrictions

Encryption BitLocker to Go


UltimateWindowsSecurity.com Device Installation Restrictions



Block ALL removable devices Includes

things like mice and keyboards

Not realistic for most environments



Block ALL removable storage Also not

realistic for most environments



2 ways to specify devices Device ID Device Setup Class

2 approaches Blacklist

• Not much value

Whitelist• Makes more sense• Disable installation of all devices by default• Enable specific devices or classes of devices



Whitelist Enable Caveat: does

not apply to devices already installed

Difference between installed and connected

• Testing caveat



Whitelist Enable installation of specific devices

• Must understand “device identification strings” http://msdn.microsoft.com/en-us/library/ff541224.aspx Hardware IDs

• Exact make, model, and revision of the device• Make and model but not specific revision

Compatible IDs• Generic hardware ID used for assigning generic drivers from MS

Enable installation of specific device classes• Must understand “Device Setup Classes”

http://msdn.microsoft.com/en-us/library/ff541509(v=VS.85).aspx

• Some are system defined, vendors can also make up new ones


http://msdn.microsoft.com/en-us/library/ff541224.aspx

http://msdn.microsoft.com/en-us/library/ff541224.aspx




Whitelist How do you figure

out device ID or class?

• System defined classes: http://msdn.microsoft.com/en-us/library/ff553426(v=VS.85).aspx

• Control Panel\Device Manager

Device properties dialog \ Details tab







Whitelist Enable devices

or classes with “Allow installation of devices using drivers that match…” policies



Device Installation Restrictions

Whitelist Test

• Against non USB devices like eSATA drives• Against devices you want to allow installation of

MiceKeyboardsMonitors

• Against devices you want to prohibit




Support Issues Message displayed to user How to handle exceptions?

• Are you a least privilege workstation environment?Enable “Configure policy to allow administrators to

override device installation restrictions”

• Otherwise you will have to make temporary GPO exception policies

Possible problem when user travelling

• “Time (in seconds) to force reboot when…”




All or nothingWhat about controlling read/write access

to removable storage? Removable Storage Access

• Control read/write access to different classes of removable storage


UltimateWindowsSecurity.com Removable Storage Access



Combining Device Restrictions and Removable Storage Access

Possible to enforce device whitelist that allows particular type of USB drive

Limit read/write access for that class of device


UltimateWindowsSecurity.com BitLocker to Go

Applies to removable drivesEncryption key

Smartcard Stored on computer

• BitLocker must be enabled on system drive

Password• Allows BitLocker encrypted devices to be shared

Can require backup to AD for recovery purposesBitLocker To Go Reader available for pre

Windows 7 computers


UltimateWindowsSecurity.com BitLocker to Go

Policies Deny write access to removable drives not

protected by BitLocker Configure use of passwords for removable

data drives Choose how BitLocker-protected removable

drives can be recovered


UltimateWindowsSecurity.com Bottom Line

Device installation restrictions May work for very homogenized, non power

user environmentsBitLocker To Go

Password based encryption of removable drives

Significant caveats, labor and limitations



Limitations and Caveats

BitLocker to Go Requires Enterprise / Ultimate Win 7

• No write support pre Win 7

BitLocker to Go Reader• Read access cumbersome, must copy files to

desktop

No Support for CD/DVD



Limitations and Caveats

No logging, reporting, auditingControls installation not connectionDefining whitelisted devices cumbersome

and laboriousNo control based on type of files or

contentWhat about temporary exceptions for

emergencies when user is off-line?What about pre Windows 7?



Brought to you by

Speakers Chris Chevalier, Senior Product Manager Chris Merritt, Director of Solution Marketing


UltimateWindowsSecurity.com Want to Learn More?

Lumension www.lumension.com [email protected] http://blog.lumension.com


http://www.lumension.com/

mailto:[email protected]

http://blog.lumension.com/

Endpoint Device Control in Windows 7 and Beyond

Technology

Transcript of Endpoint Device Control in Windows 7 and Beyond