Implementing McAfee Device Control Security

Transcription

1 Implementing McAfee Device Control Security

2 COPYRIGHT Copyright 2009 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or affiliate companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are registered trademarks or trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other registered and unregistered trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. License Attributions Refer to the product Release Notes. 2

3 Contents Overview Device classes How to control hardware devices in McAfee Device Control How device classes are organized Device definitions Plug and play device definitions Removable storage device definitions Device rules Plug and play device rules Removable storage device rules Online and offline modes Examples Example 1 - Block the Dell wireless 1490 dual band WLAN mini-card Example 2 - Blocking USB devices Example 3 - How to define a new device class

4 The following document describes how to implement security for removable devices using McAfee Host Data Loss Prevention. The descriptions and examples that follow are taken from McAfee Host Data Loss Prevention version 2.2 patch 2, though they are generally applicable in any version. Because the information that follows applies only to the Device Control component of McAfee Host Data Loss Prevention, we use the shorthand of referring to the product as McAfee Device Control throughout this document. This reduced tool set version is, in fact, the default implementation of McAfee Host Data Loss Prevention when first installed. All of the information in this document should be understood to apply to full McAfee Host Data Loss Prevention as well. Device classes Device definitions Device rules Examples Device classes A device class is a collection of devices that have similar characteristics and that can be managed in a similar manner. For example, the "Intel PRO/1000 PL Network Connection" and "Dell wireless 1490 Dual Band WLAN Mini-Card" are two devices that belong to the Network Adapter device-class. McAfee Device Control can control the behavior of device classes and specific devices belonging to a managed device class using device definitions and device rules. The device class definitions are part of the DLP Policy and is found under the Systems menu in epolicy Orchestrator 4.0. How to control hardware devices in McAfee Device Control How device classes are organized How to control hardware devices in McAfee Device Control Use this general procedure to set the behavior of a specific set of hardware devices in McAfee Device Control: Task 1 Verify that the device class to which the hardware devices belong is a Managed Device Class. 2 Create a Device Definition that matches the properties of the specific hardware devices you want to control. 4

5 Device classes 3 Create a Device Rule to set the action to apply to hardware devices matching the device definition in step 2. The action can block the device, monitor it, or set the device to read-only. Figure 1: The Device Management panel in McAfee Device Control How device classes are organized McAfee Device Control has a built-in list of pre-defined device classes, sorted to three device class categories: Managed: device classes whose behavior is controlled by McAfee Device Control. The Host DLP agent installs the DLP device driver on these device classes. Unmanageable: device classes that McAfee Device Control does not try to control, for example battery devices or processors. Unmanaged: device classes that are not controlled by the McAfee Device Control default configuration, but can easily be managed by changing the device class status to Managed (see Figure 2: Changing the decoders device class to Managed. You can use device definitions and plug and play device rules to control (monitor, block, or set to read-only) hardware devices belonging to a specific device-class only when that device class is set to Managed status. Removable storage device rules, on the other hand, do not require a Managed device class. The reason is related to the difference in how the two types of device rules utilize device classes: Plug and play device rules are triggered when the hardware device is plugged into the computer. Since the reaction is to a device driver, the device class must be managed for the device to be recognized. Removable storage device rules are triggered when a new file system is mounted. When mount occurs, the DLP agent associates the drive letter with the specific hardware device 5

6 Device definitions and checks the device properties. Since the reaction is to a file system operation (that is, mount of a new file system) the device class does not need to be managed. NOTE: For instructions on defining a new device class, refer to Example 3 - How to define a new device class at the end of this document. Figure 2: Changing the decoders device class to Managed Device definitions A device definition is a list of device properties such as bus type, device class, vendor ID and product ID. The role of device definitions is to identify and group devices according to their common device properties. Some device properties are the same for plug and play device definitions (Figure 3: Plug and play device definition) and for removable storage device definitions (Figure 4: Removable storage device definition), while others are exclusive to the specific device type. Plug and play device definitions Removable storage device definitions 6

7 Device definitions Figure 3: Plug and play device definition 7

8 Device definitions Figure 4: Removable storage device definition Plug and play device definitions The following sections describe the device definition properties and how to obtain them: Bus type A bus is the physical mechanism on which a device is connected to the computer. Common buses include USB, PCI, FireWire, and Bluetooth. When using the bus type definition in a rule, the bus itself is not blocked or monitored. The rule applies only to devices connected on top of that bus. For example, if a rule defines that the entire USB bus should be blocked, then any USB device that is connected on top of the USB controller (through the USB bus) will be blocked, but the USB controller device will not be blocked since it is connected on top of the PCI bus. In the Figure 5: Devices by connection 8

9 Device definitions below, the Intel (R)82801DB/ DBM USB Universal Host Controller - 24C will not be blocked because it has bus type PCI. Figure 5: Devices by connection To obtain the view shown in Figure 5: Devices by connection above, go to the Windows Device Manager, and select View Devices by connection from the menu. To obtain the bus type of a device, locate the device in the Windows Device Manager, right-click, and select Properties Details. The beginning of the device instance ID describes the bus 9

10 Device definitions type the device is connected to (see Figure 6: A typical network adapter connected on top of the PCI bus). Figure 6: A typical network adapter connected on top of the PCI bus NOTE: USB devices require a device called a USB hub to operate. The USB hub device is present under all physical USB controllers. Therefore, if a plug and play rule blocks the entire USB bus except several excluded devices, you must also exclude the USB Hub to allow the operation of some USB devices on that computer. (See Example 2 - Blocking USB devices.) Device class Microsoft Windows has pre-defined categories for most common devices. However, some devices install their own new device class and don't fall under the pre-existing categories. The device classes available in the device definitions dialog box (see Figure 7: Selecting a device class (the list contains only the managed device classes)) are taken from the Managed Device Classes 10

11 Device definitions list in the policy. Devices in the Unmanageable Device Class or in the Unmanaged Device Class lists cannot be used in a definition. Figure 7: Selecting a device class (the list contains only the managed device classes) 11

12 Device definitions To obtain the device class to which a specific device belongs, look in the Windows Device Manager (see Figure 8: Device classes as seen in the Windows Device Manager). Figure 8: Device classes as seen in the Windows Device Manager Device compatible ID (advanced users only) The device compatible ID is a string that identifies a device in the computer according to its characteristics. The definition can be obtained in the Windows Device Manager device properties. 12

13 Device definitions Figure 9: Compatible ID for a typical removable storage device shows an example of a device compatible ID. In the example the compatible ID is: USB\Class_08&SubClass_06&Prot_50. Figure 9: Compatible ID for a typical removable storage device Device instance ID (advanced users only) The device instance ID is a Windows-generated string that uniquely identifies the device in the computer and the port (or slot) it's connected to. The definition can be obtained in the Windows Device Manager device properties. Figure 6: A typical network adapter connected on top of the PCI bus shows an example of a device instance ID. In the example, the instance ID is the entire string: PCI\VEN_8086&DEV_4220&SUBSYS_ &REV_05\4&39A85202&0&10F0. NOTE: McAfee recommends using a device definition only when absolutely required, for example very special cases where other device definitions cannot identify a device. Device name The device name is a string which describes the device. The string can be obtained in the Windows Device Manager device properties (see Figure 6: A typical network adapter connected on top of the PCI bus). PCI vendor ID/device ID The PCI vendor ID and device ID are values embedded in PCI devices. These parameters can be obtained from the instance ID of the physical device. The vendor ID is a 16-bit hexadecimal number that uniquely identifies a certain hardware manufacturer (for example, Intel). The device ID is a 16-bit hexadecimal number that uniquely identifies a certain device model. 13

14 Device definitions Figure 6: A typical network adapter connected on top of the PCI bus shows an example of a PCI vendor ID (8086) and a device ID (4220). The separator is the '&' symbol. USB class code According to the USB standard, a class code identifies a physical USB device by its general functionality. Most standard USB devices fall under these pre-defined classes. To obtain the USB class code, look in the Windows Device Manager on the Details tab of the device properties for Compatible Ids (see Figure 9: Compatible ID for a typical removable storage device). NOTE: Some USB devices come with their own proprietary drivers. In that case the USB class code may be FF (vendor specific). USB device serial number The USB device serial number is a unique alphanumeric string assigned by the USB device manufacturer, typically for removable storage devices. To obtain the USB serial number, look in the Windows Device Manager at the device instance ID. The last section of the instance ID of a USB device is the serial number. Figure 10: A typical USB mass storage device shows an example of a USB device with a serial number. The instance ID for the device is: USB\VID_08EC&PID_0012\18105B E and the serial is 18105B E. Figure 10: A typical USB mass storage device NOTE: Most USB removable storage devices are assigned a serial number, with some rare exceptions. A valid serial number must have a minimum of 5 alphanumeric characters and must not contain an ampersand (&). If the last part of the instance ID does not follow these requirements, it is not a serial number. 14

15 Device definitions USB vendor ID/product ID The USB vendor ID and device ID are embedded in the USB device. The vendor ID uniquely identifies the device manufacturer and the device ID identifies a specific device model from that manufacturer. To obtain the vendor ID and product ID look at the device instance ID of the specific device in the Windows Device Manager. Figure 10: A typical USB mass storage device shows an example of a connected USB mass storage device. In the example shown the vendor ID is 08EC and the product ID, separated by the '&' character, is Removable storage device definitions Removable storage device definitions are similar in construct to plug and play device definitions. However, removable storage device definitions add properties that allow maximum flexibility when controlling removable storage devices. Removable storage devices are physical devices connected to a computer which export one or more logical disk drive or CD-ROM devices. The logical disk drive or CD-ROM device in turn exports one or more mounts (drive letters). A McAfee Device Control mechanism gathers attributes from the removable storage devices at different layers of the tree when processing a removable storage device rule in order to get as much data as possible about the device to uniquely identify it. Figure 11: A typical removable storage device tree shows an example of a typical removable storage device tree. It demonstrates at which level an attribute of the device is gathered at. You can see this structure in the device manager when selecting View Devices by connection and locating the plugged in removable storage device. 15

16 Device definitions All removable storage device definitions are defined in the same way as plug and play device definitions. The only difference is where the device attribute is taken from. The following section describes definition properties that are specific for removable storage devices. Figure 11: A typical removable storage device tree CD/DVD drives CD/DVD drive is a generic device class definition for all CD/DVD devices. This definition is typically used when creating a rule for blocking CD burning. File system access The file system access defines whether the file system is writable (a removable storage device) or read-only (for example, compact discs). 16

17 Device definitions File system type The file system type can be found by locating the drive letter for the removable storage device in Windows Explorer and looking at its properties (see Figure 12: Typical storage device in Windows Explorer.) Figure 12: Typical storage device in Windows Explorer File system volume label The file system volume label is a user defined label given to the file system. It can be located in Windows Explorer (see Figure 12: Typical storage device in Windows Explorer.) File system volume serial number The file system volume serial number is a 32-bit serial number generated automatically whenever a file system is created on the device. To locate the volume serial number, run a command line (Start Run, then type cmd in the text box) and type dir X: (where x is the drive letter). At the top of the results the file system volume serial number can be found. Figure 13: The file 17

18 Device rules system volume serial number shows an example of a file system volume serial number (the serial number is 0DD ) Figure 13: The file system volume serial number NOTE: The file system volume serial number changes when reformatting the media. The value can be user-modified using a special tool. Device rules Once you have created a device definition to uniquely identify a set of devices, you use device rules to set the action applied to the hardware devices matching the device definition. To control devices (monitor, block, set to read-only) that belong to a given device-class, the device-class must be configured as a Managed Device Class in the Host DLP management console. (For more information refer to How device classes are organized.) A device rule can apply the following actions: Block The device is blocked when it is plugged into the computer. Any attempt to use the device fails. Monitor A DLP event is sent to the epolicy Orchestrator server to log the activation of the device when it is plugged in. Notify User Activates a popup dialog to the user notifying the user of the action that being performed. This action is optional, and is always used with another action (block, monitor). Read-only This action is only available for removable storage devices. The action sets the device to be read-only, disabling all write operations to the device. There are two types of device rules, removable storage and plug and play device rules. Plug and play device rules Removable storage device rules Online and offline modes Plug and play device rules Plug and play device rules work on the device driver level, and can be used to block and monitor devices. Whenever a new device is plugged into the computer, McAfee Device Control matches 18

19 Device rules the new device attributes against the device attributes defined in the plug and play device rule. If a match is found, McAfee Device Control performs the action (block/monitor/notify user) defined by the device rule. Plug and play device rules are used to restrict the use of peripheral devices such as Bluetooth adapters and modems. Although plug and play device rules can also be applied to removable storage devices, McAfee does not recommend using them for such devices. For controlling removable storage McAfee recommends using the removable storage device rules Removable storage device rules Removable storage device rules are used for blocking and monitoring removable storage devices such as flash drives, MP3 players, and external hard drives. They can block, monitor, or configure the removable storage to read-only. Whenever a new removable storage device is plugged into the computer, McAfee Device Control matches the new device properties against the removable storage device definition used in the removable storage device rule. If a match is found, McAfee Device Control performs the action defined by the device rule. Removable storage device rules work on the file system level, and allow for more flexibility than plug and play device rules. For example, a removable storage device rule can match a device based on its file system type (NTFS, FAT32) or file system volume label. In addition, they provide more accurate device names. A specific example would be an ipod which is recognized by the plug and play mechanism as USB mass storage device. The removable storage rule recognizes it as Apple ipod, which is more meaningful. (This description fits older ipods. The ipod Touch is recognized as a Windows Image Acquisition device.) McAfee recommends using removable storage device rules, rather than plug and play device rules, to control all devices that provide removable storage, such as USB mass storage devices, Flash Drives ("Disk on Key"), and CD\DVD. NOTE: Since plug and play device rules are applied on the device driver level, they are applied before removable storage device rules. The implication is that if a removable storage device is blocked by both types of rule, the removable storage device rule is not applied. Online and offline modes Device rules allow assigning an Online/Offline mode to a rule. Online mode means that a rule will trigger when the user is connected to the organizational network. McAfee Device Control assumes users are "online" whenever their computers can connect to the organization's Active Directory (DC) server. Offline mode means that a rule will trigger even when the user is not connected to the organization's Active Directory (DC) server. (A user can be connected to the network and still be "offline" if there is no connection to the Active Directory server.) When a Monitor rule triggers offline, the event is stored and sent to the DLP database when the computer is reconnected to the server. Assigning online and offline flags to rules allows for the creation of flexible device rules for situations when a user is in the organization or outside of it. For example, using these flags it is possible to create a rule that disables wireless adapters while the user is online, but does not block their use when the user is offline. 19

20 Examples Examples The following illustrated examples demonstrate the concepts described above. Examples Example 1 - Block the Dell wireless 1490 dual band WLAN mini-card Example 2 - Blocking USB devices Example 3 - How to define a new device class Example 1 - Block the Dell wireless 1490 dual band WLAN mini-card This example demonstrates the three steps required to control the behavior of a hardware device. Task 1 Verify that the device class to which the hardware devices belong is a Managed Device Class. The Dell wireless 1490 Dual Band WLAN Mini-Card is a device of class Network Adapter. Open the Device Classes list and view the Managed device class. If Network Adapter does not appear, then locate it right click on it and set it to managed device. Figure 14: Verifying a managed device class 20

21 Examples 2 Create a Device Definition that matches the properties of the specific hardware devices you want to control. In our example, we define the Bus Type, Device Class, Device Name and Vender ID/Product ID properties. Figure 15: Device definition for the Dell wireless mini-card 3 Create a Device Rule to set the action to apply to hardware devices matching the device definition. 21

22 Examples In this example we set the rule to block the device when online, and monitor when both online and offline. Figure 16: Including the definition in the rule 22

23 Examples Figure 17: Adding the blocking action Example 2 - Blocking USB devices This example demonstrates how to create a plug and play device rule to block all USB devices except those on a list of selected devices. USB devices require a device called a USB Root Hub to operate. A USB Root hub device is present under each physical USB controller (that is, connected on top of the USB controller). Multiple USB devices can be connected on top of a USB Root Hub. Therefore if a rule blocks the entire USB bus except specific excluded devices, the USB Root Hub must also be excluded to allow the operation of excluded USB devices connected on top of it. 23

24 Examples Figure 18: The USB Root Hub as ancestor of any device plugged in to one of it's ports shows the USB Root Hub and the actual memory stick (disgo USB Device) that is connected on top of the hub. Figure 18: The USB Root Hub as ancestor of any device plugged in to one of it's ports To block all USB devices except specified devices using a plug and play device rule: Task 1 Create a new plug and play device definition for the USB Root Hub. a b Under Bus Type select USB. Under Device Name click Add New and type USB Root Hub. Select the Allow Partial Match option and click OK twice. 2 Create a new plug and play device definition to block all USB devices. Under Bus Type select USB, then click OK. 3 Create a new plug and play device definition for the allowed devices: a Under Bus Type select USB. 24

25 Examples b Under USB Device Serial Number click Add New and type a serial number. Repeat adding until all serial numbers to be excluded are entered. Click OK twice. Figure 19: Adding device serial numbers 25

26 Examples 4 Create a new plug and play device rule. Include All USB devices. Exclude Allowed devices and USB Root Hub. Click Next and select Block. Figure 20: Creating a device rule to exclude specified devices NOTE: This example used a plug and play device rule to demonstrate how devices are connected on top of each other. The USB Root Hub is connected on top of the USB Controller and the specific USB devices are connected on top of the USB Root Hub. It also explains the need to enable the hub for the excluded USB devices to work. The specific USB device in the example was a memory stick. Although it is possible to block USB memory devices in this manner, McAfee recommends using removable storage device rules to block all removable storage devices. Example 3 - How to define a new device class McAfee Device Control has a built-in list of pre-defined device classes. Some hardware devices install their own new device class. To control the behavior of plug and play hardware devices that define their own device class you must first add a new device class to the Device Classes list in the McAfee Device Control policy manager. A device class is defined by two properties a name and a GUID (Globally Unique Identifier). The name of a new device is displayed in the device manager, but the GUID is displayed only in the Windows Registry and there is no easy way to obtain it. To ease the retrieval of new device names and GUIDs, the HDLP agent reports a New Device Class Found event to the HDLP monitor when a new hardware device class is plugged into the host computer. To view all new device classes found on all endpoints: 26

27 Examples Task 1 Open the HDLP monitor. 2 Create a filter and select Event Type. 3 Select the devices: new device class found and click OK. Figure 21: Creating a filter to display new device classes found 4 In the HDLP monitor, select an event from the event list. The Details pane displays the Device name and Device GUID. Copy these two parameters to Notepad. Figure 22: Device details in the HDLP monitor 5 Open the HDLP policy manager and navigate to the Device Classes list. 27

28 Examples 6 Right-click and select Add New Device Class. Figure 23: Adding a new device class 7 Edit the new device class Name and Device GUID using the information copied from the DLP monitor. 8 Select the Allow devices belonging to this class to be managed checkbox and click OK. Figure 24: Editing the new device class parameters 28