HarfangLab EPP
Device Control

Active device control to protect endpoints and standalone users

The external devices that users plug into their workstations can represent a security risk for an entire information system.  

In fact, a USB key, external hard drive, or other storage device can be a threat vector for taking control of IT equipment, or spying on or stealing data from a company or institution.  

This risk exists even on a computer whose session is locked, as is the case with PoisonTap.  

Beyond data theft itself, the consequences can carry a hefty price tag: cost of restoring stolen or compromised data, loss of contracts, GDPR fines…  

For effective protection against threats linked to external devices, while meeting the needs of information system users, the Device Control functionality integrated into HarfangLab’s EPP enables teams to:  

• monitor USB port activity and launch scans
• set up filtering and blocking rules for an entire computer park, specific endpoints, or groups of endpoints 
• generate security alerts 

By authorizing only essential uses, endpoint security can be ensured without impacting end users and preserving their autonomy. 

Device Control in action

Automatically threat blocking

Device Control analyzes external devices and can automatically block unknown devices to prevent threats from running. The detection of an unauthorized device generates a security alert. 

Devices can be blocked by type: storage such as USB sticks, external or audio devices, and more. Connections can be restricted to approved devices only or to certain types of devices (by manufacturer, serial number, device type, etc.).  

Files stored on devices can be scanned for malware by HarfangLab’s EPP-integrated antivirus. 

Connection tracking

Device Control identifies and logs USB device connections, a useful source of information when investigating security events.

These logs also provide proof of compliance during audits.

Policies adaptable to all environments, even sensitive ones

For critical environments such as data centers or strategic infrastructures, Device Control security policies can be set to totally prohibit the use of USB ports on information system terminals.

Pro tip

Thanks to the telemetry generated by devices in the HarfangLab console, you can identify the values or consult the supplier’s technical specifications to identify a device’s subclass and protocols.

EDR + EPP to speed up work for cyber experts

Ensuring the defense of information systems and countering cyber threats by supporting cyber professionals is at the heart of HarfangLab.

An EPP capable of automating the blocking of known threats enables analysts to reduce their operational workload and concentrate on more in-depth exploration of the information collected by the EDR.

Thanks to this synergy between EDR and EPP, all cybersecurity data and tools are consolidated on a single platform, facilitating overall supervision and control of the information system. This saves considerable time compared to using multiple solutions, particularly for data management.

And the benefits of this combination don’t stop with analysts!

Security becomes a priority for all information system users

For an IT department, choosing a centralized solution simplifies management: a single process for acquisition, installation, and updates, lightening the workload for IT teams.

On the user side, the EDR-EPP bundle improves visibility over their own workstation activity, making them more aware of cybersecurity issues thanks to EPP alerts.

In short, the combined strength of EDR and EPP makes it possible to swiftly implement every solution essential to securing endpoints: incident detection and response, antivirus, firewall and, as we have seen, control of external devices.

The IT infrastructure is protected by a platform controlled and configured from a single interface with full access to data, enabling in-depth investigations in the event of a security incident.