HarfangLab EPP
Device Control

A closer look at how our EPP’s Device Control works.

Active device control to protect endpoints and standalone users

The external devices that users plug into their workstations can represent a security risk for an entire information system.

In fact, a USB key, external hard drive, or other storage device can be a threat vector for taking control of IT equipment, or spying on or stealing data from a company or institution.

This risk exists even on a computer whose session is locked, as is the case with PoisonTap.

Beyond data theft itself, the consequences can carry a hefty price tag: cost of restoring stolen or compromised data, loss of contracts, GDPR fines…

Automate threat blocking

Adapt configuration to your specific needs

Device Control in action

Allow essential uses only

For effective protection against threats linked to external devices, while meeting the needs of information system users, the Device Control functionality integrated into HarfangLab’s EPP enables teams to:

monitor USB port activity and launch scans
set up filtering and blocking rules for an entire computer park, specific endpoints, or groups of endpoints
generate security alerts

By authorizing only essential uses, endpoint security can be ensured without impacting end users and preserving their autonomy.

Automate threat blocking

Device Control analyzes external devices and can automatically block unknown devices to prevent threats from running. The detection of an unauthorized device generates a security alert.

Devices can be blocked by type: storage such as USB sticks, external or audio devices, and more. Connections can be restricted to approved devices only or to certain types of devices (by manufacturer, serial number, device type, etc.).

Files stored on devices can be scanned for malware by HarfangLab’s EPP-integrated antivirus.

Device Control Threats blocking automation

Track USB device connections

Device Control identifies and logs USB device connections, a useful source of information when investigating security events.

These logs also provide proof of compliance during audits.

Adapt policies to all environments, even sensitive ones

For critical environments such as data centers or strategic infrastructures, Device Control security policies can be set to totally prohibit the use of USB ports on information system terminals.

Pro tip
Thanks to the telemetry generated by devices in the HarfangLab console, you can identify the values or consult the supplier’s technical specifications to identify a device’s subclass and protocols.

Speed up work for cyber experts

An EPP including a device control feature and capable of automating the blocking of known threats enables analysts to reduce their operational workload and concentrate on more in-depth exploration of the information collected by the EDR.

Thanks to this synergy between EDR and EPP, all cybersecurity data and tools are consolidated on a single platform, facilitating overall supervision and control of the information system. This saves considerable time compared to using multiple solutions, particularly for data management.

HarfangLab EPP
Device Control

Active device control to protect endpoints and standalone users