HarfangLab EPP
Device Control

For effective protection against threats linked to external devices, while meeting the needs of information system users, the Device Control functionality integrated into HarfangLab’s EPP enables teams to:

• "335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"" aria-setsize="-1" data-aria-posinset="2" data-aria-level="1">monitor USB port activity and launch scans
• "335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"" aria-setsize="-1" data-aria-posinset="2" data-aria-level="1">set up filtering and blocking rules for an entire computer park, specific endpoints, or groups of endpoints 
• "335552541":1,"335559685":720,"335559991":360,"469769226":"Symbol","469769242":[8226],"469777803":"left","469777804":"","469777815":"hybridMultilevel"" aria-setsize="-1" data-aria-posinset="2" data-aria-level="1">generate security alerts

By authorizing only essential uses, endpoint security can be ensured without impacting end users and preserving their autonomy.

Device Control analyzes external devices and can automatically block unknown devices to prevent threats from running. The detection of an unauthorized device generates a security alert.

Devices can be blocked by type: storage such as USB sticks, external or audio devices, and more. Connections can be restricted to approved devices only or to certain types of devices (by manufacturer, serial number, device type, etc.).

Files stored on devices can be scanned for malware by HarfangLab’s EPP-integrated antivirus.

Device Control identifies and logs USB device connections, a useful source of information when investigating security events.

These logs also provide proof of compliance during audits.

For critical environments such as data centers or strategic infrastructures, Device Control security policies can be set to totally prohibit the use of USB ports on information system terminals.

Pro tip
Thanks to the telemetry generated by devices in the HarfangLab console, you can identify the values or consult the supplier’s technical specifications to identify a device’s subclass and protocols.

An EPP including a device control feature and capable of automating the blocking of known threats enables analysts to reduce their operational workload and concentrate on more in-depth exploration of the information collected by the EDR.

Thanks to this synergy between EDR and EPP, all cybersecurity data and tools are consolidated on a single platform, facilitating overall supervision and control of the information system. This saves considerable time compared to using multiple solutions, particularly for data management.