Device Control

This component is available if Kaspersky Endpoint Security is installed on a computer that runs on Windows for workstations. This component is unavailable if Kaspersky Endpoint Security is installed on a computer that runs on Windows for servers.

Device Control manages user access to devices that are installed on or connected to the computer (for example, hard drives, cameras, or Wi-Fi modules). This lets you protect the computer from infection when such devices are connected, and prevent loss or leaks of data.

Device access levels

Device Control controls access at the following levels:

Device Control regulates user access to devices by using access rules. Device Control also lets you save device connection/disconnection events. To save events, you need to configure the registration of events in a policy.

If access to a device depends on the connection bus (the DC_Access_to_Bus status), Kaspersky Endpoint Security does not save device connection/disconnection events. To enable Kaspersky Endpoint Security to save device connection/disconnection events, allow access to the corresponding type of device (the DC_Access_Allow status) or add the device to the trusted list.

When a device that is blocked by Device Control is connected to the computer, Kaspersky Endpoint Security will block access and show a notification (see the figure below).

KES11_Device_Control_Notofication

Device Control notification

Device Control operating algorithm

Kaspersky Endpoint Security makes a decision on whether to allow access to a device after the user connects the device to the computer (see the figure below).

KES11_Device_Control_Algoritm

Device Control operating algorithm

If a device is connected and access is allowed, you can edit the access rule and block access. In this case, the next time someone attempts to access the device (such as to view the folder tree, or perform read or write operations), Kaspersky Endpoint Security blocks access. A device without a file system is blocked only the next time that the device is connected.

If a user of the computer with Kaspersky Endpoint Security installed must request access to a device that the user believes was blocked by mistake, send the user the request access instructions.

Device Control component settings

Parameter

Description

Allow requests for temporary access

If the check box is selected, the Request access button is available through the local interface of Kaspersky Endpoint Security. Clicking this button opens the Request access to device window. In this window, the user can request temporary access to a blocked device.

Access rules for devices and Wi-Fi networks

This table contains all possible types of devices according to the classification of the Device Control component, including their respective access statuses.

Block connection of mobile devices in ADB and iTunes modes

The settings for controlling access to mobile devices running Android or iOS also apply to the settings of portable devices (MTP). When a mobile device is connected to the computer, the operating system determines the device type. If Android Debug Bridge (ADB), iTunes or their equivalent applications are installed on the computer, the operating system identifies mobile devices as ADB or iTunes devices. In all other cases, the operating system may identify the mobile device type as a portable device (MTP) for file transfer, a PTP device (camera) for image transfer, or another device. The device type depends on the model of the mobile device.

If the check box is selected, Kaspersky Endpoint Security blocks access to the mobile device through ADB or iTunes. However, the user can still charge the battery of the mobile device. Access to a mobile device identified as a portable device (MTP) or a PTP device (camera) is regulated by the access rule for the specific type of device.

If the check box is cleared, Kaspersky Endpoint Security regulates access to mobile devices through ADB and iTunes by using the access rules for portable devices (MTP) and PTP devices (camera). However, even if access to portable devices (MTP) is blocked, the user can still charge the battery of the mobile device.

Connection buses

A list of all available connection buses according to the Device Control component's classification, including their respective access statuses.

Trusted devices

List of trusted devices and users who are granted access to these devices.

Anti-Bridging

Anti-Bridging inhibits the creation of network bridges by preventing the simultaneous establishment of multiple network connections for a computer. This lets you protect a corporate network from attacks over unprotected, unauthorized networks.

Anti-Bridging blocks the establishment of multiple connections according to the priorities of devices. The higher a device is on the list, the higher its priority.

If an active connection and a new connection are both of the same type (for example, Wi-Fi), Kaspersky Endpoint Security blocks the active connection and allows establishment of the new connection.

If an active connection and a new connection are of different types (for example, a network adapter and Wi-Fi), Kaspersky Endpoint Security blocks the connection with the lower priority and allows the connection with the higher priority.

Anti-Bridging supports operation with the following types of devices: network adapter, Wi-Fi, and modem.

Message templates

  • Blockage. Template of the message that appears when a user attempts to access a blocked device. This message also appears when a user attempts to perform an operation on the device contents that was blocked for this user.
  • Message to administrator. A template of the message that is sent to the LAN administrator when the user believes that access to the device is blocked or an operation with device content is forbidden by mistake.

See also: Managing the application via the local interface

Enabling and disabling Device Control

About access rules

Editing a device access rule

Adding or excluding records to or from the event log

Adding a Wi-Fi network to the trusted list

Editing a connection bus access rule

Actions with trusted devices

Obtaining access to a blocked device

Editing templates of Device Control messages

Anti-Bridging

Page top