Best Practices in
Device Control



An In-Depth Look at Enforcing
Data Protection Policies




      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Today’s Agenda




             Introduction



             Augment Your Endpoint Security with Device
             Control to Protect Your Data
             • Laying the Groundwork
             • Preparing for Enforcement
             • Enforcing Policy
             • Managing Device Control


             Q&A
Why Device Control Is Important




    Today’s Endpoint Security Stack                                   Significant Data Loss / Theft Issues

                  AV
                 Device
                 Control
              Application
               Control
        Patch & Configuration
            Management

3
           PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Benefits of Enforceable Device Control Policy
    Malware Costs Money                                           Data Breaches Cost Money




4
       PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Device Control Best Practices

                                                    Laying the
                                                   Groundwork




                                                     Device
      Managing                                                         Preparing for
                                                  Management
    Device Control                                                     Enforcement
                                                    Process




                                                      Enforcing
                                                       Policy

5
            PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Laying the Groundwork
Know Your Organization’s Security Profile




    Permissive                               Moderate               Stringent



7
         PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Policy Considerations
Devices and                                                          Who, Where
Connections




Permission Types                                                          When




8
          PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Active Directory Synchronization Schedule




9
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
What Can You Control?
Physical Interfaces                     Wireless Interfaces                Device Types
•   USB                                 •   Wi-Fi                          •   Removable Storage Devices
•   FireWire                            •   Bluetooth                      •   External Hard Drives
•   PCMCIA                              •   IrDA                           •   CD / DVD Drives
•   ATA / IDE                           •   Wireless NICs                  •   Floppy Drives
•   SCSI                                                                   •   Tape Drives
•   LPT / Parallel                                                         •   Printers
•   COM / Serial                                                           •   Modems / Secondary Network
•   PS/2                                                                       Access Devices
                                                                           •   PDAs and other handhelds
                                                                           •   Imaging Devices (Scanners)
                                                                           •   Biometric Devices
                                                                           •   Windows Portable Devices
                                                                           •   Smart Card Readers
                                                                           •   PS/2 Keyboards
                                                                           •   User-Defined Devices




10
                PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
A Good Device Control Strategy

                                            Policy Scope                   Policy Assignments


Preferred                              Entire Device Class                      ‘Everyone’


                                 Device Collection - Models                  AD User Group


                                Device Collection - Devices                 Individual AD User


                                                                                 Endpoint


            Create policies at the                                        Endpoint Group (static)
            highest level possible
                                                                         Endpoint Group (dynamic)

11
              PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Permission Types & Times of Enforcement




12
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Discovery




13
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Very Important


                                                  User
                                               Communication



                                                          Executive
                                                          Sponsor

14
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Preparing for Enforcement
Creating Policies
     Work one class at a time                                           For each class

         Biometric Sensors                                             Do we use these?


                                                                     Can they be managed
           USB Printers                                               as a single class?


                                                                         What types of
               DVD/CD                                                    permissions?


                                                                     Everyone, User Groups,
        Removable Storage                                               Users, Endpoints


                                                                     What exceptions need
               et cetera                                             to be accounted for?

16
          PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Device Collections




17
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Encryption Options
                                                           • Don’t allow users to encrypt
                                                             devices and DVD/CD media

                                                           • Allow users the option to encrypt
                                                             devices and DVD/CD media

                                                           • Force users to encrypt devices
                                                             and DVD/CD media

                                                           • Encrypted Device Access
                                                                 » Password
                                                                 » User certificate




18
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Enforcing Policy
Phased Rollout
• User communication

• Start with a small group of users/endpoints
• Proceed one device class at a time until all are enforcing your policies
• Confirm – monitor, adjust

•   Expand users/endpoints
•   Confirm – monitor/adjust
•   Expand users/endpoints
•   …




20
             PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Managing Device Control
Dashboard Widgets
     Look for anomalies                                       Look for suspicious use or needed
                                                                      policy adjustments




22
       PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Temporary Policies




23
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Temporary Permissions (offline endpoints)
                                 Challenge/response tool




24
      PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Password Recovery
                                Challenge/response tool




25
     PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Adding Individual AD Users
For exceptions only




26
          PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Adding Devices to Collections
Allowing use of new devices




27
          PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
More Information
• Free Security Scanner Tools                                       • Get a Quote (and more)
 » Application Scanner – discover all the apps                            http://www.lumension.com/
   being used in your network                                             intelligent-whitelisting/buy-now.aspx#5
 » Vulnerability Scanner – discover all OS and
   application vulnerabilities on your network
 » Device Scanner – discover all the devices
   being used in your network
   http://www.lumension.com/Resources/
   Security-Tools.aspx


• Lumension® Device Control
 » Online Information:
   http://www.lumension.com/device-control

 » Free Downloadable Trial:
   http://www.lumension.com/device-control-
   software/usb-security-protection/free-trial.aspx




28
               PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
Global Headquarters
8660 East Hartford Drive
Suite 300
Scottsdale, AZ 85255

1.888.725.7828
info@lumension.com
http://blog.lumension.com

More Related Content

PDF
HP, the gloabl leader in Thin Clients
PDF
Tg nec 55_b2
PDF
Tg nec 46_b6
PDF
Tg nec 40_b6
PDF
Slfsrv 36
PDF
Tg nec 46_b2
PDF
Selfserv Checkout Ds
PDF
Tg nec 40_b2
HP, the gloabl leader in Thin Clients
Tg nec 55_b2
Tg nec 46_b6
Tg nec 40_b6
Slfsrv 36
Tg nec 46_b2
Selfserv Checkout Ds
Tg nec 40_b2

Similar to Best Practices in Device Control: An In-Depth Look at Enforcing Data Protection Policies (20)

PDF
PPT
Sanctuary Device Control
PPTX
K Two Asset Tracking Solutions Impre 090225
PDF
Ajax World West I Phone Summit
PDF
Protection against Lost or Stolen Data with Novell ZENworks Endpoint Security...
PDF
Webinar: Understanding the System Center suite & Windows Server 2012
PPTX
W8 client management
PDF
Webinar: Mobile Device Management
PDF
Mobile device management
PPTX
Airwatch - Mobile Content Strategies and Deployment Best Practices
PPTX
Mobile device management v5
PPSX
Windows7/8 Migration Strategies
PPTX
GTB DLP - Content Aware Security Suite
PDF
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...
DOC
Leccion 2 Sistemas Operacionales
PPTX
Mark Carlile, EMEA Enterprise Lead at Airwatch - Mobile content strategies an...
PPT
PSoC USB HID
PDF
IBM Virtual Desktop Virtualization
PPTX
Mobile Management
PPTX
Gtb Product Technical Present
Sanctuary Device Control
K Two Asset Tracking Solutions Impre 090225
Ajax World West I Phone Summit
Protection against Lost or Stolen Data with Novell ZENworks Endpoint Security...
Webinar: Understanding the System Center suite & Windows Server 2012
W8 client management
Webinar: Mobile Device Management
Mobile device management
Airwatch - Mobile Content Strategies and Deployment Best Practices
Mobile device management v5
Windows7/8 Migration Strategies
GTB DLP - Content Aware Security Suite
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...
Leccion 2 Sistemas Operacionales
Mark Carlile, EMEA Enterprise Lead at Airwatch - Mobile content strategies an...
PSoC USB HID
IBM Virtual Desktop Virtualization
Mobile Management
Gtb Product Technical Present
Ad

More from Lumension (20)

PPTX
Using SCCM 2012 r2 to Patch Linux, UNIX and Macs
PPTX
2015 Endpoint and Mobile Security Buyers Guide
PPTX
Top 10 Things to Secure on iOS and Android to Protect Corporate Information
PPTX
2014 BYOD and Mobile Security Survey Preliminary Results
PPTX
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...
PPTX
Careto: Unmasking a New Level in APT-ware
PPTX
Securing Your Point of Sale Systems: Stopping Malware and Data Theft
PPTX
2014 Security Trends: SIEM, Endpoint Security, Data Loss, Mobile Devices and ...
PPTX
2014 Data Protection Maturity Survey: Results and Analysis
PDF
Greatest It Security Risks of 2014: 5th Annual State of Endpoint Risk
PPTX
Windows XP is Coming to an End: How to Stay Secure Before You Migrate
PPTX
Adobe Hacked Again: What Does It Mean for You?
PPTX
Real World Defense Strategies for Targeted Endpoint Threats
PPTX
APTs: The State of Server Side Risk and Steps to Minimize Risk
PPTX
2014 Ultimate Buyers Guide to Endpoint Security Solutions
PPTX
Data Protection Rules are Changing: What Can You Do to Prepare?
PPTX
Java Insecurity: How to Deal with the Constant Vulnerabilities
PPTX
BYOD & Mobile Security: How to Respond to the Security Risks
PPTX
3 Executive Strategies to Reduce Your IT Risk
PDF
The Evolution of Advanced Persistent Threats_The Current Risks and Mitigation...
Using SCCM 2012 r2 to Patch Linux, UNIX and Macs
2015 Endpoint and Mobile Security Buyers Guide
Top 10 Things to Secure on iOS and Android to Protect Corporate Information
2014 BYOD and Mobile Security Survey Preliminary Results
Using SCUP (System Center Updates Publisher) to Security Patch 3rd Party Apps...
Careto: Unmasking a New Level in APT-ware
Securing Your Point of Sale Systems: Stopping Malware and Data Theft
2014 Security Trends: SIEM, Endpoint Security, Data Loss, Mobile Devices and ...
2014 Data Protection Maturity Survey: Results and Analysis
Greatest It Security Risks of 2014: 5th Annual State of Endpoint Risk
Windows XP is Coming to an End: How to Stay Secure Before You Migrate
Adobe Hacked Again: What Does It Mean for You?
Real World Defense Strategies for Targeted Endpoint Threats
APTs: The State of Server Side Risk and Steps to Minimize Risk
2014 Ultimate Buyers Guide to Endpoint Security Solutions
Data Protection Rules are Changing: What Can You Do to Prepare?
Java Insecurity: How to Deal with the Constant Vulnerabilities
BYOD & Mobile Security: How to Respond to the Security Risks
3 Executive Strategies to Reduce Your IT Risk
The Evolution of Advanced Persistent Threats_The Current Risks and Mitigation...
Ad

Recently uploaded (20)

PDF
Taming the Chaos: How to Turn Unstructured Data into Decisions
PDF
CloudStack 4.21: First Look Webinar slides
PPTX
Benefits of Physical activity for teenagers.pptx
PPTX
Final SEM Unit 1 for mit wpu at pune .pptx
PDF
“A New Era of 3D Sensing: Transforming Industries and Creating Opportunities,...
PPTX
Configure Apache Mutual Authentication
DOCX
search engine optimization ppt fir known well about this
PDF
Consumable AI The What, Why & How for Small Teams.pdf
PDF
The influence of sentiment analysis in enhancing early warning system model f...
PDF
Zenith AI: Advanced Artificial Intelligence
PDF
A proposed approach for plagiarism detection in Myanmar Unicode text
PDF
Getting started with AI Agents and Multi-Agent Systems
PPTX
TEXTILE technology diploma scope and career opportunities
PDF
OpenACC and Open Hackathons Monthly Highlights July 2025
PPTX
The various Industrial Revolutions .pptx
PDF
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
PPTX
2018-HIPAA-Renewal-Training for executives
PPT
Module 1.ppt Iot fundamentals and Architecture
PDF
How IoT Sensor Integration in 2025 is Transforming Industries Worldwide
PPTX
Modernising the Digital Integration Hub
Taming the Chaos: How to Turn Unstructured Data into Decisions
CloudStack 4.21: First Look Webinar slides
Benefits of Physical activity for teenagers.pptx
Final SEM Unit 1 for mit wpu at pune .pptx
“A New Era of 3D Sensing: Transforming Industries and Creating Opportunities,...
Configure Apache Mutual Authentication
search engine optimization ppt fir known well about this
Consumable AI The What, Why & How for Small Teams.pdf
The influence of sentiment analysis in enhancing early warning system model f...
Zenith AI: Advanced Artificial Intelligence
A proposed approach for plagiarism detection in Myanmar Unicode text
Getting started with AI Agents and Multi-Agent Systems
TEXTILE technology diploma scope and career opportunities
OpenACC and Open Hackathons Monthly Highlights July 2025
The various Industrial Revolutions .pptx
Hybrid horned lizard optimization algorithm-aquila optimizer for DC motor
2018-HIPAA-Renewal-Training for executives
Module 1.ppt Iot fundamentals and Architecture
How IoT Sensor Integration in 2025 is Transforming Industries Worldwide
Modernising the Digital Integration Hub

Best Practices in Device Control: An In-Depth Look at Enforcing Data Protection Policies

  • 1. Best Practices in Device Control An In-Depth Look at Enforcing Data Protection Policies PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 2. Today’s Agenda Introduction Augment Your Endpoint Security with Device Control to Protect Your Data • Laying the Groundwork • Preparing for Enforcement • Enforcing Policy • Managing Device Control Q&A
  • 3. Why Device Control Is Important Today’s Endpoint Security Stack Significant Data Loss / Theft Issues AV Device Control Application Control Patch & Configuration Management 3 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 4. Benefits of Enforceable Device Control Policy Malware Costs Money Data Breaches Cost Money 4 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 5. Device Control Best Practices Laying the Groundwork Device Managing Preparing for Management Device Control Enforcement Process Enforcing Policy 5 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 7. Know Your Organization’s Security Profile Permissive Moderate Stringent 7 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 8. Policy Considerations Devices and Who, Where Connections Permission Types When 8 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 9. Active Directory Synchronization Schedule 9 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 10. What Can You Control? Physical Interfaces Wireless Interfaces Device Types • USB • Wi-Fi • Removable Storage Devices • FireWire • Bluetooth • External Hard Drives • PCMCIA • IrDA • CD / DVD Drives • ATA / IDE • Wireless NICs • Floppy Drives • SCSI • Tape Drives • LPT / Parallel • Printers • COM / Serial • Modems / Secondary Network • PS/2 Access Devices • PDAs and other handhelds • Imaging Devices (Scanners) • Biometric Devices • Windows Portable Devices • Smart Card Readers • PS/2 Keyboards • User-Defined Devices 10 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 11. A Good Device Control Strategy Policy Scope Policy Assignments Preferred Entire Device Class ‘Everyone’ Device Collection - Models AD User Group Device Collection - Devices Individual AD User Endpoint Create policies at the Endpoint Group (static) highest level possible Endpoint Group (dynamic) 11 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 12. Permission Types & Times of Enforcement 12 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 13. Discovery 13 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 14. Very Important User Communication Executive Sponsor 14 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 16. Creating Policies Work one class at a time For each class Biometric Sensors Do we use these? Can they be managed USB Printers as a single class? What types of DVD/CD permissions? Everyone, User Groups, Removable Storage Users, Endpoints What exceptions need et cetera to be accounted for? 16 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 17. Device Collections 17 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 18. Encryption Options • Don’t allow users to encrypt devices and DVD/CD media • Allow users the option to encrypt devices and DVD/CD media • Force users to encrypt devices and DVD/CD media • Encrypted Device Access » Password » User certificate 18 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 20. Phased Rollout • User communication • Start with a small group of users/endpoints • Proceed one device class at a time until all are enforcing your policies • Confirm – monitor, adjust • Expand users/endpoints • Confirm – monitor/adjust • Expand users/endpoints • … 20 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 22. Dashboard Widgets Look for anomalies Look for suspicious use or needed policy adjustments 22 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 23. Temporary Policies 23 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 24. Temporary Permissions (offline endpoints) Challenge/response tool 24 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 25. Password Recovery Challenge/response tool 25 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 26. Adding Individual AD Users For exceptions only 26 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 27. Adding Devices to Collections Allowing use of new devices 27 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 28. More Information • Free Security Scanner Tools • Get a Quote (and more) » Application Scanner – discover all the apps http://www.lumension.com/ being used in your network intelligent-whitelisting/buy-now.aspx#5 » Vulnerability Scanner – discover all OS and application vulnerabilities on your network » Device Scanner – discover all the devices being used in your network http://www.lumension.com/Resources/ Security-Tools.aspx • Lumension® Device Control » Online Information: http://www.lumension.com/device-control » Free Downloadable Trial: http://www.lumension.com/device-control- software/usb-security-protection/free-trial.aspx 28 PROPRIETARY & CONFIDENTIAL - NOT FOR PUBLIC DISTRIBUTION
  • 29. Global Headquarters 8660 East Hartford Drive Suite 300 Scottsdale, AZ 85255 1.888.725.7828 info@lumension.com http://blog.lumension.com