The only reason to scan data you're not intending to read, would be to protect a subsequent reader of that data who was not protected by VSE - a "gatekeeper" function so to speak. We could, but we won't - for all the reasons mentioned above - it makes for an awful user experience and adds almost zero protection.ĭata stored on a removable drive which is not read, might as well not exist. –– Visibility and manageability of data copied to removable media I am not sure how VSE could actually do this anyway.Ī broader solution might be McAfee Device Control (DEC). This could interfere with Word's normal working process. docx file, where Word creates temporary files that the filter might block. That filter might cause problems when Word is used to modify any. docx files from the USB attached drive may create more problems than you solve. A better approach would be to look a DLP to limit what can be written to the attached drive.Ĭreating a filter that limits reading only. docx files to be used from the USB attached drive: This is not easy via VSE. These 2 settings should protect against spreading malware when keeping the signature files completely up to date.Īs for only allowing. To ensure that files written to the USB drive are scanned during the write process. In addition, make sure that from the Control Panel: This setting should be in place regardless of external drives as this is an Absolute Requirement for stopping many forms of malware, for internal drives too. This will ensure that any file on the USB drive is scanned prior to execution (autorun or otherwise). Make the equivalent settings change from ePO if available.
On-Access Scan Properties>All Processes>Scan Items>Scan Files If you find it necessary, those workstations can have the heuristics scan set to High, though expect false positives at this level. Scanning the entire external drive before allowing access is simply a plecebo scan, used to placate the uninformed or the paranoid. The On-Access Scanner can handle this nicely without the performance penalty of scanning the entire drive. As long as this is done, scanning the entire external drive is simply redundant without value. Performance issues with the USB interface, coupled with the recent incredible sizes of new USB attached drives can make scanning the entire drive so painfully slow that your users would find the system unusable.Ī better strategy is to scan all files upon Read and Write to the drive. It is very effective at killing performance and making USB drives impractical. Scanning entire USB (flash) drives 'automatically' is not very effective at stopping malware.
0 kommentar(er)
