Endpoint Protection

Hi Guys!

This might be an intensely stupid question, but I haven't been able to find much in the SEP11 help...I want to make sure that SEP will scan any media or devices a user attaches/inserts to their computer, like a jump drive or a DVD.  I've been looking at the device control policy settings in the manager portal, but as far as I can tell it will only block devices from being attached.

I'm probably missing something, and I'm sure this capability probably exists, because it seems like it'd be a pretty common requirement, but I can't seem to find it.

If anyone can point me in the right direction, I'd appreciate it.

If it helps, I'm using SEP version: 11.0.1000.1375

Hi julisana
                  do you want to lunch the device scanning automatically when inserted. If yes I don't think there is any scope of that in SEP. But not to worry as the autoprotect constantly scans the device when accessed which should detect any threat which is lunching from external device.

Julisana,

Just imagine if u insert an external Harddrive which is around 400Gig.

If this was the feature to scan a device autmatically when it connects to any of your USB, then it could take several hours scanning that drive. Also it makes your system too busy/slow.

Hence no AV vendor provide this feature of automatic scanning of External device when attached to USB.

Also, if there are threats in the external device and when the threats tries to copy/write itself on the local hard-disk, then SEP 11.0 will definately scan it and detect the same depending upon the signature/definition.

Hence, pls make sure that you are using latest vesion of SEP i.e. MR4MP1a and having definition up-to-date.

Rgrds,
SAM

Hi,

I think you can't do that.
But are you sure that's what you need ?
What will happen when you connect a 16 GB flash drive... SEP will start the scan and you will have your performance down for 5 to 10 minutes.
What SEP does is detect the threat when it's executed or copied...so, the final result will be the same.

Remember that SEP doesn't detect threats when the windows opens... you need to touch the file in some way.

The best way here is to disable auto play for this kind of devices to stop auto-execution of infected files.

HI

This is a function that we need to test USB's in production. The feature should be available for certain applications. Where potentially infected product is tested in a controlled environment and yet not be manaully required