This section contains information about Device Control and instructions on how to configure the component settings

Kaspersky

1. Device Control

2. Why Device Control is necessary This component manages access to devices and thus helps reduce the attack surface You can allow full access to trusted devices and temporary access to other devices upon request Manages access to Wi-Fi networks Allows you to flexibly restrict access to data storage devices based on various criteria: Account Operation type: Read Modify Schedule It can block the entire connection bus or access to specific types of external devices

3. Configure Device Control You can allow connecting devices by: Type Bus

4. Connection buses All buses are allowed by default Device types have priority over buses and a device will work if its type is allowed and its bus is prohibited

5. Device types These conditions have a higher priority than conditions for buses Rules for printers: Local Network

6. Rules for devices For storage devices, you can flexibly set up a rule with a schedule for a particular user, taking into account types of file operations

7. Removable drive access log You can configure logging for file operations on removable drives. Select: File operation type File types Account

8. Access to Wi-Fi Three actions are available for Wi-Fi: Allow Block Block with exceptions A network is considered trusted if the combination of parameters matches

9. Anti-Bridging By default, Anti-Bridging is off When enabled, a user can use only one network adapter at a time Anti-Bridging can block simultaneous connections through: Network adapters Wi-Fi Modems Anti-Bridging will apply only to those connection types that you turn On; the others will not be controlled

10. Local notifications and user requests The user can: Accept it Ask the administrator for permanent access Request temporary access

11. Where the administrator can find user requests In the User requests selection; each event contains: Identifier and type of blocked device User name Computer name The operation that was blocked on the device Timestamp

12. Temporary access to blocked devices The user creates a file with a request key Sends it to the administrator The administrator generates an access code Sends it to the user The user activates the key and can access the device

13. Temporary access to blocked devices A request contains: Device ID Computer name User name Desired access period

14. Temporary access to blocked devices The administrator finds the necessary computer in the list of managed devices On the menu, selects Grant access in offline mode

15. Temporary access to blocked devices The administrator adds the request file received from the user Specifies the access duration and the time during which access can be activated Generates a file with an access key and sends it to the user

16. Temporary access to blocked devices

17. Trusted devices A trusted device can be specified by: Device ID Device model Mask of device ID Mask of device model

18. Trusted devices The list shows devices connected to computers where Kaspersky Endpoint Security is installed (and the corresponding event was reported to the Administration Server) To make a device trusted: Select the device Select users

19. Export and import of the list of trusted devices You can export the list of devices to an XML file If necessary, you can add new devices manually (take care to preserve the file structure) And import the file into the policy again

20. Device Control events Device Control has several types of events: Network connection blocked (Critical) Operation with the device prohibited (Critical) Device connection blocked (Warning) Temporary access to the device activated (Warning) — not sent to the Server Device access blockage message to administrator (Warning) Device is disconnected (Info) Device is connected (Info) Operation with the device allowed (Info) File operation performed (Info)

21. Device Control reports The Details tab provides detailed information about each rule-triggering instance Device Control has two reports: Report on Device Control events Report on file operations on removable drives Not all reports are available by default, you will need to add this template manually