Kaspersky Embedded Systems Security 3.3 for Linux

Kaspersky Embedded Systems Security for Linux

Print Support Send link

Device Control

Device Control

When the Device Control task is running, Kaspersky Embedded Systems Security manages user access to the devices that are installed on or connected to the client device (for example, hard drives, cameras, or Wi-Fi modules). This lets you protect the client device from infection when external devices are connected, and prevent data loss or leaks. Device Control manages user access to devices using the access rules.

When a device, access to which is denied by the Device Control task, connects to a client device, the application denies the users specified in the rule access to this device and displays a notification. During attempts to read and write on this device, the application silently blocks the users specified in the rule from reading/writing.

Device Control settings

Setting	Description
Device Control enabled / disabled	This toggle button enables or disables Device Control. The check toggle button is switched on by default.
Configure trusted devices	Clicking this link opens the Trusted devices window. In this window, you can add devices to a list of trusted devices by ID or by selecting them from the list of devices detected on the client devices.
Device Control action	Action performed by the application when an attempt is made to access a device to which access is denied in accordance with Device Control rules. Test rules. If you select this option, Kaspersky Embedded Systems Security tests the access rules and generates an event about detection of an attempt to access a device. Apply rules (default value). If you select this option, Kaspersky Embedded Systems Security applies Access Control rules and performs the action specified in the rules.
Configure settings for device types	Clicking this link opens the Device types window. In this window, you can configure access rules for various types of devices.
Configure settings for connection buses	Clicking this link opens the Connection buses window. In this window, you can configure access rules for connection buses.

Page top

Trusted devices window

The table contains a list of trusted devices. The table is empty by default.

Trusted device settings

Setting	Description
Device ID	Trusted device ID.
Device name	Name of a trusted device.
Device type	Trusted device type (for example, Hard drive or Smart card reader).
Host name	Name of the client device the trusted device is connected to.
Comment	Comment related to a trusted device.

You can add a device to the list of trusted devices by the device ID or by selecting the required device in the list of devices detected on the user device.

You can edit and delete trusted devices in the table.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

The selected element's settings are changed in a separate window.

Page top

Trusted device (Device ID) window

In this window, you can add a device to the list of trusted devices by its identifier.

Adding device by ID

Setting	Description
Device ID	Entry field for a device ID or device ID mask. You can manually specify the device ID or copy the ID of the required device from the Devices detected on hosts list. To specify an identifier, you can use the following wildcards: * (any sequence of characters) or ? (any single character). For example, you can specify the USBSTOR* mask to allow access to all USB drives.
Comment	Entry field for a comment (optional). This field is available after you enter the device ID, and click the Next button.

Setting

Description

Device ID

Entry field for a device ID or device ID mask. You can manually specify the device ID or copy the ID of the required device from the Devices detected on hosts list.

To specify an identifier, you can use the following wildcards: * (any sequence of characters) or ? (any single character). For example, you can specify the USBSTOR* mask to allow access to all USB drives.

Comment

Entry field for a comment (optional). This field is available after you enter the device ID, and click the Next button.

Page top

Trusted device window (List of detected devices)

In this window you can add a device to the list of trusted devices by selecting it in the list of existing managed devices.

Information about existing devices is available only if an active policy exists and synchronization with the Network Agent has been completed (the synchronization interval is specified in the Network Agent policy properties; the default setting is 15 minutes). If you create a new policy and there are no other active ones, the list will be empty.

Adding device from list

Setting	Description
Device type	In this drop-down list, you can select type of devices to be displayed in the Devices detected on hosts table.
Device ID mask	Entry field for a device ID mask.
Comment	Entry field for a comment (optional). This field is available after you select the devices, and click the Next button.

Clicking the Filter button opens the window, where you can set up the filtering of displayed information about devices.

Page top

Device types window

In this window, you can configure access rules for various types of devices.

Access rules for device types

Setting	Description
Access to data storage devices	The table contains the following columns: Type represents device types (for example, Hard drives, Printers). Access represents the access mode for devices of this type. You can select one of the following access modes: Allow, to allow access to devices of this type. Block, to block access to devices of this type. Depends on bus (default value), to allow or block access to devices depending on the access rule for a bus used for connecting a device. By rule – allow or block access to devices, depending on the access rule and schedule. You can configure the access rule and its schedule by clicking the required device type.
Access to other devices	The table contains the following columns: Type – type of device (for example, Input devices, Sound adapters). Access represents the access mode for devices of this type. You can select one of the following access modes: Allow, to allow access to devices of this type. Block, to block access to devices of this type. The Block access rule cannot be selected for network adapters. Depends on bus (default value), to allow or block access to devices depending on the access rule for a bus used for connecting a device.

Setting

Description

Access to data storage devices

The table contains the following columns:

Type represents device types (for example, Hard drives, Printers).
Access represents the access mode for devices of this type. You can select one of the following access modes:
- Allow, to allow access to devices of this type.
- Block, to block access to devices of this type.
- Depends on bus (default value), to allow or block access to devices depending on the access rule for a bus used for connecting a device.
- By rule – allow or block access to devices, depending on the access rule and schedule. You can configure the access rule and its schedule by clicking the required device type.

Access to other devices

The table contains the following columns:

Type – type of device (for example, Input devices, Sound adapters).
Access represents the access mode for devices of this type. You can select one of the following access modes:
- Allow, to allow access to devices of this type.
- Block, to block access to devices of this type. The Block access rule cannot be selected for network adapters.
- Depends on bus (default value), to allow or block access to devices depending on the access rule for a bus used for connecting a device.

Page top

Device access rules window

In this window, you can configure access rules and schedules for the selected device type.

Device access rules and schedules

Setting	Description
Access to device	Access rule for devices of the selected type: Allow: allow access to devices of the selected type. Block: prohibit access to devices of the selected type. Depends on bus (default value), to allow or block access to devices depending on the access rule for a bus used for connecting a device. By rule – allow or block access to devices, depending on the access rule and schedule.
List of device access rules	The table contains a list of access rules and consists of the following columns: Access schedule – names of existing access schedules. Users and/or groups of users – names of users or names of user groups, to which the access rule will apply. Access – access type for the schedule: Allow (grant access to devices of the selected type) or Block (deny access to devices of the selected type). By default, the table contains the Default schedule access schedule, which provides all users with full access to devices (the \Everyone option is selected in the list of users and groups) at any time, if access by the connection bus is allowed for this type of device. You can add, edit, and delete access rules. Clicking the Delete button removes the selected item from the table. This button is available if at least one item is selected in the table.

Setting

Description

Access to device

Access rule for devices of the selected type:

Allow: allow access to devices of the selected type.
Block: prohibit access to devices of the selected type.
Depends on bus (default value), to allow or block access to devices depending on the access rule for a bus used for connecting a device.
By rule – allow or block access to devices, depending on the access rule and schedule.

List of device access rules

The table contains a list of access rules and consists of the following columns:

Access schedule – names of existing access schedules.
Users and/or groups of users – names of users or names of user groups, to which the access rule will apply.
Access – access type for the schedule: Allow (grant access to devices of the selected type) or Block (deny access to devices of the selected type).

By default, the table contains the Default schedule access schedule, which provides all users with full access to devices (the \Everyone option is selected in the list of users and groups) at any time, if access by the connection bus is allowed for this type of device.

You can add, edit, and delete access rules.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

Page top

Device access rules window

In this window, you can configure the device access rule.

Device access rule

Setting	Description
Device access rule settings	Access to devices of the selected type: Allow (default value) – provide access to the devices of the selected type. Block: prohibit access to devices of the selected type.
Users and/or user groups	Name of the user or user group to which the rule applies. The default value is \All (all users). You can add, edit, and delete users or user groups. Clicking the Delete button removes the selected item from the table. This button is available if at least one item is selected in the table.
Schedule for access to devices	Schedule for the specified users' access to devices. The default value is Default schedule. The Default schedule link opens the Schedules window, in which you can configure a different access schedule.

Setting

Description

Device access rule settings

Access to devices of the selected type:

Allow (default value) – provide access to the devices of the selected type.
Block: prohibit access to devices of the selected type.

Users and/or user groups

Name of the user or user group to which the rule applies.

The default value is \All (all users).

You can add, edit, and delete users or user groups.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

Schedule for access to devices

Schedule for the specified users' access to devices. The default value is Default schedule. The Default schedule link opens the Schedules window, in which you can configure a different access schedule.

Page top

Select user or group window

In this window, you can specify a local or domain user or user group for which you want to configure an access rule.

Configuring an access rule

Setting	Description
Manually	If this option is selected, in the field below enter the name of the local or domain users or the name of a user group, to which the device access rule will apply.
List of groups or users	If this option is selected, in the search field you can enter search criteria for the name of the user or name of the user group, to which the device access control rule will apply, or you can select the name of the user group in the list below.

Page top

Schedules window

In this window, you can specify the schedule for the selected device access rule.

You can add, edit, and delete access schedule.

Clicking the Delete button removes the selected item from the table.

This button is available if at least one item is selected in the table.

You cannot delete the Default schedule.

Page top

Schedule for access to devices window

In this window, you can configure the device access schedule. You can configure schedules only for hard drives, removable drives, floppy disks, and CD/DVD drives.

In the General settings->Application settings section, if the Block access to files during scans check box is cleared, then it is not possible to block access to devices using a device access schedule.

Schedule for access to devices

Setting	Description
Name	Entry field for the access schedule name.
Time intervals	The table where you can select time intervals for the schedule (days and hours). Intervals highlighted in green are included to the schedule. To exclude an interval from the schedule, click the corresponding cells. Intervals excluded from the schedule are highlighted in gray. By default, all intervals (24/7) are included to the schedule.

Setting

Description

Name

Entry field for the access schedule name.

Time intervals

The table where you can select time intervals for the schedule (days and hours).

Intervals highlighted in green are included to the schedule.

To exclude an interval from the schedule, click the corresponding cells. Intervals excluded from the schedule are highlighted in gray.

By default, all intervals (24/7) are included to the schedule.

Page top

Connection buses window

In this window, you can configure access rules for connection buses.

Connection rules for buses

Setting	Description
Connection bus	Connection bus used to connect devices to the client device: FireWire USB
Access	This toggle button enables or disables access to devices that use this connection bus: Allow (default value), to provide access to the devices connected using this connection bus. Block, to deny access to the devices connected using this connection bus.

Setting

Description

Connection bus

Connection bus used to connect devices to the client device:

FireWire
USB

Access

This toggle button enables or disables access to devices that use this connection bus:

Allow (default value), to provide access to the devices connected using this connection bus.
Block, to deny access to the devices connected using this connection bus.

Page top

Contents

Device Control

Trusted devices window

Trusted device (Device ID) window

Trusted device window (List of detected devices)

Device types window

Device access rules window

Device access rules window

Select user or group window

Schedules window

Schedule for access to devices window

Connection buses window