Environment
- Carbon Black Cloud Console: November 20 Release (0.60) and Higher
- Endpoint Standard Sensor: 3.6.0.1897 and Higher
- Endpoint Advanced: 3.6.0.1897 and Higher
- Endpoint Enterprise: 3.6.0.1897 and Higher
Question
Is there anyway to have Endpoint Standard Device Control block access to cell phones?
Answer
- Not currently
- The Endpoint Standard sensor only tracks mounted volumes
- Some phones, cameras, and other media devices use the Media Transfer Protocol (MTP) or Picture Transfer Protocol (PTP) to transfer media files to/from the machine without ever mounting as a volume
Additional Notes
Device Control only controls USB Mass Storage Devices (removable hard disks, USB thumbsticks, SDHC cards etc) peripherals that the operating system identifies as a mounted volume/drive
Related Content