SafeBoot N.V. PORT CONTROL V1-V2 CHANGES

Size: px

Start display at page:

Download "SafeBoot N.V. PORT CONTROL V1-V2 CHANGES"

Shawn Hunt
5 years ago
Views:

1 SafeBoot N.V. PORT CONTROL V1-V2 CHANGES B

2 Table Of Contents SafeBoot N.V. Edisonbaan 15, Nieuwegein, 3439 MN, The Netherlands Tel: +31 (0) Fax: +31 (0) For more information regarding local SafeBoot representatives please take a look at: Port Control V1-V2 Changes Version 2.0 release 4730 Release Paper Document: Port Control V1-V2 Changes Product Version: CD 4730 Last updated: Monday, 17 July 2006 Copyright 2006 SafeBoot N.V. All rights reserved. Printed in The Netherlands. No part of this document may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior written permission from SafeBoot N.V. The information furnished herein is believed to be accurate and reliable. However, no responsibility or liability is assumed by SafeBoot N.V., including its subsidiaries, for its use, nor for any infringements of patents or other rights of third parties resulting from its use. Microsoft and Windows NT are registered trademarks of Microsoft Corporation. SafeBoot is a registered trademark of SafeBoot N.V.. All other trademarks and registered trademarks are the property of their respective holders. 2

3 SafeBoot N.V. Table Of Contents TABLE OF CONTENTS 3 INTRODUCTION TO PORT CONTROL V2 4 USER SPECIFIC POLICIES 4 MORE DEVICE TYPES ARE SUPPORTED 5 USABILITY CHANGES 6 TECHNOLOGY ENHANCEMENTS 7 3

Introduction to Port Control v2 Introduction to Port Control v2 This paper documents the major functional changes between Port Control v1 (PC1) and the new Port Control Version 2 (PC2).

4 Introduction to Port Control v2 Introduction to Port Control v2 This paper documents the major functional changes between Port Control v1 (PC1) and the new Port Control Version 2 (PC2). The latest version is a completely new product, and although it presents many of the same features as PC1, it performs its function in a completely different manner. PC2 is a class based device blocking product, which means that it ties into the device-type interfaces, rather than into the bus or port interfaces. This design change makes it capable of supporting far more device types than previously. PC2 is also user-aware, so device blocking policies can be changed as users log on and off. User Specific Policies Policies can now be applied on a user-by-user basis. PC1 applied a policy to a device, PC2 also applies device policies, but allows (if set) a user policy to override the device default policy. When users login, PC2 looks up their profile in the SafeBoot Management Center, and if set, applies the specific policy assigned to that user if no policy has been assigned, the default machine policy is applied. This feature supports enumeration both by the Windows login user name, and SafeBoot Device Encryption user ObjectID transparently. 4

5 SafeBoot N.V. More Device Types are supported PC2 supports far more device types than PC1, some examples are: PCMCIA devices Serial (COM) USB 1.0, 1.1 and 2.0 devices FireWire (1394) devices ATAPI devices DVD/CD-ROM Drives Disk Drives Imaging Devices Printers Display Adaptors Keyboards Smart Card Readers Platform specific ACPI devices UPS and power controllers Printer Ports (LPT) IrDA (Infrared) SCSI Bluetooth Mice and Other Pointing Devices Sound, Video and Game Controllers Floppy Disk Drives Modems Tape Drives Human Interface Devices PDA s such as Palm and Pocket Windows devices SD Card Controllers PC2 now detects all devices which have ever been plugged into the machine, not only those plugged in since it was installed. This makes getting specific device lists much simpler. Devices such as Sound Card controllers, Codecs, fix disks etc are now all supported. PC2 allows blocking of PDA s directly, not by inference that they are storage devices. Both Palm and Windows Mobile devices appear as separate block able device types. In PC1, composite devices (devices with more than one function, such as a combined keyboard/smart card reader, or video camera with microphone) were complicated to configure as administrators had to navigate through the device details to work out what part they were configuring. PC2 displays these separate components under their appropriate class, so all video cameras appear under the Sound, Video and Game Devices class, regardless of how they are attached to the PC, or whether they are stand-alone or composite. 5

Introduction to Port Control v2 Usability Changes PC2 allows dynamic switching of policies without requiring a reboot. While a user is working, a system administrator can change their device policy.

6 Introduction to Port Control v2 Usability Changes PC2 allows dynamic switching of policies without requiring a reboot. While a user is working, a system administrator can change their device policy. When PC2 applies it any in-use devices now blocked or controlled will be disabled according to the new policy. PC2 now uses the Windows system objects to display the appropriate icons for device types making it easier for administrators to find the device they want to block. The same icons are used in the Windows Device Manager. PC2 also allows the administrator to see directly if the device is restricted (in any way), audited, or if it has time restrictions. Port Control 1 Port Control 2 PC2 uses the new MC5 tool-tray icon, which in the future all our products will share. This provides a single place where any of our products can be configured and their status known. Unlike PC1 which was invisible to the user, PC2 lets them look at the current configuration, and create Specific Devices lists, without being able to modify the policies. Port Control 2 Status Icon. 6

7 SafeBoot N.V. Technology Enhancements This version adds the following new technology improvements: File Synchronization PC2 updates its files and code at the same time as the policy information, so new patches and features can be deployed direct to clients without needing to visit the machine, or use external software such as SMS. Device Class model PC1 used a port model where it monitored certain ports for the presence of new devices. PC2 watches device classes, so rather than looking for USB connected drives (PC1), PC2 looks for Drives, however they are attached. This gives the capacity to support many more types of device, and also apply controls other than simple block/allow such as block removable, allow read only etc. You can now specify the hours a particular device is useable for, and what days, for example you can specify that PDA s are only available for connection between 12pm and 13:00pm, or that digital cameras cannot be used at weekends or out of hours. As well as being able to block devices, you can now make many device types readonly, for example CD-ROM writers can be switched into read-only mode for certain users (or all users) 7

Device usage statistics per user

Device usage statistics per user Generated on: Generated by: 4-May-2 :4 GFI User Description: This report shows a list of external devices connected by each user together with the number of allowed and denied access requests for each