Media Encryption & Port Protection Deep Dive: USB Control, Encryption & Device Authorization
This article is part of my Harmony Endpoint Deep Dives series, originally published on Check Point CheckMates. It is written for a cloud-managed deployment (Infinity Portal / Web Management); where an on-premises Management Server behaves differently, that is called out. Purpose The USB port is one of the easiest ways data walks out of a company, and one of the easiest ways malware walks in. This…
This article delves into Media Encryption & Port Protection (ME&PP), a security feature designed to safeguard sensitive data on removable devices. ME&PP operates in a cloud-managed environment, such as Infinity Portal or Web Management, with on-premises Management Servers functioning differently.
ME&PP encrypts data and mandates authorization before access is granted. The process begins by distinguishing between storage devices (like USB storage, SD cards, and external drives) that allow data file storage and peripheral devices (like keyboards, mice, and modems) that do not.
The write action dictates the behavior when users copy files to a USB stick. There are five predefined write action options: allowing any data writing, encrypting business-related file types while permitting unencrypted non-business files, encrypting all data, blocking all writes, or allowing user overrides with justifications. Only "encrypt business-related data" is recommended for most organizations since it balances data security with user convenience.
ME&PP also employs a UUID Site Trust Model, assigning a unique identifier to each management instance (Site). When an encrypted device is connected to another device, ME&PP compares the device's UUID with the connected Site's UUID to determine access. If the UUIDs match or the device is connected to a trusted Site, access is granted; otherwise, access is denied.
For devices incapable of data storage, ME&PP controls ports directly, with predefined actions such as allowing essential devices while blocking all transmitting devices or allowing all peripheral devices without restrictions. Custom actions can also be set per-device.
ME&PP can scan inserted media for malware and unauthorized file types and prompt users to scan manually or automatically or authorize an admin to do so after a clean scan. Unauthorized file types can be blocked or allowed, depending on the authorization mode. Optical media scanning is supported from client version E80.64 onwards.
ME&PP also allows offline access to encrypted media using passwords or recovery options. Container sizing and lockout policies ensure secure data handling even in environments without ME&PP.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
