Access Control

Controlling access to drive and device types

• In the User management/Computer management | Control, select a user or a computer in the User management/Computer management work area.
• In the lower area, select the Devices and ports tab.
• In the Profile drop-down, select whether permissions apply to online or offline mode. Offline mode means that there is no connection to EgoSecure Server.
• Right-click a device.
• Select an access type in the context menu. Depending on the device type, the following options are available:
  • Not controlled (EgoSecure doesn’t control a selected device)
  • No access
  • Read access (only storage media)
  • Write access (only storage media)
  • Print access (only locally connected printers)
  • Full access
  • Scheduled access, for details refer to: Configuring scheduled access
  • Playback access (only sound, video and game controllers)
  • Temporary access, for details refer to: Configuring one-time access
• Click Save.
• The new permissions apply on the Agents.

Controlling access to port types

You can control access to ports. The following ports are controllable:

• FireWire
• PCMCIA
• Parallel
• Serial
• USB (except mice and keyboards)

Granting temporary or scheduled access

Restricting access globally to device models

To globally limit the usage of specific device models, add them to permitted device models. Not listed device models are globally forbidden (exception: User-specific known devices). Under Permitted device models you can add all devices ever connected to Clients.

Access rights for devices from permitted device models

Permitted device models have access rights assigned to a device class. E.g.: flash card SMI USB DISK Device has read access, because under Computer management | Control | Devices and ports, read access is assigned to the external storage device class.

Creating a list of permitted device models

• Go to Permitted devices | Removable devices | Permitted device models.
• To search on a computer for devices, which are currently connected or have been connected:
  • Select a computer in the List of EgoSecure Agents work area. To multi-select computers, hold-down Ctrl and click.
  • In the Permitted device models area, click Scan computer.

• The Add new device – Scan computer dialog appears. Devices already added to the list of permitted ones are highlighted with bold, devices which were disconnected have a red icon.
• 
  • To hide unconnected devices, enable Show only available devices.
  • Select a device or a port from the list. To multi-select, hold-down Ctrl and click.
  • Click Add. 
  • The dialog closes. The device is added to the list of permitted ones. -or-
  • In the Add new device – Scan computer dialog, select the added device and click Update to close the dialog and update the device info.
• To search the database for devices, which are currently connected or have been connected to network computers
  • In the Permitted device models area, select Devices database.
  • 
• The Add new device – Devices database dialog appears.
• In the Computer drop-down, select computers to see the list of devices on the selected computers. Select <All> to see the list of devices on all computers of the directory.
• Select a device. To multiselect, hold down Ctrl and click.
• Click Add.
• The dialog closes. The device is added to the list of permitted ones.
• Click Save.
• The white list of device models is applied to all Agents of a company where Access Control is activated. Not listed device models are blocked.

Allowing user-specific or computer-specific known devices

In individual device permissions, you can specify the devices that a user/computer is allowed to use regardless of the list of permitted device models and the access rights for device types. Individual access rights also apply if access to the device type is not permitted for the user/computer (defined under User management/Computer management | Control | Devices and ports) or the device model is globally locked (defined under Permitted devices | Permitted device models). What is more, you can allow certain devices to be used only on certain computers. When allowing a device individually, select the criteria according to which the device is identified.

You can use wildcards in the Hardware ID, Serial number and Name fields. These fields are case-sensitive.   

Allowing CD or DVD 

• Go to Permitted devices | Removable devices | Media permissions.
• In the List of EgoSecure agents work area, select a computer where a disk is currently connected. To multi-select computers, hold-down Ctrl and click.
• Click Scan computer. The Device database option is not available, because disks can be added to the list only when they are connected at the moment of adding.
• The Add new device – Scan computer dialog appears.
• Select the CD/DVD and click Add.
• The media appears in the list with the checked box.
• Select the disk and define computer and user permissions for using this disk:
  • In the lower area, click Add.
  • In the Selection of users/Selection of computers dialog, select a user/computer.
  • Click OK to confirm.
• The user/computer appears in the lower area.
• Click the entry in the Access rights column to specify access rights:
  • Full access: Reading and writing allowed. Warning: Changing the data requires to redefine the permissions.
  • Write access: Only writing allowed. Warning: Changing the data requires to redefine the permissions.
  • Read access: Only reading allowed.
  • Scheduled access: Opens the Access rights – time schema dialog, where you specify a time period for permissions.
• Click Save.

To transfer the defined access rights to other optical storage media, use the Copy rights button. For details, see: Copying usage settings

Online Clients

• Via the Access request tab, a user can request specific access rights for one or more device types or instances.
• The following access rights are available depending on a device type:
  • Not controlled (EgoSecure doesn’t control a selected device)
  • Read access (only storage media)
  • Print access (only locally connected printers)
  • Full access
  • Playback access (only sound, video and game controllers)
• Once the requested rights reach the Server, they appear under Administration | Administrator | Access rights requests.

Offline Clients

When the Agent is offline (no connection between Agent and Server), the settings defined for the offline profile apply. For details, see: Configuring offline profile. Changes to offline permissions take effect when Agent becomes online. To apply the changes of rights and settings on offline Agents, use an unblocking code or import a file with settings.

• Exporting the whole user permission profile to a file
• Granting access to known devices via the challenge-response procedure
• Granting access to a device type via an unblocking code

Specifying filter mode  

• Go to Product settings | Filters | Settings.
• Click on
  • White list, to allow only the file types that match the filter settings. All other file types are blocked.
  • Black list, to forbid file types that match the filter settings. All other file types are allowed.

• To additionally scan archives and office files for allowed/blocked file types, enable the In archives or In files of Microsoft Office check boxes under Scan embedded files. The options can now be activated for the default user under User management | Default policies | Default rights (user). The inheritance of the options can be deactivated individually for a user.
• Click Save.
• The specified filter mode applies to all filters assigned to users.

Creating filters

• Go to Product settings | Filters | File type filters.
• In the File type filters area, you can see the predefined filters for audio/video files, compressed files, image files and office files.
• Click Add.
• A new entry appears in the list.

• Enter a filter name.
• To assign the filter to all users where Access Control is activated, enable the Global check box. Global filters unlike inherited filters cannot be disabled individually.
• In the Rule definition area, click Add.
• Specify the rules. You can use wildcards (placeholders) for file names and formats:
  • * replaces any number of characters
  • ? replaces a single character
    • Define a specific file name in the Name column.
    • In the File type column, select a file format from the drop-down list or double-click on the field and enter a file extension. E.g.: jpg filters all jpg files, jp* filters jpeg and jpg
    • To specify a file size limit, double-click the entry in the Limit column. In the File size dialog, define the size of a file and click OK. If you use a black list mode, all files whose size does not exceed the defined limit will be allowed. If you use a white list mode, all files whose size exceeds the defined limit will be blocked.

• Supervisors can add other file formats, if necessary. For details about creating new file formats, see Defining file formats (advanced).
• To copy a filter rule to another filter:
  • Select a rule you want to copy. To select multiple rules, hold down Ctrl and click.
  • Right-click a rule and select Copy into… from the context menu.
  • The Select object dialog appears.
  • Select a filter where to copy the rule. To select multiple filters, hold down Ctrl and click.
  • Click Save to confirm.
  • The rule is duplicated to another filter.
• To move a filter rule to another filter:
  • Select a rule you want to move. To select multiple rules, hold down Ctrl and click.
  • Right-click a rule and select Move into… from the context menu.
  • The Select object dialog appears.
  • Select a filter where to move the rule. To select multiple filters, hold down Ctrl and click.
  • Click Save to confirm.
  • The rule is deleted from the current filter and assigned to the selected filter.
• Click Save.
• The new filter can now be assigned to users or groups.

Assigning filters

• Go to User management and select a user.
• Under Filters, select where a filter takes effect:
  • External storage
  • Network shares (including thin client storage if its control is enabled)
  • Cloud storage

• Enable a filter. 

• Now all existing global filters, filters inherited from a group and/or default user and individually enabled filters are assigned to the user.
• To disable inheritance, enable the Activate individual settings check box.
• The previously inherited filters remain selected, uncheck them, if necessary. Global filters apply no matter whether they are enabled in the first column or not and whether inheritance is enabled or not.
• Click Save.
• If necessary, adjust the options for scanning archives and Microsoft Office files. For details, see: Specifying filter mode
• Go to User management | Settings | User settings.
• In the File type filter – embedded files area, enable the Activate individual settings check box and edit the settings.
• Click Save.
• All files corresponding to the filter are now either allowed (whitelisted) or blocked (blacklisted) for the user.

Temporary disabling filters

• Select a user under User management and then select any tab under Filters. The tab selection plays no role, because the filters will be disabled for all storage types.
• Click the Unblocking code… button.
• The Unblocking code generation – File type filter dialog opens.
• Specify a time period.
• Click Generate.
• The generated code appears in the Code field.
• Copy the code and send it to the Client (e.g. by e-mail).
• Via EgoSecure Agent the user can now enter the code and receive access rights:

Defining file formats (advanced)

Only the Supervisor account can access the File Formats dialog. Delete operations are no longer supported.

If the necessary file format is not in the list of predefined ones, supervisors can specify  a format. This requires the format’s buffer (file signature in a hexadecimal format) and offset (digit, which identifies a fixed place of a signature in a file) values. The buffer and offset values of the most popular file formats can be found on the Internet while unknown formats should be requested from the program developers.

• Go to Product settings | Filters | Content filter definition.
• In the Rules definition area, click Define file formats.
• The File format editor dialog appears.
• Click Add.
• New entry appears.
• In the Format description area, add information about a format:
  • In the Name field, define a format name.
  • In the Extension(s) field, enter file ending. E.g.: jpg, jpeg.
  • In the Comment field, add notes.
  • In the Rule definition area, define rules for a format:
  • In the Buffer field, enter a file signature in a hexadecimal format. E.g.: FF D8 FF
  • In the Offset field, enter a number which identifies the place of a signature in the file. E.g.: 0 (informs that file signature is at the beginning of the file).
  • Click Save.
  • The dialog doesn’t close to all to add more formats.
• Carefully verify the information entered: formats, once added, cannot be deleted.
• Click Close.
• The dialog closes.
• New format appears in the list of predefined formats in the drop-down of the File type column.

Configuring access

Restricting access to certain file formats

You can limit access to specific file formats in clouds: Creating file filters

• Select a user under User management.
• Enable a filter under Filters | Cloud storage tab.
• Click Save.
• The filter takes effect on all cloud storage types where access rights are defined for a user under User management | Control | Cloud storage.

Preventing simultaneous usage of different network connections (antibridging)

You can control network connections so that only one connection (LAN or WLAN) is always available on the clients at the same time.
To use this functionality, it is not necessary to activate the Access Control product for a computer, the Access Control license must be just available under Administration | Licenses | License management.

• Under Computer management | Control, select a computer from the directory service structure.
• In the Antibridging tab, to disable the inheritance of settings from a group or from a default computer, enable the Activate individual settings check box.
• Previously inherited options remain selected, uncheck them if needed.
• Enable the options:
  • No WLAN when LAN is active: Block all WLAN connections if LAN connection is available.
  • No WLAN when WLAN is active: Block all WLAN connections except the one WLAN used for connection from Agent to Server at the moment of assigning this option. If no WLAN is used at the moment, any WLAN is randomly selected from the list of available WLANs.
  • No WLAN when LTE is active: Block all WLAN connections if LTE connection is available.
  • No LAN when WLAN is active: Block all LAN connections if WLAN connection is available.
  • No LAN when LAN is active: Block all LAN connections except the one LAN used for connection from Agent to Server at the moment of assigning this option. If no LAN is used at the moment, any LAN is randomly selected from the list of available LANs.
  • No LAN when LTE is active: Block all LAN connections if LTE connection is available.
  • No LTE when LAN is active: Block all LTE connections if LAN connection is available.
  • No LTE when WLAN is active: Block all LTE connections if WLAN connection is available.
  • No LTE when LTE is active: Block all LTE connections except the one LTE used for connection from Agent to Server at the moment of assigning this option. If no LTE is used at the moment, any LTE is randomly selected from the list of available LTEs.
  • Ignore virtual devices: Do not take network connections on virtual devices into account during antibridging.
• Click Save.

Defining permitted WLANs

When defining permitted WLANs, only the assigned WLANs are permitted. Other WLANs not included in the list are blocked.

Defining permitted WLAN networks

• Go to Permitted devices | Removable devices | WLAN permissions.
• Click Add in the WLAN permissions area.
• Define a name for a WLAN filter.
• In the Rule definition - <filter name> area, click Add and then enter a SSID and/or MAC address of the WLAN access point.
• Enable the Password-protected check box if the connection must be secure.
• Define, for which computers the permission must take effect:
  • To assign the WLAN filter for all computers of the directory service structure, enable the Global check box. This filter works independently of the Access Control product activation on Clients.
  • To assign the WLAN filter only for an individual computer, leave the Global checkbox disabled and assign WLAN filters individually under Computer management | Filters | WLAN permissions.
• Click Save.
• You can now assign the filter to a default computer (with inheritance to all existing computers where Access Control is activated) or to individual computers of a directory service.

Assigning WLAN filter

• Select a computer under Computer management | Filters.
• In the WLAN permissions tab, enable a filter.
• To disable filters inherited from a group and/or from the default computer, enable the Activate individual settings check box.
• The previously inherited filters remain selected, uncheck them, if needed.
• Click Save.
• All WLAN connections that match the filter are now allowed on the computer. Other wireless connections are blocked.

Enabling keyboard control on computer

• Go to Administration | Clients | Client settings.
• In the Control input devices group, enable the Keyboard Control and Automatic keyboard registration options.
• You can now enable the Keyboard Control for the default computer or only for an individual computer. If you enable the Keyboard Control for the default computer, this setting is inherited to all computers. The inheritance can be disabled for computers individually.
• Click Save.
• Go to Computer management | Settings.
• Select the default computer under Default policies or a computer from the directory service structure.
• In the BadUSB protection tab, enable the Keyboard Control check box.
• If you haven’t enabled the option for the default computer and want to enable it individually for a computer, first disable the inheritance by enabling the Activate individual settings check box:

• The keyboard that is currently connected becomes the primary one. This is the only keyboard permitted on this computer, all other keyboards are blocked.Enable the Automatic keyboard registration option.
• Newly connected keyboards are registered. While the option is enabled, all keyboards connected to the computer are automatically added to the individual list of permitted devices (Permitted devices | Individual device permissions) and assigned to the computer. Once the option is disabled, only registered keyboards and the primary keyboard are permitted.
• Click Save.
• The computer-based keyboard control is now enabled.

Allowing users to control keyboards

• In User management | Settings, select a user from the directory service structure.
• In the BadUSB protection tab, enable the Grant keyboard control to user option.
• When connecting a keyboard that is not primary or not registered, a user now decides whether to include it to the individual list of permitted devices for this computer or not. When connecting the keyboard for the first time, a message appears.
• The message text can be edited under Administration | Clients | Custom messages, section Security warnings. For details, see: Customizing user messages.

•  Additionally, enable the Ask user each time on keyboard connection option to show the message each time on connecting a keyboard that is not primary or not registered. In this case, unlike the previous option, the permitted keyboard is not added to the list of individual device permissions for this computer.
• Click Save.
• The user-based keyboard control is now enabled.

Enabling mouse control on computer

• Go to Administration | Clients | Client settings.
• In the Control input devices group, enable the Mouse Control option.
• You can now enable the Mouse Control for a default computer or only for an individual computer. If you enable the Mouse Control for the default computer, this setting is inherited to all computers. The inheritance can be disabled for a computer individually.
• Go to Computer management.
• Select the default computer in Default policies or a computer in the directory service structure.
• Under Settings | BadUSB protection, enable the Mouse Control option.
• If you haven’t enabled the option for the default computer and want to enable it individually for a computer, first disable the inheritance by enabling the Activate individual settings check box.
• Click Save.
• The mouse that is currently connected becomes the primary one. This is the only mouse permitted on this computer, all other mice are blocked if they are not in the individual list of permitted devices.

Controlling access rights for Bluetooth access point

The rights for a Bluetooth access point have a priority over Bluetooth whitelist. E.g: Block virtual adapter is set for Bluetooth access point and mobile devices are in whitelist. => File transfer on mobile devices is blocked.

• Select a directory object under User management/Computer management | Control.
• In the Devices and ports tab, right-click Bluetooth.
• Select one of the following access rights:
  • Full access to allow Bluetooth connections on Agent computer.
  • No access to forbid Bluetooth connections on Agent computer.
  • Block virtual adapters to forbid only file sending, but to allow the connection from an Agent computer to devices via Bluetooth.
  • Scheduled access to apply access rights for a Bluetooth access point according to a scheduler.
• Click Save.

Allowing Bluetooth connections for specific device categories

If the full access or the block virtual adapters access type is assigned to a Bluetooth access point, you can define Bluetooth devices permitted to connect to this access point. Specify Bluetooth device categories (Bluetooth whitelist) or specific Bluetooth devices that the user is allowed to use. Bluetooth device permissions have a priority over Bluetooth whitelist.

Allowing Bluetooth connections for known devices

If full access or block virtual adapters access type is assigned to a Bluetooth access point, you can define known Bluetooth devices permitted to connect to this access point. Define specific Bluetooth devices that the user is allowed to connect. Bluetooth device-specific permissions have a priority over Bluetooth whitelist.

• Go to Permitted devices | Bluetooth devices.
• To add a Bluetooth device, click Scan computer or Devices database. For details, see: Allowing device for user
• The device appears in the list.
• If there is no whitelist defined, add an empty whitelist to block all other Bluetooth devices except the ones listed:
  • Click Add whitelist.
  •  Define a name and click Add.
• Now only added Bluetooth devices are allowed.
• Assign the device to a directory object:
  • In the lower area, select the User or Computer tab.
  • Click Add.
  • The Selection of users or Selection of computers dialog appears.
  • In the directory service structure, select a user or a computer where Access Control product is activated.
  • Click OK to confirm.
• The Selection of users or Selection of computers dialog closes.
• In the Bluetooth devices area, click Save.
• The added directory objects are allowed to use only listed Bluetooth devices.

Enabling PRESENSE control

To use PRESENSE connector, the PRESENSE certificate is required.

• Import the PRESENSE certificate for the Current user. For details, see in help center: Importing certificate
• Go to Administration | Clients | Client settings.
• Check the Enable PRESENSE Connector box.

• The Windows Security dialog appears.
• Select the displayed certificate or click More choices to select a different certificate.
• Click OK in the Windows Security dialog to confirm.
• The Windows Security dialog closes.
• Click Save.
• PRESENSE connector is now enabled and configured. Storage devices where not clean files are detected, are blocked completely if no PRESENSE filter is enabled.

Enabling and assigning PRESENSE filter

If the PRESENSE report of a storage device contains files marked as 'not clean', EgoSecure denies access to the entire storage device. If the PRESENSE filter is enabled for users, only access to unclean files is blocked. Access to other files is granted if they are not blocked by another file filter. For details, see: File type filters. To enable the filter, perform the following steps: 

• Select a user under User management | Filters.
• In the External storage tab, enable the PRESENSE approved files (in case of the white list mode) or PRESENSE unapproved files (in case of the black list mode).
• Click Save.
• The PRESENSE filter is now assigned to the user.

Adding a network login session to exclusions – by user SID

• Go to Product settings | Control | Network login exclusions.
• Click Add SID on the toolbar.
• A new entry appears.
• In the Value column, enter the SID of the user, whose network sessions you want to exclude from processing.
• (optional) In the Comments column, add your description.
• Click Save.

Adding a network login session to exclusions – by user name

• Go to Product settings | Control | Network login exclusions.
• Click Add name on the toolbar.
• A new entry appears.
• In the Value column, enter the name of a user, whose network sessions you want to exclude from processing.
• (optional) In the Comments column, add your description.
• Click Save.