In short
USB device control is an endpoint security feature that decides which removable media and peripherals can be used on your computers. You set policies by device class, vendor, product or serial number to allow, make read-only or block them, approve company-issued drives, and log what was connected and copied. Most business endpoint platforms include it in the same agent.
Get a quote for USB device control
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why control USB and other peripherals
The NCSC's guidance on using peripherals securely sets out the risks clearly. Ports and short-range wireless links are useful, but each is another way into a device and out of it:
- Removable media such as USB drives and SD cards can carry data out of the organisation, often unencrypted, and are a route for malicious software outside your normal installation process.
- Other USB devices can pretend to be something they are not; the NCSC gives the example of a tool that masquerades as a keyboard to type malicious commands.
- Fast external interfaces such as Thunderbolt allow direct memory access, which a rogue device could use to scan memory for encryption keys and passwords if the computer is not configured to resist it.
- Bluetooth can give attackers unauthenticated access to devices, so the NCSC suggests disabling it where it is not needed, or allowing pairing only with managed peripherals.
- Phones plugged in to charge can also sync or transfer data to a device you do not control.
The NCSC's advice is to assess the business need for each type of interface, set a policy that balances that need against the risk, use management tools to enforce it, and tell users what the policy is and why. On Windows and Mac computers, the device control module of your endpoint security platform is a practical way to do the enforcing, with central rules, exceptions and logs in one console.
How USB device control works
Device control is usually a module of the endpoint protection or EDR agent you already run, managed from the same console. The building blocks are similar across products:
| Setting | What it does | Typical use |
|---|---|---|
| Device class | Applies a rule to a whole category: mass storage, printers, imaging devices, mobile phones, Bluetooth and so on | Block all removable storage by default |
| Access level | Full access, read-only or block | Read-only lets staff open files from a supplier's drive without being able to copy data out |
| Vendor and product | Targets devices from a specific manufacturer or product line | Allow the company's standard encrypted drive model range |
| Serial number | Targets one individual device, where the product supports it | Allow only the drives IT has issued and recorded |
| Groups and exceptions | Different rules for different teams or devices | Allow a design team to use cameras; allow one finance PC a card reader |
| Audit and logging | Records what was connected, by whom and, in some products, which files were copied | Investigating a leak; evidence for auditors |
| Notifications | Tells the user why a device was blocked | Fewer help desk calls |
Most products also let you run a policy in a monitoring mode first, so you can see which devices people really use before you start blocking. That step avoids the classic mistake of blocking a scanner, card reader or headset that a team depends on.
Not sure which level fits? Ask us
Tell us what you need and we will recommend the right level for your organisation, with a quote.
Building a device control policy
A practical sequence that we can help you plan and run:
- Inventory first: turn on device control in audit mode and collect a few weeks of connection data, so you know what is in use.
- Agree the default: for most organisations, block or set read-only for removable storage, and leave keyboards, mice, headsets and docking stations alone.
- Approve what is needed: issue approved drives (ideally hardware-encrypted) and allow them by vendor, product or serial number; allow specific peripherals for teams that need them.
- Decide on exceptions: a time-limited, logged way for IT to allow a device for a specific task, rather than permanent holes.
- Cover Bluetooth and phones: decide whether file transfer over Bluetooth and phone storage are allowed, not just USB sticks.
- Enforce in waves: start with IT and a pilot group, then the rest of the organisation, watching for blocked devices that should have been allowed.
- Review the logs: look at blocked attempts and permitted transfers regularly, and keep the reports as evidence.
Write the outcome into your endpoint security policy so staff know the rules, and reflect it in your endpoint hardening baseline. Disabling auto-run is part of secure configuration in Cyber Essentials, and our sister site explains the secure configuration control.
Encrypting the removable media you allow
Blocking every USB drive is not realistic for some organisations. Where staff genuinely need to carry data, make sure what they carry is encrypted, so a lost drive is an inconvenience rather than a reportable breach. The options are:
- Hardware-encrypted drives issued by IT and allowed by device control, so only those drives can be written to
- Software encryption of removable media enforced by your endpoint platform, where it offers it. Check Point Endpoint Security includes removable media encryption in its Complete and Elite editions, for example
- Operating system encryption such as BitLocker To Go on Windows, managed and reported centrally
Encryption of the computers themselves matters too: see full disk encryption and BitLocker management.
Is USB device control the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Platforms we supply that include device control
You may already own device control without using it. These are the platforms we supply, and what each vendor says its device control covers. Exact capabilities vary by operating system, so we confirm the detail for your estate at quote.
| Platform | Device control | Notes |
|---|---|---|
| CrowdStrike Falcon | Falcon Device Control, included in all the Falcon Defend bundles we supply | CrowdStrike lists USB and SD card control on Windows and Mac, Bluetooth and Thunderbolt on Mac, and visibility of file activity on removable media. Licensing: Falcon Defend |
| SentinelOne | Device control in Singularity Control and Singularity Complete | USB and Bluetooth on Windows and macOS, alongside firewall control. See SentinelOne Singularity |
| ThreatDown | Device control in ThreatDown Endpoint Protection | Controls access to USB storage and other peripherals from the OneView console. Licensing: ThreatDown Endpoint Protection |
| Bitdefender | Device control in GravityZone endpoint protection | Blocks or restricts USB storage and other attachable devices. See Bitdefender GravityZone |
| TrendAI | Device and application control in Vision One Endpoint Security Core and above | Licensing: TrendAI Vision One Endpoint Security |
| Sophos | Device control in Sophos Endpoint | Covers removable media and Bluetooth. See Sophos Endpoint |
| Check Point | Port protection in Check Point Endpoint Security (Harmony Endpoint) from the Advanced edition up | Controls which storage and peripheral devices can use USB, Bluetooth and other ports on Windows and macOS; removable media encryption is added in Complete and Elite. See Harmony Endpoint |
Choosing a whole platform is a bigger question than device control alone; our best EDR solutions guide covers what else to compare. If antivirus and endpoint protection products are your starting point, our sister site endpointprotection.uk covers them.
Phones, tablets and built-in controls
Endpoint device control agents mainly cover Windows and Mac computers. For phones and tablets, the NCSC points to the operating system's own management controls: depending on the platform and how the device is enrolled, mobile device management can block USB file transfer and external storage, turn off debugging options and restrict connections to other hosts and accessories. If you manage phones, see our pages on mobile threat defence and Forever Group's mobile device management service.
Firmware settings matter too. Some protections, such as preventing booting from external devices or stopping new direct memory access devices while a computer is locked, are set in firmware or low-level system settings rather than in the endpoint agent. Include them in your build standard.
How we help
We can check whether the platform you already license includes device control, help you run it in audit mode, design the allow and block rules with your teams, and roll enforcement out in stages. If you need a new platform, we can recommend one that fits, with pricing confirmed at quote.
Contact us to talk about USB device control for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is USB device control?
USB device control is a security feature that lets an organisation decide which USB storage devices and other peripherals can be used on its computers. Policies allow, block or make devices read-only by class, vendor, product or serial number, and log what was connected.
Can I make USB drives read-only instead of blocking them?
Yes. Most device control tools support a read-only setting for removable storage, so staff can open files from a drive but cannot copy organisational data onto it. It is a common middle ground between full access and blocking.
Does CrowdStrike have USB device control?
Yes. CrowdStrike Falcon Device Control gives visibility of and control over USB and other removable media. It is included in all the Falcon Defend bundles we supply, alongside Falcon Prevent next-gen antivirus and Falcon Firewall Management.
Can I allow only company-issued USB drives?
Yes, in most products. You block removable storage by default and allow approved drives by vendor and product, or by individual serial number where the product supports it. Issuing hardware-encrypted drives and allowing only those is a common approach.
Is USB device control required for Cyber Essentials?
Cyber Essentials does not name device control, but its secure configuration control includes disabling auto-run, and its malware protection control aims to stop untrusted software running. Device control supports both and reduces the risk of data leaving on removable media.
Does device control work on phones?
Endpoint device control agents generally cover Windows and Mac computers. On phones and tablets, the equivalent restrictions, such as blocking USB file transfer or external storage, are applied through mobile device management, and what is possible depends on the platform and how the device is enrolled.
Still have a question about USB device control?
Ask us and a member of our team will reply by email.