USB device control
Restrict which USB peripherals a device will accept.
USB device control lets you restrict which USB peripherals a device will accept, protecting against unauthorized devices being plugged into hardware in the field. It is configured from the dashboard (or the API).
How it works
When USB device control is enabled, the device accepts only USB peripherals that match your allow rules; everything else is rejected. When it is disabled, USB devices are accepted normally.
Allow rules
Each allow rule describes the USB devices it permits. You can match on:
| Criterion | Matches on |
|---|---|
| Device ID | The USB vendor/product identifier. |
| Device name | The device’s reported name. |
| Connected port | The physical port path the device is attached to. |
| Interface | The USB interface class the device exposes. |
| Connection type | How the device is connected. |
Rules can match a specific value or one of a set of values, so you can, for example, allow a specific approved peripheral on any port, or allow only devices connected to a particular internal port.
Recommendations
- Enable USB device control on devices in physically exposed locations.
- Allow only the specific peripherals your deployment needs (for example, an approved cellular modem or sensor), and reject everything else.
- Account for peripherals that are part of the device itself when writing rules, so enabling control does not disable required internal devices.
Test before wide rollout
Apply your USB rules to a representative device first and confirm all required peripherals still work before rolling the policy out to a fleet.Related
- Remote access — reaching a device without physical access.
- Security — the rest of this section.
- Configuration reference — where USB device control and allow rules are set.