USB device control
USB device control lets you restrict which USB peripherals a device will accept, protecting against unauthorized devices being plugged into hardware in the field. It is configured from the dashboard (or the API).
USB control is managed as part of SPEKTRA Edge OS. On a device running the
droplet agent installed from a .deb package, OS management is disabled and
these settings have no effect. See Install the droplet agent.
How it works
When USB device control is enabled, the device accepts only USB peripherals that match your allow rules; everything else is rejected. When it is disabled, USB devices are accepted normally.
Allow rules
Each allow rule describes the USB devices it permits. You can match on:
| Criterion | Matches on |
|---|---|
| Device ID | The USB vendor/product identifier. |
| Device name | The device’s reported name. |
| Connected port | The physical port path the device is attached to. |
| Interface | The USB interface class the device exposes. |
| Connection type | How the device is connected. |
Rules can match a specific value or one of a set of values, so you can, for example, allow a specific approved peripheral on any port, or allow only devices connected to a particular internal port.
Recommendations
- Enable USB device control on devices in physically exposed locations.
- Allow only the specific peripherals your deployment needs (for example, an approved cellular modem or sensor), and reject everything else.
- Account for peripherals that are part of the device itself when writing rules, so enabling control does not disable required internal devices.
Apply your USB rules to a representative device first and confirm all required peripherals still work before rolling the policy out to a fleet.
Related
- Remote access — reaching a device without physical access.
- Security — the rest of this section.