USB device control
USB device control lets you restrict which USB peripherals a device will accept, protecting against unauthorized devices being plugged into hardware in the field. It is configured from the dashboard (or the API).
How it works
When USB device control is enabled, the device accepts only USB peripherals that match your allow rules; everything else is rejected. When it is disabled, USB devices are accepted normally.
Allow rules
Each allow rule describes the USB devices it permits. You can match on:
| Criterion | Matches on |
|---|---|
| Device ID | The USB vendor/product identifier. |
| Device name | The device’s reported name. |
| Connected port | The physical port path the device is attached to. |
| Interface | The USB interface class the device exposes. |
| Connection type | How the device is connected. |
Rules can match a specific value or one of a set of values, so you can, for example, allow a specific approved peripheral on any port, or allow only devices connected to a particular internal port.
Recommendations
- Enable USB device control on devices in physically exposed locations.
- Allow only the specific peripherals your deployment needs (for example, an approved cellular modem or sensor), and reject everything else.
- Account for peripherals that are part of the device itself when writing rules, so enabling control does not disable required internal devices.