Best way to authorize a USB device in an organisation?

Question

I am developing a project where I need to restrict usage of accessing non white-listed USB devices in the organization's network.

I am using it by checking the VID and PID of that USB devices.

Now, the problem is that if I have, for example, an Apple I-pad, that would have a global VID and PID number. If I white list any of the Apple I-Pads then, with my current scenario, all other Apple I-Pads would be authorized in the network.

Is using VID and PID numbers the best way to check if a USB device is white-listed, or is there a better solution?

Thanks.

Keep in mind this isn't going to prevent people from booting via USB unless you disable "Boot from USB" in BIOS of each computer. — cutrightjm, Oct 01 '12 at 20:28

CL. · Answer 1 · 2012-09-26T11:53:28.023

2

Most USB devices with storage have a serial number; use that.

For example, in Linux, you can see this in the output of lsusb:

lsusb -v
...
Device Descriptor:
  ...
  idVendor 0x1908
  idProduct 0x0102
  ...
  iManufacturer 2 BUILDWIN
  iProduct 3 Digital Photo Frame
  iSerial 1 200807101900000000
  ...

edited Sep 26 '12 at 11:53

answered Sep 26 '12 at 10:38

CL.

1,595
12
12

Can you show any serial number example here – RL89 Sep 26 '12 at 10:45
I am using Asp.net c#, and does not found any Serial Number. – RL89 Sep 28 '12 at 11:33
On Windows, you get the VID, PID and serial# from the device InstanceID. – MSalters Sep 28 '12 at 11:42
serial id is what device id you are talking about.?correct me if i am wrong – RL89 Sep 28 '12 at 11:50
1

This page looks as if it might help you: [How to Access the Serial Number on Your Flash Drive](http://www.customusb.com/blog/how-to-access-the-serial-number-on-your-flash-drive/) – CL. Sep 28 '12 at 12:59

score 2 · Accepted Answer · answered Oct 04 '12 at 14:50

2

I suggest you take a look at this document :
Thumb Drive Threats and Countermeasures in a Microsoft Windows

Especially look at the chapter "Threat Countermeasures", where are described the security measures built into Windows, as well as commercial security products such as :

GFI LanGuard
Lumension
DeviceLock

answered Oct 04 '12 at 14:50

harrymc

455,459
31
526
924

1

Thanks for the information, but have you worked on any such kind of security measures in any organisation? – RL89 Oct 04 '12 at 15:38
Sorry, I have no experience with any of these products. Employees in my company can take home their laptops, so thumb drives are not our main worry. – harrymc Oct 04 '12 at 17:25

Best way to authorize a USB device in an organisation?

2 Answers2