McAfee Data Loss Prevention 9.2.2 Product Guide

5Integrating McAfee DLP EndpointControlling devicesIn daily tasks, the system administrator should not tamper with the device classes list becauseimproper use (for example, blocking the managed computer’s hard disk controller) can cause a systemor operating system malfunction.Instead of editing an existing item to suit the needs of a device protection rule, add a new, user‐definedclass to the list.Classifying devicesEvery endpoint device has a unique set of parameters, and device definitions are used to identify eachone.Device parameters, such as Product ID/Vendor ID (PID/VID), or USB class code, are the componentsof the device definitions. A different set of properties for each device enables blocking or monitoring ofspecific devices by the system.Built‐in definitions for McAfee Endpoint Encryption for Files and Folders and McAfee Endpoint Encryptionfor Removable Media facilitate the use of those products with McAfee DLP EndpointDefined devices are classified into two groups:• Plug and play devices — Devices that can be added to a managed computer without anyconfiguration or manual installation of dlls and drivers. For example, the system can preventloading of plug and play devices like Bluetooth, Wi‐Fi, and PCMCIA devices. Most Microsoft Windowsdevices are PnP devices.• Removable Storage devices — Removable external storage devices containing file systems thatappear on the managed computer as drives.While the plug and play device definitions and rules include general device properties, the removablestorage device definitions and rules are more flexible and include additional properties related to theremovable storage devices. McAfee recommends using the removable storage device definitions andrules to control devices that can be classified as either PnP or removable storage, such as USB massstorage devices.Whitelisted plug and play devicesCertain plug and play devices are whitelisted because they do not handle device management well,and might cause the system to stop responding or cause other serious problems. McAfee recommendsadding such devices to the whitelisted device list to avoid compatibility problems.Whitelisted plug and play device definitions are added automatically to the Excluded list in every plugand play device rule. They are never managed, even if their parent device classes are.If you inspect the device rules, you do not see the whitelist definition because the definition is notadded to the rule until the policy is applied. You do not have to rewrite existing rules to include newwhitelisted devices.Add a new device classDevice classes categorize device types used by the system. Each class of devices is identified by aname, optional description, and one or more Globally Unique Identifiers (GUIDs).Task1 Select one of these options:• In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Sys Config | Endpoint Configuration.• On your McAfee DLP appliance, select System | Endpoint Configuration.160 McAfee Data Loss Prevention 9.2.2 Product Guide