Block USB storage device

Requirements: Windows, macOS, or Linux.

The block USB storage device action helps you protect against data exfiltration and infiltration attempts.

This policy-initiated action enables the FortiDLP Agent to deny access to an unauthorized USB mass storage device based on properties, such as its VID/PID identifier and serial number. In turn, you can safeguard against USB devices being used to copy sensitive information out of the organization, as well as USB devices that are infected with malware or equipped with other dangerous capabilities.

This functionality is supported for USB storage devices, such as:

• Flash drives
• Memory cards
• External hard drives (HDDs) and solid-state drives (SSDs)
• CD and DVD drives
• Cameras.

USB storage device blocking is provided by the Unauthorized USB storage device inserted policy template.

For more information, refer to the FortiDLP Policies Reference Guide.

The insertion of an SD card device reader into a device will trigger a USB devices event and/or a detection and action(s) (if the Unauthorized USB storage device used policy template is used) instead of the insertion of the SD card into the device reader. On Windows, a configuration option is available to alter this behavior, identifying the SD card's insertion as the trigger for events, detections, and/or actions. For details, contact Fortinet Support. To configure blocking controls for WPD devices, which connect using the Windows Portable Devices (WPD) system and include Android devices and Media Transfer Protocol (MTP) or Picture Transfer Protocol (PTP) devices, see Creating Agent configuration groups in the FortiDLP Administration Guide.