Prevent files from being copied to removable storage devices

S

scy

Well-Known Member
Joined
Aug 1, 2011
Messages
105
Reaction score
16
Hi all,

I want to protect files files so that they can't be copied, users must have access to shared files on the network and be able to work on them but must not be able to copy them to removal storage devices, and maybe not be able to attach them to email.
 
You'd have to heavily lock down the machine accessing the data, and also lock down internet access.

You could probably use group policies in a Windows environment to do something like this but it won't be simple.
 
scy said:
Hi all,

I want to protect files files so that they can't be copied, users must have access to shared files on the network and be able to work on them but must not be able to copy them to removal storage devices, and maybe not be able to attach them to email.
Click to expand...
One Drive and SharePoint allow you to control this.

Not putting the whole thing here but on Microsoft Learn you can find out how to do it. It is very easy.

To allow users to edit SharePoint files in their web browser while blocking local downloads, create a custom permission level by copying "View Only" and adding edit rights, or apply site-level policies if your organization has enterprise compliance licenses.
 
scy said:
Hi all,

I want to protect files files so that they can't be copied, users must have access to shared files on the network and be able to work on them but must not be able to copy them to removal storage devices, and maybe not be able to attach them to email.
Click to expand...
Which ai did you ask before posting here?
 
Shoot the user!

With traditional AD/AAD environment - Really easy via policy - both GPO and Intune baseline. Quick n easy.

Superglue in the USB slot works well?
 
TribbleZA said:
One Drive and SharePoint allow you to control this.

Not putting the whole thing here but on Microsoft Learn you can find out how to do it. It is very easy.

To allow users to edit SharePoint files in their web browser while blocking local downloads, create a custom permission level by copying "View Only" and adding edit rights, or apply site-level policies if your organization has enterprise compliance licenses.
Click to expand...
Sensitivity labels have lasting impact as well that stretch beyond the boundary of the device
 
scy said:
Gemini and it said it is virtually impossible to do it on the local network, it suggested cloud based services.
Click to expand...
Gemini is talking garbage.

Block all 445 traffic.

Place files in data enclave that has no 445 egress. Access via GW into a JumpBox that denies clipboard/device access.

JumpBox can interact with files but not exfiltrate them.

First idea in literally hundreds of different ways you can skin this feline, with varying levels of technical complexity and effort.

Trust me on the superglue
 
  • Like
Reactions: scy
rustypup said:
Gemini is talking garbage.

Block all 445 traffic.

Place files in data enclave that has no 445 egress. Access via GW into a JumpBox that denies clipboard/device access.

JumpBox can interact with files but not exfiltrate them.

First idea in literally hundreds of different ways you can skin this feline, with varying levels of technical complexity and effort.

Trust me on the superglue
Click to expand...
No need for superglue if everything is inside a VM. :whistling:
 
My_King said:
GPO:

Computer Configuration
Policies
Administrative Templates
System
Removable Storage Access

Microsoft DLP:

learn.microsoft.com

Learn about data loss prevention

Learn how to protect your sensitive information using Microsoft Purview Data Loss Prevention policies and tools and take a tour through the DLP lifecycle.
learn.microsoft.com
Click to expand...
THIS!
You can do it individually (gpedit) and likely a registry setting (non-pro).

I haven't gotten my skills up on MacOS policies yet (learning the .mobileconfig stuff though). In linux, disable automount and disallow user mounting.

Are you trying to stop people copying the company client list (then DLP all the way and set groups to auto encrypt files with a default of all company can open; caveat: only really works with the MS Office suite -- doesn't really stop them printing to PDF or the printer).
Are you trying to prevent people copying design files or spreading STUXNET? (good luck...glue the ports and ban the internet).

Also disable bluetooth and media transfer protocol while you're there

I've seen people take phones out because they couldn't screenshot a Teams meeting, and executives send large contract files over whatsapp.

In the end, rather just log EVERYTHING, if your are a Windows heavy environment with Defender and DLP ($$). User copies a file to USB, it'll show in the log. Blocking just means the nefarious will just use a way you can't see.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X