Security Basics mailing list archives
RE: Deny access to copy files
From: "Mason, Samuel" <SMason () mt gov>
Date: Mon, 9 Jun 2008 07:39:42 -0600
I haven't reached the bottom of this thread so I apologize if this is repeat info. If you have AD or some sort of management software that can push registry changes you can try these: Turn off CD Burners: REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoCDBurning /t REG_DWORD /d 00000001 /f Turn off USB Mass Storage: REG ADD "HKLM\System\CurrentControlSet\Services\UsbStor" /v Start /t REG_DWORD /d 00000004 /f Turn USB Mass Storage to Read-Only: REG ADD "HKLM\System\CurrentControlSet\Control\StorageDevicePolicies" /v WriteProtect /t REG_DWORD /d 00000001 /f The CD Burner option only works with the built-in burning function of Windows. You'd have to make sure the systems also did not have burning software. All of these tricks will, of course, do you absolutely no good if the developers are savvy and have more than standard user rights or you can't enforce these changes via GP with consistency. As far as web mail goes I'd suggest some filtering software to get the majority of the webmail sites if that's important. They aren't perfect. In your situation a strong and well-enforced policy (with actual consequences for not following) might get you further than some of these mechanisms. There are a lot of ways around what you're trying to do . Samuel Mason, CISSP -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Ahmed Khalid Sent: Sunday, June 01, 2008 12:20 PM To: focus-ms () securityfocus com Cc: security-basics () lists securityfocus com Subject: Deny access to copy files I am working for a software house, they are developing a software product and their requirement is to restrict programmers to take the code out of office premises due to company policy. I am trying to configure a windows based machine which denies access to copy files to external storage devices connected to USB. There is an NTFS permission "Read + Execute" I guess this could do the work but is there any other way to do it? They also don't need programmers to take the code with them in their email. I can restrict SMTP and POP ports but when it comes to web based emails I am clueless, How can I restrict web based emails like hotmail, gmail, yahoo there are so many of these and if I somehow manage to block all web based email sites someone can write a script to send emails, if not a script HTTP tunneling would bypass any checks and bounds defined by my proxy/gateway machine. How can I block such thing? Any help would be highly appreciated. Regards, Ahmed Khalid
Current thread:
- Re: Deny access to copy files, (continued)
- Re: Deny access to copy files Adam Pal (Jun 02)
- RE: Deny access to copy files Yahsodhan Deshpande (Jun 02)
- Re: Deny access to copy files Liam Jewell (Jun 03)
- RE: Deny access to copy files Craig Wright (Jun 03)
- RE: Deny access to copy files Yahsodhan Deshpande (Jun 03)
- RE: Deny access to copy files Craig Wright (Jun 03)
- RE: Deny access to copy files Yahsodhan Deshpande (Jun 03)
- RE: Deny access to copy files Craig Wright (Jun 03)
- RE: Deny access to copy files Yahsodhan Deshpande (Jun 02)
- Re: Deny access to copy files Adam Pal (Jun 02)
- RE: Deny access to copy files James Finnican (Jun 17)
- Re: Deny access to copy files GSO GSO (Jun 17)
- Re: Deny access to copy files Atif Azim (Jun 19)
- RE: Deny access to copy files Michael P. Carter (Jun 19)
- Re: Deny access to copy files Shreyas Zare (Jun 20)
- Message not available
- Re: Deny access to copy files Shreyas Zare (Jun 23)
- Message not available
- Re: Deny access to copy files Shreyas Zare (Jun 23)
- Message not available
- Re: Deny access to copy files Shreyas Zare (Jun 24)
- Re: Deny access to copy files Ansgar -59cobalt- Wiechers (Jun 24)