Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her computer, we need an audit report that she copied files X, Y, Z to/from media. We have a 100% Mac user base.

I've looked at endpoint protector products from CoSoSys and Sophos, but neither supports removable media control on the Mac. I'm looking at McAfee right now, but their product literature is making my head spin.

Can anybody recommend a product to do this? Or are we looking at building something from scratch?

Thanks in advance...

share|improve this question

3 Answers 3

Hmm.. Are you sure CoSoSys doesn't support removable media control on the Mac? It completely seems like they do: http://www.cososys.com/software/device_management_for_Mac_OS_X.html:

Device Management for Mac OS X

  • Centralized Device Management / Device Whitelist
    • For Mac OS X the use of USB storage devices, FireWire devices and CD/DVD is controlled.
  • Support for Mac OS X and Windows (XP, Vista, 7)
  • File Tracing - Control your Data Flow (for Endpoint Protector)
  • Offline Temporary Password
  • Enforcement of your Device use Policy
  • Reporting and Analysis
    • My Endpoint Protector offers powerful reporting and analysis tools that lets you analyse all activity (e.g. devices connected, files transferred, etc) at the endpoint.


What is it missing from your requirements?

share|improve this answer
    
Yeah, I thought so too. There was something that didn't work; I think the audit trail was missing. The management interface was very nice (I get no $$$ from them!), but even though authorizing a device (r|rw) worked there was still no log of file XXX read''; file YYY written'' ... but I'm going to have to call them if no vendor has this; they look small enough that I could perhaps pay a bit extra for them to implement it. –  Christopher DeMarco Dec 11 '10 at 2:08
    
According to their product description, I would consider this audit trail an essential part of the solution and would be surprised if this wasn't working. I have another concern though, see my own answer. –  Sven Dec 11 '10 at 3:59

I'm Anca from Endpoint Protector Community. I think that we have what you are looking for. It is a new product called Endpoint Protector Appliance, which has the Audit Trail feature available for MAC together with File Tracing and File Shadowing. You can check our product here: http://www.endpointprotector.com/en/index.php/products/endpoint_protector_appliance If you have any questions or you need more information, please let me know.

share|improve this answer
    
Anca, welcome to Server Fault! As you're representing a vendor please be sure to read the FAQ (especially in regards to advertising products). –  Chris S Dec 16 '10 at 15:33

If you find a working solution there is still another problem I am not sure you can avoid on a Mac: There is always the possibility to mount the physical disk to another computer read-only and copy the data this way, thus leaving no trails at all. You can easily prevent the easiest way of doing this with locking target mode in EFI, but beyond that you will need at least a seal to detect something has been tampered with. The only protection from this would be an encryption that is tied to the hardware (AFAIK you can get that for some PCs) or would work in conjunction with your monitoring software.

share|improve this answer
    
Right - it's turtles all the way down. We understand that we're doing security theatre, and to some extend the client does as well, but we're still doing it :-( –  Christopher DeMarco Dec 13 '10 at 17:35
    
s/extend/extent –  Christopher DeMarco Dec 15 '10 at 16:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.