3

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her computer, we need an audit report that she copied files X, Y, Z to/from media. We have a 100% Mac user base.

I've looked at endpoint protector products from CoSoSys and Sophos, but neither supports removable media control on the Mac. I'm looking at McAfee right now, but their product literature is making my head spin.

Can anybody recommend a product to do this? Or are we looking at building something from scratch?

Thanks in advance...

3 Answers 3

1

Hmm.. Are you sure CoSoSys doesn't support removable media control on the Mac? It completely seems like they do: http://www.cososys.com/software/device_management_for_Mac_OS_X.html:

Device Management for Mac OS X

  • Centralized Device Management / Device Whitelist
    • For Mac OS X the use of USB storage devices, FireWire devices and CD/DVD is controlled.
  • Support for Mac OS X and Windows (XP, Vista, 7)
  • File Tracing - Control your Data Flow (for Endpoint Protector)
  • Offline Temporary Password
  • Enforcement of your Device use Policy
  • Reporting and Analysis
    • My Endpoint Protector offers powerful reporting and analysis tools that lets you analyse all activity (e.g. devices connected, files transferred, etc) at the endpoint.


What is it missing from your requirements?

2
  • Yeah, I thought so too. There was something that didn't work; I think the audit trail was missing. The management interface was very nice (I get no $$$ from them!), but even though authorizing a device (r|rw) worked there was still no log of file XXX read''; file YYY written'' ... but I'm going to have to call them if no vendor has this; they look small enough that I could perhaps pay a bit extra for them to implement it. Dec 11, 2010 at 2:08
  • According to their product description, I would consider this audit trail an essential part of the solution and would be surprised if this wasn't working. I have another concern though, see my own answer.
    – Sven
    Dec 11, 2010 at 3:59
1

I'm Anca from Endpoint Protector Community. I think that we have what you are looking for. It is a new product called Endpoint Protector Appliance, which has the Audit Trail feature available for MAC together with File Tracing and File Shadowing. You can check our product here: http://www.endpointprotector.com/en/index.php/products/endpoint_protector_appliance If you have any questions or you need more information, please let me know.

1
  • Anca, welcome to Server Fault! As you're representing a vendor please be sure to read the FAQ (especially in regards to advertising products).
    – Chris S
    Dec 16, 2010 at 15:33
0

If you find a working solution there is still another problem I am not sure you can avoid on a Mac: There is always the possibility to mount the physical disk to another computer read-only and copy the data this way, thus leaving no trails at all. You can easily prevent the easiest way of doing this with locking target mode in EFI, but beyond that you will need at least a seal to detect something has been tampered with. The only protection from this would be an encryption that is tied to the hardware (AFAIK you can get that for some PCs) or would work in conjunction with your monitoring software.

2
  • Right - it's turtles all the way down. We understand that we're doing security theatre, and to some extend the client does as well, but we're still doing it :-( Dec 13, 2010 at 17:35
  • s/extend/extent Dec 15, 2010 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .