SD card is not controlled even when SD card bus rule is configured

Technical Articles ID: KB87194
Last Modified: 12/22/2021

Environment

McAfee Data Loss Prevention (DLP) Endpoint - all supported versions

For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.

Panasonic CF-AX2LDCCS card reader

Problem

Typically, a Removable storage device definition is created and then added with an SD card bus rule using the Bus Type. But, when you insert an SD card into the defined card reader, the SD card is not controlled. The Block or Monitor action is not applied.

Cause

DLP Endpoint looks at the device enumerator to identify an SD card reader. If the enumerator is SD or RIMMPTSK, DLP Endpoint recognizes the device as an SD card reader. But, some built-in SD card readers might use the PCISTOR enumerator, and so the device definition does not work properly.

Solution

This behavior is as designed. The PCISTOR enumerator is not SD card-specific.

Workaround

Create a Removable Storage Device Rule and use the Device Instance ID:

NOTE: If you specify PCISTOR in Instance ID, it might unexpectedly block some PCI storage devices. So, you must test and verify the rule before you apply it to your production environment.

Log on to the ePolicy Orchestrator 5.x console.
Select Menu, Data Protection, DLP Policy Manager.
In Definitions, click Device Control, Device Definitions.
Click Actions, New, Removable Storage Definition.
Name the definition.
Add the Device Instance ID (Advanced) property and configure the value as PCISTOR. Change the Comparison to Contains.
Click Save.
Assign this device definition to your Removable storage device rule.

If the workaround does not resolve the issue, contact Technical Support.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Configuration
Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.4.x (EOL)

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Japanese
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

SD card is not controlled even when SD card bus rule is configured

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

SD card is not controlled even when SD card bus rule is configured

Environment

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title