Carbon Black Cloud: Notification says USB device was blocked, but files can still be accessed

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Policy configured to block USB devices, but users are still able to read, write, and execute files on the device
• Endpoint receives a notification that the device was blocked

Environment

• Carbon Black Cloud: All Versions

Cause

Sensor policy has a bypass rule which allows the particular service to access the USB device

Resolution

Adjust the policy rules for the service / folder being used to access the USB device