USB Blocking Policy is not working when the files in USB storage is opened by the apps from App Volumes

Products

• Carbon Black Cloud Endpoint Standard

Issue/Introduction

Symptoms:
USB Blocking Policy is applied to a VDI desktop. If a USB Flash Disk is inserted into the client and App Volumes Package(s) are attached to the VDI, and the files stored on the USB Flash storage are opened by the apps deployed by App Volumes , USB Blocking Policy does not work and the user is still able to access files stored on the USB Flash storage.

Environment

• Carbon Black Cloud Console
• VMware App Volumes 4.x

Cause

This issue is caused by the Full Bypass permission rule created for everything under App Volumes folder SVROOT in Carbon Black policy

Resolution

Modify the Carbon Black rules to an Allow "runs or is running" rule combined with an API bypass rule instead of Full Bypass for App Volumes folders. Whether to adopt this resolution is up to what level of monitoring user wants based on security/performance tradeoff decisions.

1. Navigate to the Carbon Black Cloud console.
2. Navigate to "Enforce" > "Policies", then choose the policy to be changed.
3. Navigate to the "Prevention" tab.
4. Expand the "Permissions" panel.
5. Click "Add application path" and set "**\SVROOT**"
6. Then do the following configuration:
   •  Set "Runs or is running" to Allow
   •  Set "Performs any API operation" to Bypass

Additional Information

Impact/Risks:
This causes a possible security risk as a security policy is bypassed.