implementing-usb-device-control-policy

name	implementing-usb-device-control-policy
description	Implements USB device control policies to restrict unauthorized removable media access on endpoints, preventing data exfiltration and malware introduction via USB devices. Use when deploying device control via Group Policy, Intune, or EDR platforms to enforce USB restrictions. Activates for requests involving USB control, removable media policy, device control, or data loss prevention via USB.
domain	cybersecurity
tags	["endpoint","USB-control","device-control","data-loss-prevention","removable-media"]
subdomain	endpoint-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Implementing Usb Device Control Policy

Overview

Cybersecurity skill for implementing usb device control policy. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "implementing usb device control policy"
• "Restricting USB storage devices to prevent data exfiltration or malware introduc"
• "Implementing device control policies via GPO, Intune, or EDR device control modu"
• "Creating USB whitelists for authorized devices while blocking all others"

Use this skill when:

• Restricting USB storage devices to prevent data exfiltration or malware introduction
• Implementing device control policies via GPO, Intune, or EDR device control modules
• Creating USB whitelists for authorized devices while blocking all others
• Meeting compliance requirements for removable media control (PCI DSS, HIPAA)

Do not use for network-based DLP or cloud storage restrictions.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Active Directory GPO or Microsoft Intune for policy deployment
• Device Instance IDs of authorized USB devices
• EDR with device control module (CrowdStrike, Microsoft Defender for Endpoint)
• Understanding of USB device classes (mass storage, HID, printer, etc.)

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text) for k, v in IOC_PATTERNS.items()}