[EN] Media Encryption & Port Protection Deep Dive: USB Control & Device Authorization

[jorgeluiznim]

Article 11 of the Harmony Endpoint Deep Dives series · A note on management: Harmony Endpoint is cloud-managed (Infinity Portal / Web Management) in most deployments today. ME&PP is configured under Policy > Data Protection > Media Encryption and works on Windows and macOS (macOS from client E85.30). Where an on-premises Management Server behaves differently, that is called out.

Purpose

The USB port is one of the easiest ways data walks out of a company, and one of the easiest ways malware walks in. This article dissects Media Encryption & Port Protection (ME&PP): the write-action encryption modes, storage vs peripheral device control, device exceptions with wildcards, offline access, device scanning and authorization, media lockout, and the UUID "Site" trust model that decides who can open an encrypted stick.

Audience

• [x] Endpoint Administrators
• [x] Security Engineers
• [x] Data Protection / DLP teams
• [ ] SOC Analysts
• [x] Beginners

Prerequisites

• Data Protection policy basics in the Web Management console
• Completes the Data Security trio with Full Disk Encryption (Article 10)

---

Two Kinds of Devices

ME&PP protects sensitive information by encrypting data and requiring authorization to access devices. Everything starts with a distinction:

Type	Definition	Can encrypt?
Storage Device	Removable media users can save data files to: USB storage, SD cards, CD/DVD, external drives	Yes
Peripheral Device	Devices users cannot save data to (keyboard, mouse, modem, Bluetooth, Wi-Fi, etc.)	No

Rules are built in the Web Management console (Policy > Data Protection > General > Capabilities and Exclusion > Media Encryption) and cover: read/write defaults, storage access, device access, which file types to encrypt, offline access, and user overrides. Device-level exceptions can be imported and exported as JSON.

---

Write Actions: the Core of Data Protection

The write action decides what happens when a user copies a file to a USB stick. Five predefined options:

Write Action	Behavior
Allow writing any data	All file types written freely
Encrypt business related data	Business-related file types must go to encrypted storage; non-business files can be unencrypted
Encrypt all data	Every file (business + non-business) must be encrypted
Do not allow writing any data	No writes at all
...allow user override	Blocked by default, but UserCheck lets the user override with a justification

What counts as "business-related" (encrypted by default): Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email, Text. Not business-related by default: Multimedia, Image, Executable. You cannot edit the predefined groups, but you can create custom ones.

Tip: Encrypt business related data is the sweet spot for most organizations. Confidential documents are forced into encryption while personal photos and music stay usable, so users do not fight the policy.

The encrypted portion of a device is the Business Related drive; the rest is the Non-Business Related drive. You can force encryption of the whole device (see Encryption Container below).

---

The UUID "Site" Trust Model: Who Can Open the Stick

Each management instance is a Site with a UUID. When a device is encrypted, that Site's UUID is written to it. When someone plugs the encrypted device in elsewhere, ME&PP compares the device's UUID against the connected Site (and any trusted Sites):

The controlling setting is the Site action (enabled by default): Allow access to storage devices encrypted at current site only means clients open only media encrypted by the same Site. This is what stops an encrypted USB from being opened on a random unmanaged machine, and what lets you deliberately share media across trusted Sites.

For machines with no ME&PP (or offline), the Explorer Utility can be copied onto the device so encrypted data is still readable with a password.

---

Peripheral Device Access (Port Protection)

For devices that cannot store data, you control the ports directly:

Predefined action	Effect
Allow essential devices only (keyboard, mouse, network adapters)	Everything else blocked
Block all transmitting devices (Modem, Bluetooth, IrDA, Wi-Fi)	Everything else allowed
Allow all peripheral devices	No port restriction

Custom actions set per-device Access Type (Allow/Block) and Log.

---

Device Exceptions & Wildcards

You rarely apply one rule to every USB stick. Exceptions target a device by serial number, a model (device ID), a device type, or a user-defined group. Serial numbers accept wildcards:

• * matches one or more characters, ? matches exactly one character
• Example: 1234* matches 1234ABC, 1234XYZ, and 1234567 (the 1234 prefix followed by at least one more character). It does not match 1233, nor 1234 on its own.

Precedence (enforced in this order):

1. Serials containing * first
2. Serials containing ? next
3. Exact serials (no wildcard) last

Example evaluation order: 12345*, then 123456*, then 123????, then 123456?, then 1234567.

The Device ID Filter matches by prefix: My_USB_Stick matches My_USB_Stick_40GB and My_USB_Stick_80GB. Devices are found automatically via the Device Discovering Wizard (from user logs) or created manually.

---

Device Scanning & Authorization

Beyond encryption, ME&PP can scan inserted media for malware and unauthorized file types before allowing access:

Unauthorized file types work in two modes: Unauthorized (you list what is blocked and everything else is allowed; this is the default, with all types allowed) or Authorized (you list what is allowed and everything else is blocked). On E80.64+ clients, optical media (CD/DVD) can also be scanned.

---

Offline Access, Container Sizing & Lockout

Offline Access lets users open encrypted media on protected computers not connected to a server, or on non-protected computers, via a password, with an optional read-only password and Remote Help password recovery. Encryption settings control what happens to non-business data (copy to encrypted section, delete, or leave untouched), secure-format passes, and owner selection (AD only).

Note (E89.x known limitation): when Windows Smart App Control is enabled, it blocks the Media Encryption offline utility (Access To Business Data.exe) that ships on the removable media. Workaround: copy the utility to a local disk and run it from there (EPS-51871).

Encryption Container: to force whole-device encryption, do not allow the user to change the encrypted size, and set both Minimum and Default percentage of media capacity to 100.

Media Lockout after failed authentication:

Setting	Default threshold
Temporarily lock the device	5 attempts
Permanently lock the device (until admin unlocks)	10 attempts

Offline passwords reuse the OneCheck complexity model (Windows complexity: at least 6 characters, at least 3 of 4 categories, or a custom policy).

---

Logging

Log actions are predefined (no custom): Do not log, Log critical only, Log critical + security, or Log all events. Log entries are stored on the client and uploaded to the server at intervals. Events carry a severity classification (for example, Event ID 3 "Policy update completed" = Low).

---

Best Practices

Best Practice: default to Encrypt business related data. It protects confidential documents without blocking personal files, so adoption is painless.

Best Practice: use the UUID Site trust deliberately. Trust only the sites that genuinely need to share encrypted media, and leave everything else non-trusted.

Best Practice: copy the Explorer Utility to encrypted media if users must read it on machines without ME&PP. Otherwise the data is unreadable off-network.

Best Practice: enable temporary lockout (5) at minimum, and add permanent lockout for high-sensitivity fleets.

---

Common Mistakes

Mistake	Impact	Solution
Clearing Allow encryption in the write action	No device can be encrypted at all	Keep it enabled where encryption is intended
Forgetting wildcard precedence	An overly broad * rule shadows a specific rule	Remember the order *, then ?, then exact, and scope specifics accordingly
Blocking all peripherals without allowing essentials	Users lose keyboard/mouse/network	Use Allow essential devices only as the floor
Expecting encrypted media to open anywhere	Non-trusted server means no access	Plan Site trust; ship the Explorer Utility for off-network reads
Not setting lockout	Brute-force on a lost stick	Enable temporary (5) and permanent (10) lockout
Offline utility blocked on a locked-down endpoint	Users cannot open encrypted media where Smart App Control is on	Copy Access To Business Data.exe to a local disk and run it there (EPS-51871)

---

Troubleshooting

Symptom: A user cannot open an encrypted USB device on another company machine Environment: ME&PP with multiple Management Servers (Sites) Root Cause: The device UUID does not match the connected server, and that server is not trusted Resolution:

1. Check whether the second machine's Management Server is trusted by the encrypting Site
2. If cross-site sharing is intended, add the server to the trusted list (then a password grants access)
3. For non-protected machines, ensure the Explorer Utility was copied to the device and the user has the offline password
4. If the offline utility itself will not launch, check whether Windows Smart App Control is blocking it, and run Access To Business Data.exe from a local disk (EPS-51871)

---

FAQ

Q: Which file types get encrypted by default? A: Business-related types: Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email, Text. Multimedia, Image and Executable are not, by default.

Q: How do I force the entire USB device to be encrypted? A: Disable "allow user to change size" and set Minimum + Default to 100% of media capacity.

Q: Can users still read encrypted media off the corporate network? A: Yes, with Offline Access: a password (and the Explorer Utility on machines without ME&PP).

Q: How many failed attempts before lockout? A: 5 for temporary lock, 10 for permanent lock (defaults).

Q: Can I allow one specific USB model and block the rest? A: Yes. Create a device exception by device ID/model or serial (with wildcards), respecting the *, then ?, then exact precedence.

---

References

• Check Point Harmony Endpoint Administration Guide (cloud / Infinity Portal), Configuring the Data Protection Policy > Media Encryption & Port Protection (read/write actions, business file types, Site/UUID actions, wildcards, offline access, lockout)
• sk166110, How to encrypt media with Media Encryption & Port Protection
• Check Point SecureKnowledge sk184929, Enterprise Endpoint Security E89.25 Windows Clients (known limitation EPS-51871: Windows Smart App Control blocks the Media Encryption offline utility)

---

Revision History

Date	Version	Author	Changes
2026-07-16	1.0	Jorge Luiz	Initial version
2026-07-30	2.0	Jorge Luiz	Cloud-first revalidation of the ME&PP configuration path, write actions, Site/UUID model, wildcards, offline access and lockout; macOS support (E85.30+)
2026-09-21	2.1	Jorge Luiz	Added the E89.x known limitation about Windows Smart App Control blocking the Media Encryption offline utility (EPS-51871); clarified the wildcard example; removed emoji and dashes for a cleaner read

---

Supported Versions: Harmony Endpoint cloud management (Infinity Portal / Web Management); Windows and macOS (E85.30+) clients Last Updated: 2026-09-21

[WiliRGasparetto]

Exelente bro

[jorgeluiznim]

Thank you Wili!