Sophos Data Control: created policy refuses to allow saving direct to flash drive

Hello DMahlen,

the Data Control default policy was set to allow multimedia files to be saved directly to flash drives

is this your only rule or do you, as I assume (at least that's how I interpret what you observe), have other rules in the policy as well and at least one of these policies has acceptance or block as action? As you say you can copy the files using Explorer the blocked message likely tells you that direct save is not allowed.

Please note (quoting from the Console help, boldunderline mine): When a data control policy only contains rules with the Allow file transfer and log event action, direct saves from within applications and transfers using the command prompt are not intercepted. Data Control can only inspect an existing file. If you potentially want to block (i.e. at least one of the rules in the policy has acceptance or block as action) transfer of certain files/content to removable media there has to be a source file - in case of direct saves there isn't one (as an aside: Explorer is more or less the only generally available application which permits to reliably hook/intercept copy/move operations and to determine source and destination).

Christian

Thanks for the reply.

When the default policy was set up by another tech, the "default" policy only had one rule-"Allow multimedia files to save to removable storage".  It did have the "Allow file transfer and log event" action.  By looking at how Data Control is set up, I'm assuming that if there is a rule, that's the only thing that will "work" and everything else would get blocked unless you TELL it what you want. At least that's how it was functioning until I actually tried to save a multimedia file and got blocked.

I did create a new policy and at first had the rules I mentioned, the above multimedia rule, the Microsoft Office rule that was built in and a file specific rule for that specialized software I mentioned.  All of which were set to have the actioin "Allow file transfer and log event".  After applying that policy to the IT computers and seeing that my PC was the same as the policy, I tried saving to the thumb drive following the rules and was blocked.

This morning I cleared the rules so that the new policy just monitored events.  I applied the policy and the IT computers were updated.  I tried saving a Word document to my thumb drive and it worked.  So then I went back into the rules and applied the "Microsoft Office" rule as before.  I applied it and I could still save a word doc to my thumb drive.  I then tried saving an MP3 file and that worked too, only it shouldn't have as there wasn't a rule applied.  I rebooted my machine and I'm still pretty much free to save directly to the flash drive.

I'm wondering if I'm approaching this wrong, like I'm assuming Sophos will automatically block everything. Should I be locking everything down for removable storage and then opening up what I need or am I on the right track and my Sophos setup is just being tempermental?

Thanks to you and anyone for your time replying to this!