USB storage drives are blocked on the Global policy by default, however, there exists a host group that allows users to use USB storage drives if their computers reside in this group. Serial numbers of specific USB storage drives can be whitelisted by contacting the SOC.
You can block and unblock USB ports to protect against malicious software. When USB blocking is enabled, any class 08 device inserted into a USB port will be blocked unless the device is moved into the USB Allowed group via the XDR Dashboard.
By default, all tenants have three groups created for managed devices:
Monitor + Remediation
Monitor Only
Monitor + Remediation + USB
Allowed Host Groups are created for you by the SOC team. If additional groups are needed, please contact us at soc@barracuda.com.
Blocking and Unblocking USB Drive Usage
To block or allow a USB storage drive usage on any host group besides the default group (Monitor + Remediation).
In the Barracuda XDR dashboard, navigate to Infrastructure > Endpoint Devices.
Click the Groups button in the top right corner of the screen.
Toggle USB Blocking on or off, according to preference.
Click Apply Changes.
In some cases, a system reboot may be necessary to speed up the policy change.