As employees have been working remotely during the COVID-19 pandemic, home printers and removable devices have expanded the scope of attacks on their companies’ data and daily business operations. To address this increased security exposure, Microsoft has added new checks on removable storage devices and printers to Microsoft Defender for Endpoint, the enterprise version of Windows 10 Defender antivirus.
See also: Microsoft Flight Simulator: Coming to Xbox Series X/S consoles
These new capabilities available in the enterprise endpoint security platform (formerly known as Microsoft Defender Advanced Threat Protection) will enable access restrictions on removable devices and blocking print jobs through non-corporate or unapproved printers.
Removable device control protection is now generally available
Removable storage access control on Windows and removable storage protection on Mac are generally available, and printer protection on Windows is now available in public preview.
See also: PetitPotam attack: Microsoft published mitigation measures
The new removable storage control capabilities added to the Windows release complement the existing device control for scenarios such as Endpoint DLP removable storage, device installation, and BitLocker removable storage.
The USB storage device control added to the Mac version of Microsoft Defender for Endpoint is designed to balance the level of access granted to external storage devices using custom policies.
Last month, Microsoft Defender for Endpoint also added support for detecting jailbroken iOS devices and mobile application management (MAM) support for Android and iOS that are not enrolled in Intune.
By jailbreaking their iOS devices, users gain full write and execute access by increasing their privileges to root, thus removing all restrictions imposed by Apple on installing applications.
See also: Safe Links: Microsoft Teams' new anti-phishing protection
Without restrictions, they can later install potentially malicious apps and, by bypassing potentially critical security updates to maintain their root access, they will also be exposed to attacks.
Information source: bleepingcomputer.com
