Media Encryption & Port Protection Deep Dive: USB Control, Encryption & Device Authorization

Jorge Dias Jr — Tue, 22 Sep 2026 00:02:24 +0000

This article is part of my Harmony Endpoint Deep Dives series, originally published on Check Point CheckMates. It is written for a cloud-managed deployment (Infinity Portal / Web Management); where an on-premises Management Server behaves differently, that is called out.

Purpose

The USB port is one of the easiest ways data walks out of a company, and one of the easiest ways malware walks in. This article dissects Media Encryption & Port Protection (ME&PP): the write-action encryption modes, storage vs peripheral device control, device exceptions with wildcards, offline access, device scanning and authorization, media lockout, and the UUID "Site" trust model that decides who can open an encrypted stick.

Two Kinds of Devices

ME&PP protects sensitive information by encrypting data and requiring authorization to access devices. Everything starts with a distinction:

Type	Definition	Can encrypt?
Storage Device	Removable media users can save data files to: USB storage, SD cards, CD/DVD, external drives	Yes
Peripheral Device	Devices users cannot save data to (keyboard, mouse, modem, Bluetooth, Wi-Fi, etc.)	No

Rules are built in the Web Management console (Policy > Data Protection > General > Capabilities and Exclusion > Media Encryption) and cover: read/write defaults, storage access, device access, which file types to encrypt, offline access, and user overrides. Device-level exceptions can be imported and exported as JSON.

Write Actions: the Core of Data Protection

The write action decides what happens when a user copies a file to a USB stick. Five predefined options:

Write Action	Behavior
Allow writing any data	All file types written freely
Encrypt business related data	Business-related file types must go to encrypted storage; non-business files can be unencrypted
Encrypt all data	Every file (business + non-business) must be encrypted
Do not allow writing any data	No writes at all
...allow user override	Blocked by default, but UserCheck lets the user override with a justification

What counts as "business-related" (encrypted by default): Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email, Text. Not business-related by default: Multimedia, Image, Executable. You cannot edit the predefined groups, but you can create custom ones.

Encrypt business related data is the sweet spot for most organizations. Confidential documents are forced into encryption while personal photos and music stay usable, so users do not fight the policy.

The UUID "Site" Trust Model: Who Can Open the Stick

Each management instance is a Site with a UUID. When a device is encrypted, that Site's UUID is written to it. When someone plugs the encrypted device in elsewhere, ME&PP compares the device's UUID against the connected Site (and any trusted Sites):

flowchart TD
    A[Encrypted device attached] --> B{Device UUID vs connected Site}
    B -->|Same Site that encrypted it| C[Access with a password]
    B -->|A different TRUSTED Site| D[Access with a password]
    B -->|A non-trusted Site| E[No access]

The controlling setting is the Site action (enabled by default): Allow access to storage devices encrypted at current site only means clients open only media encrypted by the same Site. This is what stops an encrypted USB from being opened on a random unmanaged machine, and what lets you deliberately share media across trusted Sites.

For machines with no ME&PP (or offline), the Explorer Utility can be copied onto the device so encrypted data is still readable with a password.

Peripheral Device Access (Port Protection)

For devices that cannot store data, you control the ports directly:

Predefined action	Effect
Allow essential devices only (keyboard, mouse, network adapters)	Everything else blocked
Block all transmitting devices (Modem, Bluetooth, IrDA, Wi-Fi)	Everything else allowed
Allow all peripheral devices	No port restriction

Custom actions set per-device Access Type (Allow/Block) and Log.

Device Exceptions & Wildcards

You rarely apply one rule to every USB stick. Exceptions target a device by serial number, a model (device ID), a device type, or a user-defined group. Serial numbers accept wildcards:

* matches one or more characters, ? matches exactly one character
Example: 1234* matches 1234ABC, 1234XYZ, and 1234567 (the 1234 prefix followed by at least one more character). It does not match 1233, nor 1234 on its own.

Precedence (enforced in this order):

Serials containing * first
Serials containing ? next
Exact serials (no wildcard) last

Example evaluation order: 12345*, then 123456*, then 123????, then 123456?, then 1234567.

The Device ID Filter matches by prefix: My_USB_Stick matches My_USB_Stick_40GB and My_USB_Stick_80GB. Devices are found automatically via the Device Discovering Wizard (from user logs) or created manually.

Device Scanning & Authorization

Beyond encryption, ME&PP can scan inserted media for malware and unauthorized file types before allowing access:

flowchart TD
    A[Device inserted] --> B[Scan: malware + unauthorized file types]
    B --> C{Self-authorization allowed?}
    C -->|Yes| D[User scans manually or automatically, then authorized]
    C -->|No| E[A specified admin authorizes after a clean scan]
    D --> F[Authorized]
    E --> F
    F --> G{Contents change later?}
    G -->|In a trusted ME&PP environment| H[Not rescanned each time]
    G -->|In an environment WITHOUT ME&PP| I[Rescanned every insertion into an ME&PP PC]

Unauthorized file types work in two modes: Unauthorized (you list what is blocked and everything else is allowed; this is the default, with all types allowed) or Authorized (you list what is allowed and everything else is blocked). On E80.64+ clients, optical media (CD/DVD) can also be scanned.

Offline Access, Container Sizing & Lockout

Offline Access lets users open encrypted media on protected computers not connected to a server, or on non-protected computers, via a password, with an optional read-only password and Remote Help password recovery. Encryption settings control what happens to non-business data (copy to encrypted section, delete, or leave untouched), secure-format passes, and owner selection (AD only).

Note (E89.x known limitation): when Windows Smart App Control is enabled, it blocks the Media Encryption offline utility (Access To Business Data.exe) that ships on the removable media. Workaround: copy the utility to a local disk and run it from there (EPS-51871).

Encryption Container: to force whole-device encryption, do not allow the user to change the encrypted size, and set both Minimum and Default percentage of media capacity to 100.

Media Lockout after failed authentication:

Setting	Default threshold
Temporarily lock the device	5 attempts
Permanently lock the device (until admin unlocks)	10 attempts

Offline passwords reuse the OneCheck complexity model (Windows complexity: at least 6 characters, at least 3 of 4 categories, or a custom policy).

Best Practices

Default to Encrypt business related data. It protects confidential documents without blocking personal files, so adoption is painless.
Use the UUID Site trust deliberately. Trust only the sites that genuinely need to share encrypted media, and leave everything else non-trusted.
Copy the Explorer Utility to encrypted media if users must read it on machines without ME&PP. Otherwise the data is unreadable off-network.
Enable temporary lockout (5) at minimum, and add permanent lockout for high-sensitivity fleets.

Common Mistakes

Mistake	Impact	Solution
Clearing Allow encryption in the write action	No device can be encrypted at all	Keep it enabled where encryption is intended
Forgetting wildcard precedence	An overly broad `*` rule shadows a specific rule	Remember the order `*`, then `?`, then exact
Blocking all peripherals without allowing essentials	Users lose keyboard/mouse/network	Use Allow essential devices only as the floor
Expecting encrypted media to open anywhere	Non-trusted server means no access	Plan Site trust; ship the Explorer Utility for off-network reads
Not setting lockout	Brute-force on a lost stick	Enable temporary (5) and permanent (10) lockout
Offline utility blocked on a locked-down endpoint	Users cannot open encrypted media where Smart App Control is on	Copy `Access To Business Data.exe` to a local disk and run it there (EPS-51871)

FAQ

Q: Which file types get encrypted by default?
A: Business-related types: Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email, Text. Multimedia, Image and Executable are not, by default.

Q: How do I force the entire USB device to be encrypted?
A: Disable "allow user to change size" and set Minimum + Default to 100% of media capacity.

Q: Can users still read encrypted media off the corporate network?
A: Yes, with Offline Access: a password (and the Explorer Utility on machines without ME&PP).

Q: How many failed attempts before lockout?
A: 5 for temporary lock, 10 for permanent lock (defaults).

Q: Can I allow one specific USB model and block the rest?
A: Yes. Create a device exception by device ID/model or serial (with wildcards), respecting the *, then ?, then exact precedence.

References

Check Point Harmony Endpoint Administration Guide (cloud / Infinity Portal), Configuring the Data Protection Policy > Media Encryption & Port Protection
Check Point SecureKnowledge sk166110, How to encrypt media with Media Encryption & Port Protection
Check Point SecureKnowledge sk184929, Enterprise Endpoint Security E89.25 Windows Clients (known limitation EPS-51871)

Originally published on Check Point CheckMates. Read the full article and the rest of the Harmony Endpoint Deep Dives series there:

DEV Community: Jorge Dias Jr