This article is part of my Harmony Endpoint Deep Dives series, originally published on Check Point CheckMates. It is written for a cloud-managed deployment (Infinity Portal / Web Management); where an on-premises Management Server behaves differently, that is called out.
Purpose
The USB port is one of the easiest ways data walks out of a company, and one of the easiest ways malware walks in. This article dissects Media Encryption & Port Protection (ME&PP): the write-action encryption modes, storage vs peripheral device control, device exceptions with wildcards, offline access, device scanning and authorization, media lockout, and the UUID “Site” trust model that decides who can open an encrypted stick.
Two Kinds of Devices
ME&PP protects sensitive information by encrypting data and requiring authorization to access devices. Everything starts with a distinction:
Type Definition Can encrypt? Storage Device Removable media users can save data files to: USB storage, SD cards, CD/DVD, external drives Yes Peripheral Device Devices users cannot save data to (keyboard, mouse, modem, Bluetooth, Wi-Fi, etc.) NoRules are built in the Web Management console (Policy > Data Protection > General > Capabilities and Exclusion > Media Encryption) and cover: read/write defaults, storage access, device access, which file types to encrypt, offline access, and user overrides. Device-level exceptions can be imported and exported as JSON.
Write Actions: the Core of Data Protection
The write action decides what happens when a user copies a file to a USB stick. Five predefined options:
Write Action Behavior Allow writing any data All file types written freely Encrypt business related data Business-related file types must go to encrypted storage; non-business files can be unencrypted Encrypt all data Every file (business + non-business) must be encrypted Do not allow writing any data No writes at all …allow user override Blocked by default, but UserCheck lets the user override with a justificationWhat counts as “business-related” (encrypted by default): Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email, Text. Not business-related by default: Multimedia, Image, Executable. You cannot edit the predefined groups, but you can create custom ones.
Encrypt business related data is the sweet spot for most organizations. Confidential documents are forced into encryption while personal photos and music stay usable, so users do not fight the policy.
The UUID “Site” Trust Model: Who Can Open the Stick
Each management instance is a Site with a UUID. When a device is encrypted, that Site’s UUID is written to it. When someone plugs the encrypted device in elsewhere, ME&PP compares the device’s UUID against the connected Site (and any trusted Sites):
flowchart TD
A[Encrypted device attached] --> B{Device UUID vs connected Site}
B -->|Same Site that encrypted it| C[Access with a password]
B -->|A different TRUSTED Site| D[Access with a password]
B -->|A non-trusted Site| E[No access]The controlling setting is the Site action (enabled by default): Allow access to storage devices encrypted at current site only means clients open only media encrypted by the same Site. This is what stops an encrypted USB from being opened on a random unmanaged machine, and what lets you deliberately share media across trusted Sites.
For machines with no ME&PP (or offline), the Explorer Utility can be copied onto the device so encrypted data is still readable with a password.
Peripheral Device Access (Port Protection)
For devices that cannot store data, you control the ports directly:
Predefined action Effect Allow essential devices only (keyboard, mouse, network adapters) Everything else blocked Block all transmitting devices (Modem, Bluetooth, IrDA, Wi-Fi) Everything else allowed Allow all peripheral devices No port restrictionCustom actions set per-device Access Type (Allow/Block) and Log.
Device Exceptions & Wildcards
You rarely apply one rule to every USB stick. Exceptions target a device by serial number, a model (device ID), a device type, or a user-defined group. Serial numbers accept wildcards:
-
*matches one or more characters,?matches exactly one character - Example:
1234*matches1234ABC,1234XYZ, and1234567(the1234prefix followed by at least one more character). It does not match1233, nor1234on its own.
Precedence (enforced in this order):
- Serials containing
*first - Serials containing
?next - Exact serials (no wildcard) last
Example evaluation order: 12345*, then 123456*, then 123????, then 123456?, then 1234567.
The Device ID Filter matches by prefix: My_USB_Stick matches My_USB_Stick_40GB and My_USB_Stick_80GB. Devices are found automatically via the Device Discovering Wizard (from user logs) or created manually.
Device Scanning & Authorization
Beyond encryption, ME&PP can scan inserted media for malware and unauthorized file types before allowing access:
flowchart TD
A[Device inserted] --> B[Scan: malware + unauthorized file types]
B --> C{Self-authorization allowed?}
C -->|Yes| D[User scans manually or automatically, then authorized]
C -->|No| E[A specified admin authorizes after a clean scan]
D --> F[Authorized]
E --> F
F --> G{Contents change later?}
G -->|In a trusted ME&PP environment| H[Not rescanned each time]
G -->|In an environment WITHOUT ME&PP| I[Rescanned every insertion into an ME&PP PC]Unauthorized file types work in two modes: Unauthorized (you list what is blocked and everything else is allowed; this is the default, with all types allowed) or Authorized (you list what is allowed and everything else is blocked). On E80.64+ clients, optical media (CD/DVD) can also be scanned.
Offline Access, Container Sizing & Lockout
Offline Access lets users open encrypted media on protected computers not connected to a server, or on non-protected computers, via a password, with an optional read-only password and Remote Help password recovery. Encryption settings control what happens to non-business data (copy to encrypted section, delete, or leave untouched), secure-format passes, and owner selection (AD only).
Note (E89.x known limitation): when Windows Smart App Control is enabled, it blocks the Media Encryption offline utility (
Access To Business Data.exe) that ships on the removable media. Workaround: copy the utility to a local disk and run it from there (EPS-51871).
Encryption Container: to force whole-device encryption, do not allow the user to change the encrypted size, and set both Minimum and Default percentage of media capacity to 100.
Media Lockout after failed authentication:
Setting Default threshold Temporarily lock the device 5 attempts Permanently lock the device (until admin unlocks) 10 attemptsOffline passwords reuse the OneCheck complexity model (Windows complexity: at least 6 characters, at least 3 of 4 categories, or a custom policy).
Best Practices
- Default to Encrypt business related data. It protects confidential documents without blocking personal files, so adoption is painless.
- Use the UUID Site trust deliberately. Trust only the sites that genuinely need to share encrypted media, and leave everything else non-trusted.
- Copy the Explorer Utility to encrypted media if users must read it on machines without ME&PP. Otherwise the data is unreadable off-network.
- Enable temporary lockout (5) at minimum, and add permanent lockout for high-sensitivity fleets.
Common Mistakes
Mistake Impact Solution Clearing Allow encryption in the write action No device can be encrypted at all Keep it enabled where encryption is intended Forgetting wildcard precedence An overly broad* rule shadows a specific rule
Remember the order *, then ?, then exact
Blocking all peripherals without allowing essentials
Users lose keyboard/mouse/network
Use Allow essential devices only as the floor
Expecting encrypted media to open anywhere
Non-trusted server means no access
Plan Site trust; ship the Explorer Utility for off-network reads
Not setting lockout
Brute-force on a lost stick
Enable temporary (5) and permanent (10) lockout
Offline utility blocked on a locked-down endpoint
Users cannot open encrypted media where Smart App Control is on
Copy Access To Business Data.exe to a local disk and run it there (EPS-51871)
FAQ
Q: Which file types get encrypted by default?
A: Business-related types: Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email, Text. Multimedia, Image and Executable are not, by default.
Q: How do I force the entire USB device to be encrypted?
A: Disable “allow user to change size” and set Minimum + Default to 100% of media capacity.
Q: Can users still read encrypted media off the corporate network?
A: Yes, with Offline Access: a password (and the Explorer Utility on machines without ME&PP).
Q: How many failed attempts before lockout?
A: 5 for temporary lock, 10 for permanent lock (defaults).
Q: Can I allow one specific USB model and block the rest?
A: Yes. Create a device exception by device ID/model or serial (with wildcards), respecting the *, then ?, then exact precedence.
References
- Check Point Harmony Endpoint Administration Guide (cloud / Infinity Portal), Configuring the Data Protection Policy > Media Encryption & Port Protection
- Check Point SecureKnowledge sk166110, How to encrypt media with Media Encryption & Port Protection
- Check Point SecureKnowledge sk184929, Enterprise Endpoint Security E89.25 Windows Clients (known limitation EPS-51871)
Originally published on Check Point CheckMates. Read the full article and the rest of the Harmony Endpoint Deep Dives series there: