Centennial Software's DeviceWall can lock out unauthorised devices from USB ports

Centennial Software has updated its security tool for managing USB devices so that firms can now permit specific types of authorised device. The new version also encrypts by default any files written to USB Flash drives.

DeviceWall 4.0, available immediately, allows administrators more granular control over the type of device that users can plug into PC USB ports, the firm said. DeviceWall can already block the use of media players such as Apple's iPod, digital cameras, PDAs, and DVDs.

"When the security threat from USB memory sticks was first recognised, there was a knee-jerk reaction to just block everything," said Matt Fisher, Centennial's vice-president for Europe, the Middle East and Africa. However, companies are starting to realise that such devices have their uses, and that a blanket ban is too restrictive.

The new Policy Customiser feature allows IT staff to authorise a particular make and model of device for use on company systems. This locks down the general use of kit like USB drives, but allows for specific instances. "You wouldn't want sales executives using USB sticks they'd picked up from a trade show, but you might let them use company-issued devices," Fisher said.

Using Policy Customiser, devices can be recognised by their product and vendor ID and added to the policy database. This avoids IT staff having to authorise each individual device before issuing them to employees. "Firms don't want to close down an entire class of device [such as Flash drives], but instead want to manage their use," said Fisher. Administrators can still dictate which of their employees is allowed to use such devices.

This capability is not just limited to USB Flash drives and PDAs, but extends control to other devices such as internal modems and serial ports fitted to PCs, according to Centennial.

DeviceWall 4.0 also supports automatic encryption of files written to USB Flash drives, using the AES or Blowfish 256bit algorithms. This is transparent to users, but renders data unreadable to any computer outside the company network.

Licensing remains the same as for the previous version of DeviceWall at £13.50 per seat for 250 users. Customers with a maintenance contract will get an upgrade. DeviceWall runs on Windows NT, 2000 and XP systems