Phone Lines icon GFI Support Home

Articles in this section

See more

Configuring Device Scanning Options with Scanning Profile Editor

Author: Andriy Rybalchenko Updated

Overview

This article provides information on enabling/disabling scanning for hardware devices on target computers and adding the appropriate network and USB devices to the blacklist and whitelist groups for a Scanning Profile. This allows detecting the devices you mark as dangerous or removing extra scanning time checks you are not interested in.

 

Solution

LanGuard can detect the hardware device marked as dangerous or exclude from the scanning process-specific USB devices you consider safe. Such devices can be a USB mouse or keyboard. This is achieved through a safe/whitelist of USB devices to be ignored during scanning.

You can further configure LanGuard to generate high-security vulnerability alerts whenever a USB or Network device is detected. This is achieved by compiling a list of unauthorized or blacklisted Network and USB devices you want to be alerted for.

  1. Access GFI LanGuard.
  2. Go to Configuration > Scanning Profile Editor. Alternatively, press CTRL + P to launch the Scanning Profiles Editor.
  3. Go to Network & Software Audit Options and select the Devices tab. 

    configuringnetworkandsoftwareauditoptions-devices.png

    • Use the Network Devices sub-tab to configure the attached network devices scanning options and blacklisted (unauthorized)/whitelisted (safe) devices lists.
    • Use the USB Devices sub-tab to configure the attached USB devices scanning options and unauthorized/safe devices lists.
  4. Choose the appropriate action needed from the list of options on the table below:
    Option Description
    Enabling/disabling checks for all installed network devices

    To enable network device (including USB device) scanning in a particular scanning profile:

    1. Click the Network Devices tab.
    2. Select the appropriate scanning profile from the left pane under Profiles.
    3. On the right pane, select Enable scanning for hardware devices on the target computer(s).

    Network device scanning is configurable on a scan profile by scan profile basis. Make sure to enable network device scanning in all profiles where this is required.
    Compiling a network device blacklist/whitelist
    1. Click the Network Devices tab.
    2. Select the appropriate scanning profile from the left pane under Profiles.
    3. In the right pane, specify which devices you want to classify as high-security vulnerabilities or whitelist.
      • High-security vulnerabilities: Specify the devices under Create high-security vulnerability for USB devices which name contains.

        Example: If you enter the word ‘wireless,’ you will be notified through a high-security vulnerability alert when a device whose name contains the word ‘wireless’ is detected.
      • Whitelist: Specify which USB devices you want to ignore during network vulnerability scanning in the space provided under Ignore (Do not list/save to db) devices which name contains.

    Only add one network device name per line.
    Configuring advanced network device scanning options

    You can also specify the type of network devices checked by this scanning profile and reported in the scan results. These includes:

    • wired network devices
    • wireless network devices
    • software enumerated network devices
    • virtual network devices

    To specify which network devices to enumerate in the scan results:

    1. Click the Network Devices tab, which opens by default.
    2. Select the appropriate scanning profile from the left pane under Profiles.
    3. Click Advanced and set the required options to Yes.
    4. Click OK to finalize your settings.
    Scanning for USB devices

    To compile a list of unauthorized/unsafe USB devices:

    1. Click USB Devices.
    2. Select the appropriate scanning profile from the left pane under Profiles.
    3. In the right pane, specify which devices you want to classify as high-security vulnerabilities or whitelist.
      • High-security vulnerabilities: Specify the devices under Create high-security vulnerability for USB devices which name contains.

        Example: If you enter the word ‘iPod,’ you will be notified through a high-security vulnerability alert when a USB device whose name contains the word ‘iPod’ is detected.
      • Whitelist: Specify which USB devices you want to ignore during network vulnerability scanning in the space provided under Ignore (Do not list/save to db) devices which name contains.

    NOTE: Only add one USB device name per line.

Using the settings above, you can implement Scanning Profiles just for your particular case(s). For example, you can create a separate scanning profile that enumerates only Bluetooth dongles and wireless NIC cards connected to your target computers. In this case, you must specify Bluetooth and Wireless or WiFi in the unauthorized network and USB lists of your scanning profile.

 

Related Articles

Related articles