What is whitelisting?

Whitelisting USB devices is a security measure that limits which devices can access a computer to a “whitelist” of specific, approved devices. It prevents unknown or untrusted USB devices from initiating data breaches or unauthorised data transfer, as well as cutting off a common vector for malware.

Whitelisting by Vendor ID or Product ID (VID/PID) gives endpoint managers the ability to authorise specific USB devices based on their unique identifier. Only devices with a matching VID/PID combination will have permission to connect and function. Depending on the security software or operating system being used, the specific steps for whitelisting can vary. In general, the process includes identifying the device’s VID and PID, then adding it to a whitelist (allowed list).

What is VID/PID?

A USB device, while plugged in, identifies itself by its VID/PID combination. A VID (Vendor ID) is a 16-bit vendor number. A PID (Product ID) is a 16-bit product number. Together, a device’s VID/PID combination is a unique identifier comparable to a barcode that a system can use to recognise and interact with it. A host can use the VID/PID combination to find the drivers to use for the USB device, if any.

Why use both VID and PID?

There are multiple levels of protection for USB storage devices, depending on the method. Utilising USB storage devices’ respective vendor identifier and product identifier values to whitelist them is both effective and simple. Every manufacturer of USB peripherals has a unique VID, but the PID changes for each new product released. With regards to whitelisting, using a manufacturer’s VID alone would be too broad to be secure: every USB device it has ever produced would be permitted. The PID alone is more refined as a security measure, restricting access to the host system to just one specific model. However, this is not a perfect solution, as users may be able to acquire their own devices matching the authorised models on the consumer market.

Kingston’s customisation programme can create and apply custom PID profiles specific to an organisation to a range of Kingston encrypted USB flash drives. Contact your Kingston representative to learn more.

Benefits of whitelisting

• Whitelisting provides more granular control by making device access a case of blocking most devices while authorising only specific devices.
• Whitelisting frees employees from monitoring duties, saving time and resources, and improving efficiency.
• Most obviously, whitelisting enhances cybersecurity, increasing the difficulty of penetrating your system due to the blanket blocking of devices that have not been approved. Unauthorised USB devices are a common vector of malware, which can have all sorts of deleterious effects on your organisation, such as data leaks.
• For this reason, whitelisting is an effective form of DLP (data loss prevention).
• Due to the security benefits, whitelisting is an effective method of ensuring compliance with data protection regulations such as HIPAA and GDPR.

Alternatives to whitelisting

You can whitelist devices based on their serial number, if available. Other alternatives include using custom classes that group devices based on their type, or by various other criteria deemed acceptable by your organisation.

How to find a device’s VID/PID

• In Windows: Click Start. Type "Device Manager", then open it to view all devices connected to your computer. Select and double-click your device. Go to the Details tab. From the drop-down menu, select Parent to view the VID and PID.
• In macOS: Type System Information’ into the Search bar, then click Hardware. You will find your USB device’s VID/PID among the information for that drive.
• In Linux: Enter the command ‘lsusb’ in your terminal. You will see the VID and PID pairs listed by each USB device connected to your computer.

Kingston IronKey™ VID/PID combinations

* Under rare circumstances in some restricted environments, the encrypted USB drive may switch into HID Mode. If it does, the HID PID will need to be whitelisted in addition to the standard PID.
** Some endpoint solutions will display the VID/PID values in decimal, rather than the standard hexadecimal values.

Summary

Endpoint management is a pain point for organisations of all sizes. Unrestricted use of USB devices can jeopardise system and data integrity, leaving organisations liable to the tune of millions of pounds, in addition to reputational damage. At the same time, blanket bans on USB devices inhibit the ability of your organisation to work flexibly and share needed information. Whitelisting offers organisations a secure way of permitting employees to use approved devices without leaving a back door open to malware and other security issues. Kingston’s organisation-specific custom PID profiles offer a bespoke solution that both simplifies whitelisting and enhances security.