USB to Browser Upload Block

Validate that removable storage devices cannot be used to exfiltrate data via browser uploads, and that proxy enforcement prevents bypass attempts.

Objectives

• Prevent enumeration or write/export from removable storage where policy denies it.
• Deny web uploads originating from device‑sourced content; enforce proxy routing.

Preconditions

• Device controls configured for removable storage (deny enumeration and write/export per policy).
• Proxy‑only egress with pinning enabled.

Suite

ID	Canonical IDs	Flow	Procedure	Expected Outcome
INTEG-DEVICE-UPLOAD-01	DM-DEVICE-05, DM-DEVICE-02, DM-WEB-02, NET-EGRESS-05	USB to Browser Upload Block	1) Attach USB mass storage and attempt enumeration/write. 2) Attempt browser upload of a file sourced from the device (or simulate).	Enumeration/write is denied per device policy; upload attempt is denied; proxy bypass attempts fail; audit shows action: "deny", proxyEnforced: true, and relevant rule.id.

Evidence Requirements

• device/fileOp events: device type/class, action, rule.id, bytesWritten (0 if denied), integrity.hash.
• dataMotion web/upload events: action, outcome, rule.id, integrity.hash.
• network events: proxyEnforced, reason when applicable.