Check Point's business-file write mode copies images and executables to the stick in clear

The eleven groups inside "business related" are Word, Spreadsheet, Presentation, Database, Drawing, Graphic, Viewer, Archive, Markup, Email and Text ^[5][9]. Multimedia, Image and Executable are outside it ^[6]. The write-up's case for the mode is that confidential documents are forced into encryption while personal photos and music stay usable, so users do not fight the policy ^[8]. That holds when your sensitive material is shaped like a document. A screenshot of the same spreadsheet is an Image, so it lands on the stick in clear, and the predefined groups cannot be edited, so covering it means creating a custom group ^[7][10].

Exceptions target a device by serial number, by model through the Device ID filter, by device type, or by a user-defined group ^[16]. Serial numbers take wildcards, where * matches one or more characters and ? matches exactly one ^[17]. So 1234* matches 1234ABC, 1234XYZ and 1234567, and it does not match 1233, nor 1234 on its own ^[18]. Precedence is enforced in a fixed order: serials containing * first, serials containing ? next, exact serials last ^[19]. The worked example runs 12345*, then 123456*, then 123????, then 123456?, then 1234567 ^[20]. An exact-serial entry written for one engineer's stick is consulted after every wildcard entry that also matches that stick ^[21]. The Device ID filter matches by prefix, so My_USB_Stick covers My_USB_Stick_40GB and My_USB_Stick_80GB ^[22].

Encryption writes the management Site's UUID onto the device ^[11]. On attach, ME&PP compares that UUID against the connected Site and any trusted Sites: the same Site or a different trusted Site gets access with a password, a non-trusted Site gets no access ^[12]. The controlling setting, enabled by default, is "Allow access to storage devices encrypted at current site only", which the post describes as what stops an encrypted USB being opened on a random unmanaged machine and what lets you share media across trusted Sites ^[13]. For machines with no ME&PP, or offline, the Explorer Utility can be copied onto the device so the encrypted data is still readable with a password ^[14]. The UUID comparison is something an ME&PP client does, so once the utility is on the stick, the password is the only control on a machine without the client ^[15].

Scanning runs before access is allowed, and it looks for both malware and unauthorized file types ^[24]. Where self-authorization is permitted, the user scans manually or automatically and the device is then authorized; where it is not, a specified administrator authorizes the device after a clean scan ^[25]. Authorization then behaves differently depending on where the contents changed afterwards: edits made inside a trusted ME&PP environment do not force a rescan on each insertion, while a device changed in an environment without ME&PP is rescanned every time it is inserted into an ME&PP PC ^[26]. The unauthorized file type list has two modes, and the default is the blocklist form with all types allowed ^[27]. Until an administrator puts entries on that list, no file type is blocked ^[29].

Devices that cannot store data are handled by controlling the ports directly, with a per-device Access Type of Allow or Block plus Log ^[28]. Device-level exceptions import and export as JSON, and the devices themselves come either from the Device Discovering Wizard, which reads user logs, or from manual entry ^[3][23]. The post covers a cloud-managed deployment through the Infinity Portal and Web Management, and says that where an on-premises Management Server behaves differently, this is called out ^[1].