Device Identifier

No single attribute fits every purpose. Each type identifies a different thing: an interface, a radio, a whole unit, or a model.

The serial number is assigned by the manufacturer, printed on the label, and usually readable through the operating system. A MAC address is a 48-bit value for one network interface, and a laptop typically has several. IMEI is how carriers recognize a phone on a network. The system UUID stored in firmware survives operating-system reinstalls. The VID:PID pair is assigned per make and model.

Identifiers link observed hardware to asset records. When an agent reports what is connected, the serial number and model data show whether a device is already known, new, or gone. Policies built on device control reference identifiers directly: a corporate encrypted drive can be allowed by its serial number, while a whole model line can be blocked or set to read-only by vendor and product ID.

The same identifiers appear in event records. When a file is copied to removable media or a device connects at an unusual hour, the record carries the device's identity, so an investigator can attribute the action to specific hardware. From procurement to disposal, the identifier also links purchase records, assignments, repairs, and write-off.

The most practical distinction is what an identifier points at. A serial number works at the instance level and separates two identical drives bought on the same day. A vendor and product ID pair works at the model level, so every unit of that product reports the same values.

Neither is better, and mature policies combine both: a class rule defines what a category of devices may do, and an instance exception admits one specific unit. Misreading the scope is a common mistake. Blocking a counterfeit-prone VID:PID pair can disable hundreds of legitimate drives.

Identifiers differ in how far they can be trusted. MAC addresses are easy to rewrite, and current desktop and mobile systems randomize them by default. Serial numbers on cheap removable storage are often duplicated across a batch. Firmware UUIDs change when a motherboard is replaced. Treat any single attribute as a hint rather than proof, and confirm identity with several attributes observed together, such as manufacturer, model, and serial number.

In the Anexet console, the workstation Devices tab lists detected hardware with its type and manufacturer. The device control filter shows the identifiers of a chosen device: vendor ID, product ID, and serial number.

1 / 2

• 
• 

Device identifiers sit at the edge of personal data. The IMEI or MAC address of a personal phone used for work can be linked to one person, which brings their processing under data-protection rules such as the GDPR in an employment context. Organizations that collect identifiers at scale, as inventory systems do, should define the purpose, limit access to the data, and keep it no longer than that purpose requires. In BYOD settings, identifying an employee's own device means processing data about that person.

Start with the identifiers your rules actually need. A serial number suits a short list of company drives that must be tracked one by one, while a model pair suits a whole class of hardware.

A rule that matches the wrong scope either misses the device it was meant to stop or blocks hardware the business depends on. Test each rule on known devices before enforcing it, and pair it with Data Loss Prevention (DLP) for the channels that matter most.