Christopher DeMarco's questions

I have a client who wants us to lock down the Mac laptops we're using to access his data. He wants an audit of all files read and written from removable media (USB, FireWire, optical). I have a sister question re: finding a commercial app for this, but I'm starting to feel like the only fun^H^H^H suitable solution will be DIY.

Does Cocoa have an API to audit the bus/device, any identifiers (S/N, vendorID, et.al.), the filesystem metadata (stat()) and blocks in/out, etc.? Does dtrace do this!?

I could reinstall every laptop with ZFS and mirror any external device via copy-on-write...

We have a client who's requiring that we implement dataloss prevention on workstations that are accessing their project's data. If Alice attaches removable media (USB, FireWire, CD, DVD) to her computer, we need an audit report that she copied files X, Y, Z to/from media. We have a 100% Mac user base.

I've looked at endpoint protector products from CoSoSys and Sophos, but neither supports removable media control on the Mac. I'm looking at McAfee right now, but their product literature is making my head spin.

Can anybody recommend a product to do this? Or are we looking at building something from scratch?

Thanks in advance...