A method comprising: loading a plug-and-play, PnP, driver as an upper-device filter in a device stack of a hub, including writing a registry key indicating to an operating system of a computing device that the PnP driver should be loaded as an upper-device filter in the device stack of the hub upon initialization of the hub and restarting the hub to cause the operating system to load the PnP driver; receiving, by the PnP driver implemented on the computing device, a message listing at least one enumerated bus device (104, 106, 108, 134) that is connected to the computing device, wherein the message is a response to an enumeration request from a PnP manager requesting to a receiving bus driver a list of all enumerated bus devices attached to the enumerated bus device represented by the receiving bus driver, and wherein the PnP driver, as an upper-device filter in the device stack of the hub, has visibility of both the request and the response; determining, by the PnP driver, whether the at least one enumerated bus device belongs to a device class, wherein determining whether the at least one enumerated bus device belongs to a device class is based on the PnP driver issuing a request for indicative features for the at least one enumerated bus device; based at least in part on the determining, attaching the PnP driver as an upper-device filter or a lower-device filter in a device stack associated with the at least one enumerated bus device; creating (314, 316) a fingerprint for the at least one enumerated bus device (104, 106, 108, 134) based on information collected by the PnP driver and on information gathered by a security service cloud; receiving by the PnP driver a configuration update from a security client implemented on the computing device or from a remote security service, the configuration update affecting an indicator of attack usable by the PnP driver to limit or block the enumerated bus device 104, 106, 108, 134) that is connected to the computing device. loading a plug-and-play, PnP, driver as an upper-device filter in a device stack of a hub, including writing a registry key indicating to an operating system of a computing device that the PnP driver should be loaded as an upper-device filter in the device stack of the hub upon initialization of the hub and restarting the hub to cause the operating system to load the PnP driver; receiving, by the PnP driver implemented on the computing device, a message listing at least one enumerated bus device (104, 106, 108, 134) that is connected to the computing device, wherein the message is a response to an enumeration request from a PnP manager requesting to a receiving bus driver a list of all enumerated bus devices attached to the enumerated bus device represented by the receiving bus driver, and wherein the PnP driver, as an upper-device filter in the device stack of the hub, has visibility of both the request and the response; determining, by the PnP driver, whether the at least one enumerated bus device belongs to a device class, wherein determining whether the at least one enumerated bus device belongs to a device class is based on the PnP driver issuing a request for indicative features for the at least one enumerated bus device; based at least in part on the determining, attaching the PnP driver as an upper-device filter or a lower-device filter in a device stack associated with the at least one enumerated bus device; creating (314, 316) a fingerprint for the at least one enumerated bus device (104, 106, 108, 134) based on information collected by the PnP driver and on information gathered by a security service cloud; receiving by the PnP driver a configuration update from a security client implemented on the computing device or from a remote security service, the configuration update affecting an indicator of attack usable by the PnP driver to limit or block the enumerated bus device 104, 106, 108, 134) that is connected to the computing device. based at least in part on the determining, attaching the PnP driver as an upper-device filter or a lower-device filter in a device stack associated with the at least one enumerated bus device; creating (314, 316) a fingerprint for the at least one enumerated bus device (104, 106, 108, 134) based on information collected by the PnP driver and on information gathered by a security service cloud; receiving by the PnP driver a configuration update from a security client implemented on the computing device or from a remote security service, the configuration update affecting an indicator of attack usable by the PnP driver to limit or block the enumerated bus device 104, 106, 108, 134) that is connected to the computing device.