A single infected pen drive can walk past every firewall and land straight on an engineering workstation. Good removable media security decides which drives may enter the plant, how they are scanned and who is allowed to plug them in.
USB drives still carry firmware, backups and logs in and out of control systems every day. Removable media security turns that risky habit into a controlled, logged and repeatable procedure.
What Is Removable Media Security?
Removable media security is the set of policies, physical controls and technical tools that govern how USB flash drives, external hard disks, SD cards and CD or DVD discs are used around industrial control systems. Its aim is simple: no file reaches a PLC, DCS or HMI unless it comes on an approved device and passes a scan.
Operational technology networks are often isolated, so engineers depend on pen drives to move firmware, project backups, alarm logs and analyzer reports. That convenience creates a direct path around firewalls, which is why the Purdue model alone cannot stop media borne malware.
In Indian refineries, power stations, pharma units and water utilities, the same drive often travels between the office laptop, the vendor laptop and the engineering station. A removable media security programme controls every step of that journey.
Why USB Drives Still Threaten Control Systems
Honeywell reports in its 2024 USB Threat Report that 51 percent of malware attacks were designed for USB devices, up from 9 percent in its 2019 report. That is nearly a six fold rise in five years.
The same Honeywell research found that 82 percent of the malware it saw could cause loss of view or loss of control in industrial operations. It also reports that 31 percent of attacks targeted industrial systems, compared with 16 percent in 2016.
Industrial Cyber, summarising the report, notes that about 20 percent of the analysed malware was content based, hiding inside documents, spreadsheets and scripts. A drive that carries only a harmless looking Excel sheet can still deliver a payload, which is why removable media security must scan content, not just executables.
Stuxnet, discovered in 2010, is widely believed to have entered an air gapped uranium enrichment site on an infected USB drive. It then reprogrammed Siemens S7 PLCs that drove centrifuges while showing normal values to operators.
Main Removable Media Threats in OT
Ordinary worms, ransomware and trojans copied from home or office computers onto a pen drive.
Code written to find engineering software or PLC project files, as Stuxnet did.
A device that looks like a drive but acts as a keyboard and types commands at high speed.
Copying recipes, P&ID drawings or control logic onto an unmanaged drive.
Keystroke injection works because the operating system trusts any new keyboard, so antivirus scanning of files never sees it. These attack styles are part of the wider family of cyber attacks that every OT engineer should recognise.
What NIST SP 1334 Recommends
In September 2025 the NIST National Cybersecurity Center of Excellence published SP 1334, a two page guide on reducing the cyber risk of portable storage media in OT environments. SecurityWeek notes that it covers USB drives as well as external hard drives and CD or DVD drives.
| Control Area | NIST SP 1334 Examples | Typical Plant Practice |
|---|---|---|
| Procedural | Use organisation owned media only, treat other devices as untrusted, train staff | Written USB policy, approved drive register |
| Physical | Store media in a secure location, inventory and label each device | Locked cabinet in the control room, serial numbers logged |
| Technical | Disable unused ports, allowlisting, scan before and after use, disable Autorun, encryption | Port lock software, kiosk scan, write protected drives |
| Transport and sanitisation | Encrypted or locked transport, hash checks, sanitise before disposal | Checksum on firmware files, secure wipe at end of life |
The guide also asks for logs that record user identity, device serial number, date and time, and for alerts on insertion and data transfer. Those logs feed the incident response plan when something goes wrong.
IEC 62443 and NIST SP 800 82 Guidance
IEC 62443 3 3 includes system requirement SR 2.3, use control for portable and mobile devices, which asks the system to restrict and log their use. Placing kiosks and enforcement points between zones and conduits makes that requirement practical.
NIST SP 800 82 Revision 3, the OT security guide, applies media protection controls such as restricting, scanning and sanitising media to industrial systems. Indian utilities that follow CERT In advisories and the Central Electricity Authority cyber security guidelines can map these controls to their own audits, alongside the vendor rules in cybersecurity standards for PLCs.
Ask your DCS or PLC vendor which USB controls their system already supports, because many hardened workstation images ship with port lock and allowlisting built in. Using the vendor tool avoids compatibility issues with qualified antivirus versions.
7 Smart Rules for Removable Media Security
These seven rules map directly to the NIST SP 1334 control areas and to IEC 62443 SR 2.3. They also depend on a good OT asset inventory, since you cannot lock ports on machines you do not know exist.
How a Removable Media Security Kiosk Works
Honeywell describes its Secure Media Exchange as four parts: a scanning kiosk called the SMX Gateway, a Cyber Threat Engine, an enterprise threat management portal and an SMX Client enforcement driver on each endpoint. The client is what stops a user who skips the kiosk.
A kiosk sits at the boundary, often in the industrial DMZ or the control building entrance. It complements, but never replaces, one way transfer devices such as a data diode for routine data export.
Windows changed its default behaviour so that AutoRun no longer launches programs from USB flash drives, a feature Stuxnet era worms abused heavily. Old, unpatched HMIs may still allow it, so NIST SP 1334 asks plants to disable it explicitly.
Kiosk Sizing Formula
Before buying kiosks, estimate the daily scanning load from drive count, data size and handling time.
Daily load (min) = Drives per day × Time per drive
Kiosks needed = Daily load ÷ Available minutes, rounded up
Example:
40 drives per day, 8 GB each, scan rate 2 GB per min, handling 3 min, 480 min available
Time per drive = 8 ÷ 2 + 3 = 7 min
Daily load = 40 × 7 = 280 min
Utilisation = 280 ÷ 480 = 58.3 percent
Kiosks needed = 1
The scan rate here is only an example, so use the figure your kiosk vendor quotes for your own file mix.
Scanning Kiosk Load Calculator
Second Worked Example: Plant Shutdown Week
During an annual turnaround, a refinery may host many vendor engineers carrying firmware and backups. Suppose 150 drives arrive per day with 16 GB each, at 2 GB per minute and 3 minutes handling, in a 480 minute shift.
Time per drive becomes 16 ÷ 2 + 3 = 11 minutes, so the load is 150 × 11 = 1650 minutes. Dividing by 480 gives 3.44, so the site needs 4 kiosks or a second shift for that week.
Plan extra portable kiosks or rented units for shutdowns rather than relaxing the rules. Most media incidents happen when queues build up and someone decides to skip the scan just this once.
Vendor and Contractor Removable Media Security
- Vendor declares every drive and file type before arrival.
- Drive is scanned at the kiosk and the report is attached to the work permit.
- Only site issued, encrypted drives enter the control room.
- Firmware files are checked against the vendor published hash.
- Drive is rescanned when it leaves the OT zone.
- Log entry records user, serial number, date and time.
Linking removable media security to the work permit gives the shift in charge a clear checkpoint. The same discipline supports PLC remote access security, because vendors who cannot plug in a drive often ask for a remote session instead.
Benefits and Trade Offs of a Media Programme
- Closes the most common path around OT firewalls.
- Creates an audit trail for every file that enters.
- Supports IEC 62443 and NIST SP 1334 requirements.
- Protects hardware from rogue USB devices.
- Kiosks and licences add cost.
- Queues form during shutdowns if capacity is low.
- Legacy HMIs may not support endpoint agents.
- Needs steady training and enforcement.
Common Mistakes and Troubleshooting
The most frequent removable media security mistake is buying a kiosk without enforcing anything at the endpoint, so users simply walk past it. Another is allowing a single shared drive to move between office and plant without rescanning.
If a workstation stops recognising approved drives after a Windows update, check the device control policy and the antivirus version qualified by the DCS vendor before changing anything. Restore from a known good image, as listed in a SCADA security checklist, if behaviour looks suspicious.
Where Removable Media Security Matters Most
A strong programme fits alongside network segmentation, as compared in air gapped versus segmented networks, and alongside zero trust architecture for user access. Removable media security covers the gap that network controls cannot see.
NIST SP 1334 Portable Media Guide
USB Media Scanning Kiosk Video
Removable Media Security FAQ
It is the set of rules and tools that control how USB drives, disks and memory cards are used around control systems. Only approved devices that pass a scan may reach an HMI, PLC or engineering station.
It combines policy, physical storage, port control and scanning kiosks. Logging every insertion then gives an audit trail for investigations and compliance reviews.
Honeywell reports that 51 percent of malware in its 2024 study was designed for USB devices. In its 2019 report the same figure was only 9 percent.
Honeywell also found that 82 percent of that malware could cause loss of view or loss of control. These numbers explain why plants treat every pen drive as a possible threat.
The guide groups its advice into procedural, physical, technical, and transport and sanitisation controls. Examples include using only organisation owned media, locking it away and labelling each drive.
Technical controls include disabling unused ports, allowlisting, scanning before and after use and disabling Autorun. It also recommends encryption, hash checks during transport and sanitising drives before disposal.
No, an air gap actually makes removable media the main way files enter the system. Stuxnet is widely believed to have reached an isolated site on an infected drive.
Isolated machines also tend to have older antivirus signatures and missing patches. Scanning at a kiosk with current engines is therefore even more important on air gapped networks.
It is a gadget that looks like an ordinary pen drive but tells the computer it is a keyboard. It can then type commands much faster than any person.
Because it does not store a file, normal antivirus scanning does not catch it. Device control that blocks unknown keyboards and human interface devices is the right defence here.
IEC 62443 3 3 includes system requirement SR 2.3, use control for portable and mobile devices. It asks the system to restrict use of such devices and to log it.
Kiosks, port lock software and endpoint agents are the usual ways to meet it. Placing them at zone boundaries links the requirement to your zones and conduits model.
Divide the daily scanning load in minutes by the minutes a kiosk is available. The load equals drives per day times the scan time plus handling time for each drive.
For example, 40 drives at 7 minutes each need 280 minutes, so one kiosk is enough. Recalculate for shutdowns, when vendor traffic can multiply several times over.
Related Articles
- Data Diode for OT Network Security
- IEC 62443 Zones and Conduits
- OT Patch Management for ICS
- ICS Incident Response Plan for OT
- Air Gapped vs Segmented ICS Networks
External References
- NIST SP 1334, Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments
- Cybersecurity in 2024: USB Devices Continue to Pose Major Threat, Honeywell
- USB Flash Drive Security, Wikipedia
What We Learn Today
- Honeywell found 51 percent of malware in its 2024 report was designed for USB devices, up from 9 percent in 2019, and most could disrupt operations.
- Removable media security combines a written policy, owned encrypted drives, locked ports, kiosk scanning, allowlisting, logging and secure sanitisation of every device.
- NIST SP 1334 and IEC 62443 SR 2.3 both expect plants to restrict, scan and log portable media before it touches any control system.
