A practical, engineering-first look at how industrial organizations can close one of the oldest and most underestimated gaps in OT security: the humble USB drive.

Walk onto almost any plant floor and you will find a control room where a technician is updating firmware, pulling diagnostic logs, or transferring a configuration file using a USB drive. It is fast, it is familiar, and it has been part of industrial workflows since long before anyone used the phrase "cybersecurity." It is also one of the most consistent ways that malware has entered operational technology environments that were otherwise air-gapped and, in theory, untouchable.

Removable media does not respect network segmentation. It does not care whether a system is connected to the internet. A single infected drive can walk past every firewall, every intrusion detection system, and every carefully designed network zone, simply because someone plugged it into a workstation to move a file. For OT security leaders, this is not a hypothetical risk. It is one of the most well-documented attack paths in the history of industrial cyber incidents, and it remains active today across manufacturing plants, utilities, and critical infrastructure sites worldwide.

This is exactly where Zero Trust becomes relevant, not as a marketing term, but as an operating philosophy. Zero Trust assumes that no device, user, or file is inherently safe until it has been verified, and it applies that principle continuously rather than once at the point of entry. Applied correctly to removable media, Zero Trust transforms a USB port from an open door into a controlled, monitored, and auditable checkpoint. This guide breaks down why that shift matters, what the real risks look like, and how industrial organizations can put Zero Trust principles into practice without slowing down operations.

Why Removable Media Remains a Persistent Threat in OT Environments

The Physical Bridge Between IT and OT

Operational technology environments were built for reliability and safety, not connectivity. Many control systems still run on legacy platforms that cannot be patched quickly, cannot run modern endpoint protection, and were never designed with network-based threats in mind. For years, the assumption was that physical isolation, commonly called an air gap, would keep these systems safe. Removable media quietly erased that assumption.

A USB drive, an external hard disk, or even a technician's laptop connected temporarily for maintenance can carry malicious code directly into a segmented OT network, bypassing every perimeter control an organization has invested in. Vendors, contractors, and internal engineers routinely move files this way because it is often the only practical method available on systems that have no network connectivity by design. That convenience is precisely what makes removable media such an attractive and reliable entry point for attackers.

A Legacy of Real-World Incidents

The industrial sector has learned this lesson the hard way, more than once. One of the most widely studied cases involved a piece of malware engineered specifically to target industrial control systems, which was introduced into a highly isolated, air-gapped facility through an infected USB drive carried in by a contractor. The malware spread quietly through engineering workstations before ultimately manipulating the physical process it was designed to sabotage. It remains one of the clearest examples of how removable media can defeat even the most rigorous network isolation strategy.

More recently, ransomware operators have increasingly used USB-borne malware as an initial access technique against manufacturing and logistics operators, particularly in facilities where IT security policies do not extend fully into the plant floor. Security researchers tracking industrial threat activity have repeatedly flagged removable media as a top-three initial access vector for OT-targeted intrusions, alongside remote access exploitation and phishing. The pattern is consistent across sectors: energy, water treatment, pharmaceuticals, food and beverage, and heavy manufacturing have all reported incidents traced back to an unmanaged or unscanned removable device.

The common thread in nearly every one of these incidents is not sophistication. It is trust. Someone trusted a device, a vendor, or a file without verifying it, and that single moment of unearned trust became the entry point for the entire event.

What Zero Trust Really Means for OT Security

Moving Away from Implicit Trust

Traditional OT security models operate on implicit trust. Once a device is inside the network perimeter, or once a technician is inside the control room, that device and that person are generally trusted to interact with critical systems with minimal further scrutiny. This model made sense when OT networks were physically isolated and rarely touched by outside devices. It makes far less sense today, when contractors, vendors, engineers, and third-party service providers routinely bring laptops and removable drives directly into sensitive environments.

Zero Trust replaces that assumption with a simple, disciplined rule: verify everything, every time, regardless of where it came from or who is carrying it. No device is automatically trusted because it is inside the building. No file is automatically safe because it came from a known vendor. No user is automatically authorized simply because they have physical access to a workstation. Every interaction is checked against policy before it is allowed to proceed.

The Core Principles of Zero Trust in an OT Context

While Zero Trust is often discussed in the context of enterprise IT networks, its underlying principles translate directly to OT environments and, specifically, to how removable media is handled. The table below outlines the core principles and what they mean in an industrial context.

These five principles are not abstract theory. Each one maps directly to a control that OT security leaders can implement today, and together they form the foundation of a Zero Trust approach to removable media, which is examined in detail later in this guide.

Risks, Challenges, and Industry Insights

Why Removable Media Is a Unique Challenge in Industrial Settings

Enterprise IT teams have had over a decade to mature their approach to USB and removable device security. Most modern IT endpoint protection platforms can scan, restrict, or block removable media automatically. OT environments face a different reality. Endpoint agents that work reliably on a corporate laptop fleet often cannot be installed on programmable logic controllers, human-machine interfaces, engineering workstations running unsupported operating systems, or safety instrumented systems, where any change requires extensive validation and downtime approval.

This creates a genuine and difficult tension for OT security leaders. Removable media is frequently the only practical way to transfer configuration files, firmware updates, diagnostic logs, and historian data on systems that are intentionally kept off the network. Blocking USB access outright is rarely realistic, since it would interrupt legitimate maintenance and engineering work that keeps the plant running. The challenge, then, is not eliminating removable media use, but controlling it with the same rigor applied to any other privileged access path into critical systems.

There is also a workforce reality that adds to the difficulty. Plant engineers and maintenance technicians are trained to keep production running safely and efficiently, not to think like cybersecurity analysts. Asking them to memorize a long list of manual security checks rarely works in practice, especially during time-pressured maintenance windows. A control that depends entirely on individual vigilance will eventually fail, simply because people are focused on the job in front of them. This is exactly why Zero Trust favors controls that are built into the process itself, so security does not depend on someone remembering to follow a rule under pressure.

Common Attack Pathways Through Removable Media

Understanding how removable media is actually exploited helps clarify why a Zero Trust approach is necessary rather than optional. The table below summarizes the most common pathways observed across industrial incidents.

The Business Impact of a Single Infected Drive

It is easy to underestimate how far the consequences of a single infected drive can reach. Beyond the immediate cost of incident response and system recovery, OT security incidents traced to removable media frequently trigger production downtime, safety system reviews, regulatory reporting obligations, and, in critical infrastructure sectors, mandatory disclosure to oversight bodies. Industry cost studies on industrial ransomware and OT-targeted incidents have consistently placed average downtime costs in the range of tens of thousands of dollars per hour for continuous-process industries such as energy, chemicals, and food and beverage manufacturing.

There is also a reputational dimension that is harder to quantify but equally real. Customers, partners, and regulators increasingly expect critical infrastructure operators to demonstrate mature cybersecurity governance. An incident that originated from something as preventable as an unscanned USB drive raises difficult questions about an organization's overall security posture, questions that can affect vendor qualification, insurance premiums, and long-term stakeholder trust.

Applying Zero Trust to Removable Media: A Practical Framework

Turning Zero Trust from a principle into a working control requires breaking it down into specific, implementable layers. The following framework reflects how leading industrial security teams are structuring removable media governance today.

1. Continuous Verification at Every Touchpoint

Verification cannot be a one-time event that happens when a device is first issued. Under a Zero Trust model, every time a removable device is connected, its identity, its content, and the context of its use are checked again. This includes confirming that the device is registered, that its content has been scanned since the last connection, and that the user attempting to connect it is authorized for that specific system at that specific time.

2. Least Privilege Access for Devices and Files

Not every technician needs access to every workstation, and not every file transfer needs unrestricted read-write access. A least privilege model restricts what a removable device can do based on role, task, and system criticality. A vendor performing a firmware update on a single PLC, for example, should not have the same access rights as an internal engineer performing broader diagnostic work across multiple systems.

3. Trusted Device Registration and Control

Only known, registered devices should be permitted to connect to OT systems at all. Trusted device controls typically involve issuing organization-managed USB drives, disabling ports for unregistered hardware, and maintaining a live inventory of every device authorized for use in the environment. This single step eliminates a significant share of removable media risk, since it removes anonymous or unknown hardware from the equation entirely.

4. Dedicated Media Scanning and Sanitization Stations

A media scan station, sometimes called a kiosk, sits outside the OT network and inspects every removable device before it is allowed anywhere near a control system. Files are scanned against multiple detection engines, sanitized where appropriate, and only cleared content is permitted to proceed. This creates a physical and procedural checkpoint that mirrors, in the physical world, what a firewall does in the network world.

5. Logging, Visibility, and Audit Trails

Every connection, scan result, and file transfer involving removable media should be logged and retained. This visibility serves two purposes. It allows security teams to detect anomalous patterns, such as a device being used far more often than its assigned task requires, and it provides the audit trail that regulators and insurers increasingly expect industrial operators to maintain.

Logging also plays a quieter but equally important role during incident investigations. When something does go wrong, whether it is a malware detection, an unexplained system fault, or an audit inquiry, the ability to reconstruct exactly which devices touched which systems, and when, can dramatically shorten investigation time. Without that record, security teams are often left reconstructing events from memory and fragmented reports, which slows response and makes root-cause analysis far less reliable.

Practical Recommendations and Best Practices

The following recommendations translate the Zero Trust framework above into concrete actions that OT security leaders can begin implementing immediately.

• Deploy dedicated media scanning stations at every entry point to the OT environment, including engineering offices, maintenance rooms, and vendor check-in areas.

• Disable USB ports by default on all OT endpoints and enable them only through an approved exception process tied to a specific task and time window.

• Issue organization-controlled removable media to contractors and vendors instead of allowing personal devices onto the plant floor.

• Require multi-engine malware scanning, not single-engine scanning, since industrial malware is frequently designed to evade a single detection method.

• Maintain a live inventory of every registered removable device, including who it is assigned to and which systems it is authorized to touch.

• Set expiration windows on device authorizations so that access does not persist indefinitely after a project or maintenance window ends.

• Integrate removable media logs with your broader OT monitoring program so unusual patterns are visible to the security operations center, not siloed in a separate system.

• Train plant personnel and third-party contractors on why these controls exist, not just what the controls are; understanding drives compliance far more effectively than rules alone.

• Review and test the removable media policy on a scheduled basis, treating it as a living control rather than a one-time project.

• Align removable media governance with recognized OT security frameworks so the program supports broader compliance and audit requirements rather than existing in isolation.

Building a Zero Trust Removable Media Policy

A strong policy translates the framework and recommendations above into a document that plant leadership, security teams, and auditors can reference consistently. The table below outlines the core components a mature removable media policy should include.

None of these components work well in isolation. A registration process without an enforced scanning requirement simply creates a false sense of security, and a scanning requirement without logging leaves an organization unable to demonstrate compliance after the fact. The strength of a Zero Trust removable media policy comes from how tightly these components work together as a single, continuous control.

How Shieldworkz Supports Organizations

Shieldworkz works alongside OT security leaders, plant managers, and CISOs to design and implement removable media controls that fit the realities of live industrial environments, not theoretical IT frameworks retrofitted onto a plant floor. Our approach is built around the operational constraints that make OT security different: legacy systems, uptime requirements, safety considerations, and a workforce that needs security controls to be practical, not just technically sound.

• OT-specific risk assessments that identify where removable media is currently used across the environment and where the greatest exposure exists.

• Design and deployment support for media scanning stations tailored to plant layout, vendor traffic patterns, and existing network architecture.

• Policy development for trusted device registration, least privilege access, and contractor onboarding aligned with recognized industrial security frameworks.

• Integration of removable media logging and alerting into existing OT monitoring and security operations workflows.

• Workforce awareness programs designed specifically for plant personnel, engineers, and third-party technicians rather than generic corporate security training.

• Ongoing advisory support to help organizations mature their Zero Trust posture over time, rather than treating removable media security as a one-time project.

The goal is not to add friction for the sake of security. It is to build a removable media program that engineers and technicians can work with confidently, that plant managers can trust operationally, and that CISOs can defend to auditors, insurers, and boards.

Zero Trust vs. Traditional Removable Media Controls

Many industrial organizations already have some form of removable media policy in place. The difference between a traditional policy and a genuinely Zero Trust approach often comes down to when and how often verification happens, rather than whether a policy exists on paper. The comparison below highlights that distinction.

This is not a criticism of organizations that started with a traditional approach. It reflects how removable media security has evolved as threats have become more sophisticated and as regulators and insurers have raised expectations around demonstrable, continuous controls rather than static, point-in-time policies.

Measuring Success: What to Track in a Zero Trust Removable Media Program

Implementing new controls is only half the work. OT security leaders also need a way to demonstrate that the program is functioning as intended, both to internal stakeholders and to external auditors. The following metrics offer a practical starting point for measuring the health of a removable media security program.

• Percentage of removable devices in use that are formally registered and inventoried.

• Number of unauthorized or unregistered device connection attempts detected and blocked over a given period.

• Average time between a device connection and completion of its required scan.

• Number of malicious files or threats identified and quarantined at scanning stations before reaching OT systems.

• Percentage of contractors and vendors onboarded through the formal device registration process versus exceptions granted.

• Frequency of policy review and the number of updates made in response to new threats or operational changes.

Tracking these metrics over time does more than support compliance reporting. It gives plant managers and CISOs a factual basis for resourcing decisions, helps identify where additional training or scanning infrastructure is needed, and builds a defensible record that the organization is treating removable media as the serious risk it represents.

Conclusion

Removable media will likely remain part of industrial workflows for years to come, particularly in environments where legacy systems and air-gapped architectures make network-based file transfer impractical. That is not a reason to accept the risk it carries. It is a reason to govern it properly.

Applying Zero Trust principles to removable media does not mean eliminating USB drives from the plant floor. It means replacing blind trust with verification, replacing broad access with least privilege, and replacing silence with visibility. For OT security leaders, this shift closes one of the most consistently exploited gaps in industrial cybersecurity, without slowing down the maintenance and engineering work that keeps operations running.

Organizations that treat removable media as a governed access path, not an overlooked convenience, are better positioned to prevent the kind of incident that starts small and ends in a costly, disruptive, and entirely avoidable shutdown.

The organizations that get this right rarely make headlines, and that is exactly the point. A well-governed removable media program does not announce itself. It simply removes one more way for an ordinary workday to turn into an extraordinary crisis, quietly protecting production, safety systems, and the people who depend on both.

Ready to Close the Gap in Your OT Security Program?

If removable media access hasn't been reviewed as part of your OT security strategy, now is the right time. Our team can help you assess your current exposure and design a Zero Trust removable media program built around how your plant actually operates.

Book a Free Consultation with Our Experts

Additional resources:

OT Cyber Threat Intelligence Advisory - Middle East here
NIS2 Directive Achieving NIS2 Compliance Through IEC 62443 here
What Is Removable Media? Risks, Policies, and Industrial OT Security Solutions here
Free Removable Media Policy Template for OT and IT Teams here