In December 2023, a water treatment facility in the United States discovered unauthorized changes to its programmable logic controllers, traced back to a single infected USB drive that a maintenance technician had used at multiple sites. No sophisticated remote intrusion. No zero-day exploit. Just a thumb drive the size of your finger.

Before we move forward, don’t forget to check out our previous blog post on USB Device Control Policy Guide for Industrial Networks here.

This incident is not an outlier. According to research published by industrial cybersecurity organizations, USB-borne threats account for a significant share of all cyberattacks targeting operational technology environments. And unlike network-based intrusions, USB attacks bypass firewalls, demilitarized zones, and intrusion detection systems entirely.

For organizations operating industrial control systems, distributed control systems, SCADA platforms, and critical infrastructure, USB security is no longer a peripheral IT concern, it is a frontline operational risk. This guide breaks down the real-world threats, practical controls, and enforcement strategies every OT security leader and plant manager needs to understand.

Why USB Devices Remain the Achilles Heel of Industrial Cybersecurity

Industrial environments have unique characteristics that make USB threats especially dangerous. Many OT systems run legacy operating systems that have not been patched in years ,sometimes decades. They are air-gapped from corporate networks by design, which creates a paradox: the very isolation meant to protect them makes removable media the primary channel for data transfer, software updates, and maintenance.

The result is predictable. Technicians, contractors, and vendors routinely plug in USB drives to upload firmware, transfer historian data, install vendor-supplied software, or simply share files. Each insertion is a potential attack vector.

The Scale of the Problem: Industry Data

Real-World Incidents That Redefined USB Security for OT

Stuxnet: The Incident That Changed Everything

The most cited example remains Stuxnet ,the sophisticated malware that spread via infected USB drives into the Natanz uranium enrichment facility in Iran, physically damaging centrifuges while reporting normal operations to operators. What made Stuxnet landmark was not just its complexity, but its delivery method: a removable drive introduced into a completely air-gapped network. Fifteen years later, the attack model it established is still being replicated by threat actors targeting industrial infrastructure worldwide.

Triton/TRISIS: Targeting Safety Instrumented Systems

In 2017, the Triton malware framework targeted safety instrumented systems at a petrochemical plant in the Middle East. While the initial intrusion vector involved corporate network compromise, the persistence mechanism and lateral movement within the OT environment relied on removable media to reach isolated safety controllers. The incident nearly caused a catastrophic physical failure that could have endangered human lives.

Taiwan Semiconductor Manufacturing Company (2018)

TSMC, one of the world's largest semiconductor manufacturers, experienced a WannaCry variant infection that spread across its fabrication plants, originating from an unvetted software installation on a computer connected to the OT network. The infection caused a three-day production shutdown, with losses estimated at $250 million. The root cause: insufficient controls over what could be installed from removable media on production-connected systems.

U.S. Power Grid Reconnaissance (2022)

Security researchers uncovered a campaign in which threat actors used infected USB devices disguised as promotional items and shipped to employees at multiple energy sector organizations. When plugged in, the drives installed a remote access framework designed to map OT network topology. The campaign targeted utilities specifically because USB-based entry is harder to detect than network intrusions.

Anatomy of a USB-Based Attack on Industrial Control Systems

Understanding how USB-based attacks work in industrial environments helps security teams design more effective defenses. These attacks typically follow a structured progression:

Stage 1 - Device Introduction

An infected USB device enters the facility. This may be through a well-meaning employee who connected a drive to an external computer, a contractor using their personal storage device, a vendor who received a pre-infected drive through their own supply chain, or a social engineering campaign delivering infected drives to target personnel.

Stage 2 - AutoRun or Manual Execution

Legacy systems in many OT environments still support AutoRun functionality, allowing malicious code to execute the moment a drive is inserted. On more hardened systems, the attack may require a human action, but social engineering techniques like disguising executables as firmware updates or configuration files remain highly effective.

Stage 3 - Host Compromise and Lateral Movement

Once executed, the malware typically establishes persistence on the engineering workstation or HMI, then attempts to reach PLCs, RTUs, or other field devices through legitimate communication protocols. Because OT protocols like Modbus, DNP3, and EtherNet/IP were designed for reliability, not security ,the malware can issue commands that appear indistinguishable from legitimate operator actions.

Stage 4 - Payload Execution

Depending on threat actor intent, the payload may execute immediately or remain dormant for months, waiting for a trigger. Payloads range from ransomware targeting historian servers to logic bombs designed to alter PLC ladder logic at a precise moment, or persistent backdoors enabling long-term reconnaissance.

Building a Robust USB Device Control Policy for Industrial Environments

A USB device control policy is the foundational governance document that defines which devices may be used, under what conditions, by whom, and with what security requirements. For organizations operating OT infrastructure, this policy must address both the IT-facing elements of removable media management and the unique constraints of operational environments where patching cycles are measured in years and downtime carries safety consequences.

Core Elements of an Effective USB Security Policy

USB Security Policy for Employees: What Industrial Organizations Must Enforce

A policy that exists only on paper provides no protection. Effective USB security for industrial environments requires enforcement mechanisms that are practical within the operational context, meaning they must not create barriers that cause workers to find workarounds, which is itself a significant risk.

Practical Enforcement Principles

Never use personal USB devices on any OT-connected system. All removable storage must be company-issued, registered, and encrypted with hardware-level encryption. This applies equally to field technicians, control room operators, and visiting contractors.

Scanning before insertion is non-negotiable. Every USB device must pass through an approved scanning station before use on any industrial asset. The scanning station should use a dedicated system not connected to the production network, running security software with OT-specific threat intelligence.

USB ports should be physically or logically disabled by default. Enable ports only when there is a documented operational need, through a change management process that includes supervisor approval and logging.

Training must go beyond awareness. Employees should understand specific attack scenarios relevant to their role ,not just generic cybersecurity awareness. A maintenance technician needs to know what a weaponized drive looks like and what to do if they find an unmarked device.

Vendor and contractor devices require independent verification. Never assume a vendor's device is clean. Require vendors to pre-register and pre-scan media before arrival, and verify compliance on-site before any device touches a production system.

USB Device Control Software: Technical Enforcement for OT Environments

Policy without technical enforcement is insufficient. USB device control software provides the automation and real-time enforcement layer that makes policies operational rather than aspirational. For OT environments, the requirements go significantly beyond what standard IT-focused endpoint management tools provide.

Critical Capabilities for OT-Grade USB Control

The ability to permit only pre-registered devices identified by vendor ID, product ID, and serial number, not just device class. This prevents approved device categories from being exploited by substituting a different device that presents the same class identifier. Device Allowlisting by Hardware Identity:

Many OT assets operate without persistent network connectivity to central management systems. USB device control software for industrial environments must enforce policy locally, even when disconnected from the management plane. Offline Policy Enforcement:

For environments where data can be read from media but never written to it, enforcing read-only mode on all USB storage prevents exfiltration while still allowing data import workflows. Read-Only Enforcement:

Automatically logging the content of files transferred to or from USB devices provides forensic capability and supports incident investigation without requiring real-time monitoring of all endpoints. Shadow Copy and File Logging:

Device control software should integrate with the OT asset inventory to ensure that only authorized devices can connect to specific assets ,not just any asset on the network. Integration with Asset Inventory:

A significant portion of OT infrastructure runs on Windows XP, Windows 7, or proprietary RTOS environments. USB control software must support these operating systems, which mainstream IT endpoint tools frequently do not. Support for Legacy Systems:

OT systems running real-time control functions cannot tolerate the CPU overhead or memory consumption that some endpoint security tools impose. Solutions designed for OT must be lightweight and non-disruptive to real-time operations. Minimal Performance Impact:

The Role of USB Scanning Kiosks in ICS and SCADA Protection

One of the most effective physical controls in USB malware protection for SCADA systems is the dedicated scanning kiosk, a standalone, hardened workstation positioned at the entry point of the OT zone that serves as a mandatory checkpoint for all removable media.

How a Scanning Kiosk Works in Practice

A technician arriving on-site with a USB drive for a firmware update presents the device at the kiosk before entering the plant floor. The kiosk scans the drive against multiple threat intelligence sources, checks the device's hardware identity against the facility's allowlist, logs the scan result, and either grants a time-limited clearance token or flags the device for quarantine. The entire process takes less than two minutes and creates an auditable record.

More advanced implementations integrate with access control systems ,a device that fails scanning cannot be used because the port it would be connected to remains physically locked until a valid clearance is issued. This closes the gap between policy and physical reality.

Scanning Kiosk Requirements for OT Environments

Regulatory Drivers: What Standards Demand for Removable Media Security

USB device control is not just a best practice, it is a compliance requirement under multiple regulatory frameworks governing critical infrastructure and industrial operations. Understanding these requirements helps organizations build policies that satisfy multiple audit frameworks simultaneously.

Best Practices: A Layered Approach to USB Malware Protection

The most resilient USB security programs in industrial environments are built on defense-in-depth ,multiple overlapping controls that provide protection even when individual controls fail. Here is a layered framework that organizations can use as a starting point:

Layer 1 - Governance and Policy

• Establish a formal USB security policy that covers all personnel, contractors, and vendors with OT access.

• Define a clear device registration and approval process for all removable media used on OT-connected assets.

• Include USB security requirements in all vendor and contractor agreements, with audit rights.

Layer 2 - Physical Controls

• Deploy USB port blockers on assets where removable media is never required.

• Install scanning kiosks at all entry points to OT zones, integrated with access control where possible.

• Use tamper-evident seals on USB ports that should remain unused.

Layer 3 - Technical Enforcement

• Deploy USB device control software that enforces allowlisting by hardware identity on all OT endpoints.

• Implement read-only enforcement where write capability is not operationally required.

• Enable shadow copy logging for all file transfers to/from removable media.

• Integrate USB activity logs with the OT Security Operations Center for real-time alerting.

Layer 4 - Human Factors

• Conduct scenario-based training that simulates realistic USB-based attack scenarios.

• Establish a clear reporting procedure for found or suspicious devices.

• Implement a no-blame reporting culture to ensure employees report incidents without fear of repercussion.

Layer 5 - Detection and Response

• Monitor USB activity logs for anomalous patterns, high volume transfers, unusual hours, unregistered devices.

• Include USB-origin incident scenarios in tabletop exercises and incident response planning.

• Establish a documented process for isolating and forensically examining suspected infected assets.

How Shieldworkz Supports Organizations in Securing Industrial USB Environments

Shieldworkz brings deep operational technology expertise to the challenge of USB security ,understanding not just the technology, but the operational realities that make standard IT security approaches insufficient for industrial environments. Our approach is built around what works in the field, not just what looks good in compliance documentation.

• We conduct comprehensive assessments of your current USB usage patterns, port exposure, and policy gaps across your OT environment, identifying the specific risks that are most material to your operational context. OT-Specific USB Risk Assessment:

• Our team designs and documents a USB security policy for employees and contractors that is operationally realistic, enforceable, and aligned with the regulatory frameworks applicable to your industry sector. USB Device Control Policy Development:

• We evaluate, select, and deploy USB device control software solutions that meet the specific requirements of your OT environment, including legacy system support, offline enforcement, and integration with existing OT asset management platforms. USB Device Control Software Selection and Deployment:

• We design and implement dedicated scanning kiosk infrastructure at OT zone entry points, with OT-specific threat intelligence feeds and integration with access control systems where applicable. USB Scanning Kiosk Implementation:

• We map your USB security controls to applicable frameworks including NERC CIP, IEC 62443, NIST SP 800-82, and sector-specific standards, ensuring your program satisfies audit requirements while delivering real security value. Regulatory Compliance Alignment:

• We develop and deliver scenario-based training programs tailored to the specific roles and risk profiles of your OT workforce, from control room operators to field technicians and vendor personnel. Workforce Training Programs:

• Shieldworkz provides continuous monitoring of USB-related activity within your OT environment, with threat intelligence updates that keep your detection capabilities current against evolving ICS-targeted malware campaigns. Ongoing Monitoring and Threat Intelligence:

• In the event of a suspected USB-origin incident, our industrial incident response team provides rapid, OT-safe investigation and recovery support, preserving operational continuity while eliminating the threat. Incident Response for USB-Origin Threats:

Conclusion: The Cost of Inaction Is Measured in Operational Downtime

The threat that travels on a USB drive costs nothing to deploy and can cause millions in damage. For industrial organizations, the consequences extend beyond financial loss to operational disruption, safety incidents, regulatory penalties, and reputational harm that takes years to recover from.

A mature USB security program ,built on clear policy, technical enforcement, employee education, and continuous monitoring, closes one of the most commonly exploited entry points in OT cybersecurity. It is not the most glamorous investment in an industrial security portfolio, but it is consistently among the highest-return ones.

The organizations that have suffered the most damaging USB-origin incidents were not necessarily lacking in resources or sophistication. Many had network security investments far exceeding what was spent on removable media controls. The gap between IT-facing security and the operational reality of USB usage on the plant floor was what the attackers exploited.

Addressing that gap is where Shieldworkz focuses, bridging the space between policy and enforcement, between awareness and behavior change, and between theoretical best practices and the operational demands of keeping critical infrastructure running safely.

Book a Free Consultation with Our Experts

Is your OT environment protected against USB-borne threats? Our industrial cybersecurity specialists offer a no-obligation consultation to review your current USB security posture, identify gaps, and outline a practical path to stronger protection, without disrupting your operations.

Additional resources:

IEC 62443-Based OT/ICS Risk Assessment Checklist here
OT / ICS Cybersecurity Operational Security Checklist here
OT/ICS Cybersecurity Policy Template Pack here
Remediation Guides here