What is USB Control?
USB Control is the combination of policy, technical restrictions and monitoring that determines which USB devices may be used, when, by whom and on which systems, with the aim of preventing Malware, data leaks and unauthorised access via USB. In OT environments, USB is often still an indispensable channel for Firmware updates, transferring PLC projects, data logging and maintenance by suppliers. That is precisely why it is also one of the most abused routes into an isolated production network.
A USB stick bridges every air gap. If you segment the network carefully but leave USB ports open, you leave the plant’s back door open.
⚠️ Why is USB so risky in OT?
USB was designed for convenience: the operating system trusts a connected device by default and installs a driver automatically. A keyboard, network adapter or storage device is accepted without question. OT adds to this: systems stay in service for many years, are often unpatched, and external technicians work with their own media.
Germany’s BSI lists infiltration of malware via removable media and mobile systems as the first of ten threats in its publication Industrial Control System Security: Top 10 Threats and Countermeasures 2022. Honeywell reported in its USB Threat Report 2022 that 52% of the threats found at industrial sites were specifically designed to use removable media, up from 37% a year earlier. MITRE ATT&CK for ICS gives this attack route its own technique: Replication Through Removable Media (T0847).
| Risk | Example in an industrial context |
|---|---|
| Malware via USB storage | An infected stick compromises an Engineering Station, which then alters PLC logic |
| Unauthorised tools | An engineer runs an unapproved analysis or backup tool from a stick |
| Data leakage | Recipes, process data or network drawings are copied to a private drive |
| Firmware tampering | Manipulated firmware on a stick looks legitimate and is loaded into a field device |
| BadUSB / HID attack | A device poses as a keyboard and types commands within seconds |
| Network bridge | A USB modem or network adapter creates an unseen connection to the outside |
🏭 Which incidents started with USB?
- Stuxnet (discovered in 2010) - spread partly via USB sticks, exploiting a vulnerability in Windows shortcut files (CVE-2010-2568). The worm infected Windows systems running Siemens engineering software and from there altered the logic of PLCs, while the HMI kept showing normal values.
- Agent.btz (2008) - infected networks of the US Department of Defense via a USB stick. The clean-up took months and led to a temporary ban on USB storage.
- Two US power plants (2012) - according to ICS-CERT, an external technician introduced malware into a plant’s turbine control system via his USB drive during a planned outage. Around ten computers were infected and the restart was delayed by about three weeks. At a second plant, malware was found on two engineering workstations, again via USB.
- BadUSB (2014) - researchers from SRLabs showed at Black Hat that the firmware of USB controllers can be reprogrammed. An ordinary stick then behaves like a keyboard or network card, and a virus scanner does not see it.
These examples show that USB risk is not only about files, but also about the type of device that announces itself.
🧠 What falls under USB Control?
USB Control is not a single product but a layered set of measures, in line with Defense in Depth.
| Control measure | Description |
|---|---|
| Port disabling | Disable unused ports physically, via UEFI or via the operating system |
| Device whitelisting | Allow only specific devices based on vendor ID (VID), product ID (PID) and serial number; these values can be spoofed |
| Class restriction | Allow keyboard and mouse, but block storage, network adapters and wireless dongles |
| Read-only mode | Allow reading from media only, blocking writes to prevent data leaks |
| Scanning station | Check media on a separate kiosk before they may enter the OT zone |
| EDR / antivirus | Scan removable media on connection, where the OT system’s vendor supports it |
| SIEM logging | Record every USB use with time, user, device ID and files, and alert on anomalies |
| Security Awareness | Teach staff and suppliers why found or private sticks are off limits |
🔧 How do you implement USB Control technically?
| Method | Application | Point of attention |
|---|---|---|
| UEFI/BIOS setting | Disable USB ports or USB boot in the PC’s firmware | Also blocks keyboard and mouse if you disable every port |
| Windows Group Policy | Device Installation Restrictions by device ID or setup class, and Removable Storage Access (deny read/write) | Also works on older, unconnected Windows systems |
| Disable AutoRun | Prevents code from starting automatically on connection | Off by default for USB sticks since Windows 7; check older systems explicitly |
| Device control in EDR | Access per device, user and action (read, write, execute), including audit | Microsoft Defender device control, for example, does not support servers |
| Application Whitelisting | Only approved programs may run, including from a stick | A strong safety net against unknown malware |
| Encrypted, managed sticks | Company-owned sticks with hardware encryption and registration | Combine with an encryption policy, such as requiring BitLocker for writes |
| Physical locks | Lockable USB plugs, port blockers or removing ports | Cheap and effective on HMIs on the shop floor |
On systems maintained by the vendor you may not always install software freely. Ask beforehand which USB measures and agents the vendor has validated, so you do not lose warranty or support.
🔐 What do IEC 62443 and the law require?
IEC 62443-3-3 covers USB in several system requirements:
- SR 2.3 – Use control for portable and mobile devices - the system must be able to restrict and monitor the use of portable and mobile devices. Requirement enhancement RE 1 requires the security status of such a device to be checked before it is allowed.
- SR 3.2 – Malicious code protection - protection against malicious code, with RE 1 aimed specifically at entry and exit points such as USB.
- SR 7.7 – Least functionality - disable unnecessary functions, ports and services, which ties in with hardening.
NIST SP 800-82 (Rev. 3, September 2023) and ISO 27001:2022 (control 7.10 on storage media) also call for a removable media policy. For Dutch organisations in scope of NIS2, USB Control is part of the duty of care under the Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026. Basic measures such as access control and cyber hygiene must be demonstrable, and a removable media policy is concrete evidence of that.
🧭 How do you set up USB Control step by step?
- Take inventory - which systems have USB ports, what are they used for and by whom? Think of engineering stations, HMIs, SCADA servers and operator panels.
- Establish the real need - usually only a few workflows are needed: loading firmware, making PLC backups, exporting process data.
- Block by default - disable storage classes and allow only keyboard and mouse per system. Physically close unused ports.
- Create a controlled route - a scanning station at the entrance to the OT zone, preferably with several antivirus engines and a different operating system from the maintenance devices, as BSI recommends.
- Use company sticks only - numbered, encrypted and reserved for the OT environment. Private or supplier media never go directly into an OT system.
- Verify firmware before use - compare the hash with the one on the vendor’s portal and check the code signature.
- Log and monitor - send USB events to the SIEM and alert on unknown devices.
- Arrange third parties - record USB agreements in contracts and in your third-party risk management, and route remote maintenance through a jump server instead of media.
🔄 How does USB Control relate to operational needs?
| What OT needs | What security requires | Safe alternative |
|---|---|---|
| Quickly loading a PLC project | Only via approved, scanned media with registration | Project files via managed file transfer in the DMZ |
| Updating firmware on site | Only after hash verification and Code Signing checks | Central storage of verified firmware |
| Exporting process data | Encrypted media with logging, never back into OT | One-way export via a data diode |
| Supplier wants to run diagnostics | No own stick or laptop directly on the network | Supervised session via jump server |
A strict ban without a workable alternative leads to workarounds. Every prohibition therefore needs a safe route that is as easy as a stick.
❓ Frequently asked questions
Is disabling all USB ports enough?
Disabling all USB ports is effective but rarely practical, because keyboards, mice and sometimes licence dongles also use USB. USB Control therefore works better with class restrictions and device whitelisting, supplemented by physical locks on unused ports. That keeps the system usable without giving storage devices access.
What is a BadUSB attack?
A BadUSB attack uses a USB device whose controller firmware has been modified so that it poses as, for example, a keyboard and types commands automatically. Antivirus does not detect this, because no file is opened. Protection requires USB Control that blocks new keyboards and network adapters or makes them wait for approval, plus physical port locks. Do not rely on VID/PID alone, because a manipulated device can spoof those values.
What is a USB scanning station?
A USB scanning station, also called a kiosk or media sluice, is a separate computer on which removable media are scanned before they may be used in the OT environment. Good scanning stations use several antivirus engines and record which files have been approved. The station sits outside the control zone and is itself well hardened.
May a supplier use their own USB stick on an OT system?
A supplier should not plug their own USB stick directly into an OT system. Files first pass through the scanning station onto a company stick, or through managed file transfer. The 2012 incident at a US power plant started precisely with an external technician’s infected stick.
Is USB Control mandatory under NIS2?
NIS2 and the Dutch Cybersecurity Act do not mention USB literally, but they require appropriate measures for access control, cyber hygiene and system security, among other things. For organisations with OT, a removable media policy is a logical and demonstrable way to meet that requirement. Standards such as IEC 62443-3-3 make it concrete with SR 2.3 and SR 3.2.
Does application whitelisting help against USB malware?
Application whitelisting prevents unknown programs from running, even if they come from a USB stick. It is therefore a strong complement to USB Control, but it does not stop data leaks or BadUSB keyboard attacks. Combining both measures gives the best protection.
📌 In summary
USB Control determines which USB devices are allowed on OT systems, blocks the rest and records every use, so a stick does not become an unnoticed route around the air gap. Combine class restrictions, device whitelisting, physical locks, a scanning station and logging with clear agreements for staff and suppliers, and always offer a safe alternative to the USB stick.