ENDPOINT SECURITY | DATA LOSS PREVENTION

July 10, 202610 min read

USB and Removable Media Security: Enterprise Control Without Blocking the Entire Channel

Sources:Honeywell 2025 USB Threat Report|Verizon 2025 DBIR: Physical Media Vectors|Microsoft Intune Device Control Documentation

Eric Bang

Founder & Cybersecurity Evangelist

52%

of malware affecting industrial control systems and OT environments in 2025 was delivered via USB media — Honeywell 2025 USB Threat Report

65%

of insider threat incidents that involved data theft used removable media as the exfiltration channel in 2025

48%

of employees who found a USB drive in a study plugged it into a computer — unchanged from prior years despite increased security awareness

1 in 3

organizations has experienced a security incident attributed to removable media use in the past 2 years — Ponemon

What USB threats look like in 2026

Understanding current USB threat patterns clarifies which controls are highest priority.

USB drop attacks targeting employees

Attackers leave USB drives branded with logos of trusted organizations (IT department, healthcare provider, conference sponsor) in parking lots, lobbies, and common areas. Drives contain auto-run malware or LNK files that execute when the drive is opened in Explorer. The 48% plug-in rate from Stuxnet-era research remains roughly consistent in modern studies — curiosity and social engineering override security training for a significant percentage of employees.

USB as an air-gap bridge

For air-gapped or offline systems (industrial control systems, classified networks, payment processing isolated environments), USB is often the only data transfer path — making it both necessary and a primary attack vector. Stuxnet demonstrated in 2010 how USB could bridge an air-gapped nuclear facility network; the same technique remains in use in 2026. OT environments and isolated systems need explicit USB protocols regardless of general corporate policy.

Insider exfiltration via removable media

Departing employees, disgruntled insiders, or compromised credentials combined with physical access to a plugged-in system represent the exfiltration vector. A 32GB USB drive holds millions of documents and can be written in minutes on a machine with no DLP enforcement. This threat is distinct from the inbound malware vector and requires a different control (DLP + behavioral monitoring rather than device blocking alone).

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Windows USB device control with Intune and Defender

Microsoft Intune Device Control provides granular USB device management on Windows managed endpoints, controllable by device class, hardware ID, and vendor ID.

Block all removable storage by default

In Intune: Endpoint security > Attack surface reduction > Create policy > Windows 10 and later > Attack Surface Reduction Rules. Set 'Block removable drives' to 'Block'. This prevents execution of content from removable drives but does not prevent the drive from being recognized. For a complete block on data transfer: Device configuration > Settings catalog > search 'Removable disk' > set Read access and Write access to 'Deny'.

Create exceptions for approved devices by hardware ID

Approved devices (IT-issued encrypted USB drives, specific approved peripherals) can be whitelisted by hardware ID. In Intune Device Control Policies (preview feature in 2026): create a policy group with the hardware IDs of approved devices, then create a rule that allows read/write for that group and denies for all others. This requires maintaining an approved device inventory — capture hardware IDs when devices are issued.

Microsoft Defender DLP for removable media

Microsoft Purview DLP can extend to endpoint removable media: create a DLP policy that applies to 'Devices' endpoints and set action for 'Copy to USB removable media' to Audit (log) or Block for policies covering sensitive data categories (PII, financial, confidential). This layer is separate from device control — it governs what data goes to an allowed device, not whether the device is allowed.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

macOS USB device control with Jamf

macOS provides less native granularity on USB device control than Windows. Third-party MDM solutions fill this gap.

Jamf Protect and Jamf Device Compliance

Jamf Pro with Jamf Protect allows USB storage device blocking on macOS endpoints through configuration profiles and extension attributes. Blocking 'External Disk Mode' through the macOS security configuration profile prevents mass storage device mounting. Create a Jamf policy that restricts USB storage class devices while permitting HID (keyboard, mouse) devices.

macOS DLP through endpoint DLP tools

For macOS DLP on removable media, purpose-built endpoint DLP tools (Digital Guardian, Forcepoint, Symantec DLP) provide content-aware blocking for files copied to removable media. These tools inspect file content and apply policy (block, prompt, log) based on data classification. This layer runs on top of device access control.

Unified policy for mixed environments

Enterprises with mixed Windows and macOS fleets need a consistent removable media policy that applies across both platforms. Tools that provide a unified management plane for both (CrowdStrike Falcon Device Control supports both platforms) simplify policy administration and audit — one policy set rather than separate implementations for each OS.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The approved device program

A blanket USB ban creates shadow IT and workarounds that are worse than the original risk. An approved device program channels legitimate use into monitored, controlled devices.

IT-issued encrypted USB drives for legitimate use cases

For use cases that genuinely require removable media (data transfer to air-gapped systems, field technician tools, conference presentations), issue IT-managed encrypted USB drives. Drives encrypted with hardware encryption (IronKey, Kingston IronKey) require a PIN to unlock and encrypt data written to the drive — a lost drive does not expose its contents. Track which employee has which drive by serial number.

No data on vendor or personal drives policy

A policy that prohibits storing company data on personal USB drives is simple and enforceable with DLP: any attempt to write company-classified data to a non-approved device triggers an alert or block. The policy does not need to prohibit all USB use — it prohibits data egress to non-approved media, which is the actual risk.

Regular review of approved device inventory

Approved USB device lists grow over time and are rarely pruned. An annual review of the approved device inventory confirms: which approved devices are still in active use (not lost or in the possession of departed employees), whether any approved devices have been involved in security incidents, and whether newer encrypted device options should replace older approved models.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Detection: behavioral monitoring for USB anomalies

Even with device control and DLP in place, behavioral monitoring provides a detection layer for policy circumvention and insider threat scenarios.

SIEM alert on first USB device registration

Windows generates Event ID 6416 when a new device is first enumerated on a system (new hardware recognized). Alert on: any USB mass storage device recognized on a workstation that is not in your approved device list. This catches both dropped-USB scenarios and employees bringing personal drives to work before they attempt data transfer.

Alert on large data transfers to removable media

A legitimate employee rarely copies hundreds of files or gigabytes of data to a USB drive. Alert on: file copy operations to removable media exceeding 1GB in a session or exceeding 500 files. These thresholds catch bulk exfiltration while not alerting on normal single-file or small-batch transfers.

Pre-departure monitoring for high-volume USB activity

Departing employees represent elevated insider risk for data theft via removable media. During the offboarding window (from notice date to departure date), enable enhanced monitoring for USB-related activity for the departing employee's accounts and assigned workstation. An unusually high volume of file access combined with USB activity in the days before departure is an actionable signal.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

USB device control is a case where the right policy is not the most restrictive policy — it is a program that closes the actual risk vectors (unknown drives, unmonitored data transfer) while enabling legitimate use through approved, encrypted, inventoried devices. A blanket ban drives workarounds; a controlled program creates a defensible perimeter for removable media use that is auditable and enforceable.

Frequently asked questions

What is a USB rubber ducky attack?

A USB Rubber Ducky (Hak5 product) is a device that appears as a standard USB keyboard to a computer's operating system — bypassing USB storage class controls — and automatically types pre-programmed keystrokes at high speed when plugged in. Because it presents as a keyboard, device control policies that block USB storage do not stop it. Defense: physical USB port blockers for sensitive machines, BIOS-level USB port disabling, and policies that require UAC confirmation for actions that require elevated privileges.

Should we block USB entirely in high-security environments?

In high-security or classified environments (government, defense, financial trading), a complete USB block including HID devices (using wireless peripherals instead) and physical port blockers is appropriate. For OT/industrial environments, where USB is the primary data transfer path to air-gapped systems, implement a USB sanitization station: all drives must pass through an isolated scanning system before being permitted on the OT network, rather than blocking the channel entirely.

Does BitLocker To Go satisfy the encrypted removable media requirement?

BitLocker To Go encrypts removable drives using a password or smart card. It satisfies the 'data is encrypted at rest' requirement for compliance frameworks (this prevents a lost drive from exposing data). It does not prevent the drive from being used on non-domain computers — a BitLocker To Go drive can be unlocked on any Windows machine where the user knows the password. For a stricter program, hardware-encrypted drives that require the hardware PIN (not a software password) and cannot be unlocked outside the organization's approved systems provide stronger control.

Sources & references

Honeywell 2025 USB Threat Report
Verizon 2025 DBIR: Physical Media Vectors
Microsoft Intune Device Control Documentation

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Back to all briefings

Subscribe for Updates

USB security enterprise removable media security USB device control DLP removable media endpoint USB policy USB data exfiltration USB malware delivery USB control enterprise 2026

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

USB and Removable Media Security: Enterprise Control Without Blocking the Entire Channel

What USB threats look like in 2026

Windows USB device control with Intune and Defender

macOS USB device control with Jamf

The approved device program

Detection: behavioral monitoring for USB anomalies

The bottom line

Frequently asked questions

What is a USB rubber ducky attack?

Should we block USB entirely in high-security environments?

Does BitLocker To Go satisfy the encrypted removable media requirement?

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway