How should security teams protect air-gapped systems when USB drives are regularly moved between secure and internet-connected devices?

Treat removable media as a high-risk bridge between trust zones. Restrict which USB devices can enter the environment, scan media before every connection, disable autorun, and require separate administrative approval for any file transfer. Where possible, use one-way transfer processes, logging, and hardware controls so a compromised drive cannot silently seed malware into an isolated system.

Why USB Moves Are a High-Trust, High-Risk Boundary

Air-gapped systems are only as isolated as the last removable medium that crosses the boundary. USB drives can carry malicious code, hidden partitions, stale files, and legitimate-looking content that becomes dangerous once it is opened on the wrong side. The security problem is not the device alone, but the repeated trust handoff between an internet-connected workstation and a protected enclave.

That handoff should be treated like a controlled transfer process, not a convenience workflow. The biggest failure mode is assumption drift: teams begin to trust a device because it was previously used in a clean environment, even though the same device may have been exposed to malware, tampering, or unauthorized writes since the last scan.

When that trust boundary is weak, the consequences can include silent malware introduction, unauthorized data movement, and loss of confidence in the integrity of the isolated environment. Air gaps reduce exposure, but they do not eliminate it when removable media is still a bridge.

Controls That Reduce Cross-Boundary Exposure

The most effective control set starts with device restriction and inspection. Only approved removable media should be allowed into the secure zone, and every transfer should be preceded by scanning on a separate, trusted staging system. Disable autorun and similar auto-execution behaviors so a drive cannot trigger code just by being inserted.

Use one-way transfer methods where feasible, such as dedicated transfer appliances or controlled import workflows that prevent the secure system from writing back to the same device. That matters because bidirectional use is what turns a transfer medium into a reusable infection path. Logging should record who moved what, when, and under which approval so investigations can reconstruct the chain of custody.

Hardware-enforced controls also matter. Write blockers, sealed kiosks, removable media management, and port control reduce the chance that a drive is silently reused or altered between zones. These controls are strongest when they are combined, because no single safeguard can reliably detect every file-level or firmware-level abuse pattern.

Risk and Threat Considerations

Removable media is attractive to attackers because it bypasses perimeter defenses and exploits the trust humans place in physical objects. A compromised drive can be used as an initial infection vector, a covert exfiltration path, or a persistence mechanism if the secure environment is allowed to reuse media that has already crossed trust boundaries.

Failure mechanism: The drive is infected, modified, or repopulated on the internet-connected side, then reintroduced into the air-gapped side where scanning, execution control, or custody checks are incomplete. Hidden partitions, malicious shortcuts, boot-sector abuse, or file masquerading can let the payload survive superficial review.

Impact: The secure system can be seeded with malware, sensitive files can be copied out without proper control, and incident response becomes harder because the compromise path looks like ordinary user transfer activity. At scale, repeated media reuse creates a standing bridge that defeats the practical value of the air gap.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS Control 10 — Malware Defenses	USB transfer controls must stop malware from entering the enclave.
	CIS Control 8 — Audit Log Management	Logging is central to chain-of-custody and transfer accountability.
	CIS Control 6 — Access Control Management	Only approved media and approved transfer paths should be allowed.
Recommendation — Apply malware defenses to scan removable media before any secure-zone connection. Record removable-media transfers with user, device, time, and approval context. Restrict removable-media access to approved devices and controlled transfer workflows.
NIST CSF 2.0	PR.AC — Access Control	Air-gapped transfer security depends on controlling who can move data across the boundary.
	PR.PT — Protective Technology	Disable autorun and use hardware controls to reduce media-borne execution and write-back risk.
	DE.CM — Security Continuous Monitoring	Monitoring and logging are needed to detect and reconstruct unsafe media use.
Recommendation — Limit cross-boundary transfer privileges to explicitly approved personnel and devices. Use protective technology to block auto-execution and enforce one-way media handling. Monitor removable-media activity and alert on unapproved or anomalous transfers.

Practitioner Guidance

What to prioritise: Focus first on the transfer workflow, not the endpoint alone. If users can bring any USB device into the enclave, or can move data without an approval record, the control design is already too permissive.

What to verify: Confirm that scanning occurs on a system that is separate from both the source endpoint and the protected target, that autorun is disabled, and that the transfer path prevents silent write-back. The control should be auditable, not just documented.

Decision rule: If a file transfer can materially affect the secure environment, route it through a dedicated process with explicit approval and full logging. If the use case cannot tolerate that friction, redesign the workflow rather than weakening the boundary.

Practitioner takeaway: The goal is not to make USB “safe,” but to make every cross-boundary transfer deliberate, inspectable, and hard to reuse as an attack path.