Reduce exfiltration over physical medium by controlling removable media use, enforcing device encryption and logging transfers to USB, optical media and other portable storage. Apply least privilege to copy operations, block unauthorised devices where possible, and alert on large or unusual file writes to removable media.
How physical exfiltration usually gets out
exfiltration over physical medium is usually a control-plane problem as much as a data-loss problem. The risk is not limited to USB sticks: optical media, portable hard drives, SD cards and even device-to-device transfer channels can all move data out of a protected environment if removable-media policy is weak or inconsistent.
The most effective mitigations focus on reducing the number of paths that can write sensitive files to portable storage, while keeping legitimate use visible. That means policy enforcement, device control, encryption, and transfer logging working together rather than relying on user behaviour alone.
A useful way to think about the subject is to treat removable media as a governed egress channel. Data Exfiltration Guide covers the broader detection and prevention patterns around physical medium, alternative exfiltration paths, and the telemetry that helps confirm whether those controls are actually working.
Which mitigations reduce the highest-risk transfer paths?
Start with the controls that directly reduce the chance of silent copying. Block unauthorised removable devices where possible, enforce encryption on approved media, and restrict copy operations to users and systems that genuinely need them. Least privilege matters here because broad write access turns ordinary endpoints into easy staging points for bulk data movement.
Logging is the other half of the control. Transfers to USB, optical media and other portable storage should be recorded with enough detail to support review, including who wrote the data, from which system, and when. Large or unusual write activity is especially important because exfiltration often stands out as an abnormal volume pattern before it stands out as a confirmed incident.
When removable media is unavoidable, use strong device allowlisting, separate trusted from untrusted media classes, and make the approval process auditable. A control that only works in policy but not at the endpoint is usually a gap, not a mitigation.
What should be verified before you trust the control?
Mitigation quality depends on whether the environment can actually prevent or detect the transfer, not just whether a policy exists. Verify that encryption is enforced on approved media, that block rules apply to the full device population, and that transfer events are reaching the monitoring stack in a usable form.
It is also worth checking whether the organisation can distinguish authorised business use from suspicious bulk copying. If logs do not identify the endpoint, user, device type and approximate transfer size, the control may reduce risk in theory but still leave responders blind during an investigation.
CISA cyber threat advisories are a practical reference point when you are aligning local hardening and detection work to current adversary behaviour and defensive guidance, especially where removable media is part of a wider intrusion chain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1020 — Data Exfiltration | Physical media exfiltration is an ATT&CK exfiltration technique with transfer-path controls and detection needs. |
| Recommendation — Monitor removable-media writes and hunt for unusual bulk transfer patterns tied to exfiltration activity. | ||
| CIS Controls v8 | CIS-3 — Data Protection | Restricting and encrypting portable media is a direct data-protection safeguard for this exfiltration path. |
| Recommendation — Encrypt approved portable media and restrict which devices can receive sensitive data. | ||
| NIST SP 800-53 Rev 5 | AC-19 — Access Control for Mobile Devices | Mobile and removable media access controls directly reduce the physical-medium exfiltration path. |
| MP-7 — Media Use | Media-use restrictions and oversight directly govern USB, optical and other portable storage transfer risks. | |
| AU-2 — Event Logging | Transfer logging is necessary to detect and investigate suspicious copying to removable media. | |
| Recommendation — Limit and monitor removable-media use on endpoints that handle sensitive data. Enforce approved-use rules for portable media and block unauthorized device classes. Log media-transfer events with user, device and timestamp context for review and response. | ||
| ISO/IEC 27001:2022 | A.7.10 — Storage media | Storage-media handling and transfer controls directly address removable-media exfiltration risk. |
| Recommendation — Apply handling rules and encryption to approved storage media and restrict unauthorised removal. | ||
Practitioner Guidance
What to prioritise: Prioritise controls that prevent unsanctioned writes first, then add encryption and transfer logging. If the organisation still permits broad removable-media use, detection alone will usually be too late to stop meaningful data loss.
What to verify: Confirm that policy, endpoint enforcement, and audit logging are aligned. The common failure mode is a policy that names USB restrictions while endpoints still allow exceptions, local admin overrides, or unlogged writes.
Decision rule: If the data is sensitive enough that copying it to portable storage would be unacceptable, treat removable-media access as an exception path, not a normal workflow. If business use is required, narrow it to approved devices and documented transfer need.
Practitioner takeaway: The best mitigation is not a single block rule, but a small, tightly governed set of approved transfer paths with encryption, visibility and review built in.