Topic starter
19/08/2026 3:29 pm
TL;DR: Content-aware USB blocking is presented as a way to stop sensitive data leaving endpoints without disabling removable media entirely, and Strac says Mandiant data cited in the article points to a three-fold rise in infected USB attacks in early 2023. The governance lesson is that endpoint DLP must be policy-driven, not port-driven, if organisations want containment without forcing users around controls.
Editorial analysis by NHI Mgmt Group, based on content published by Strac: “USB Blocking & Content-Aware Device Control (2026 Guide)”.
By the numbers:
- Recent findings from Mandiant revealed a three-fold increase in cyber attacks using infected USB drives as an initial access vector in the first half of 2023.
Key questions
Q: What fails when USB policy blocks ports instead of inspecting file content?
A: Blanket port blocking prevents legitimate work but still leaves organisations blind to what is actually leaving the endpoint.
Q: Why does removable-media control still matter when most exfiltration happens elsewhere?
A: USB remains both an exfiltration path and an initial access vector, so ignoring it leaves a useful route for attackers and insiders.
Q: What are the signs that USB controls are too weak for sensitive data?
A: The clearest sign is when teams can enforce device allow-lists but still cannot stop regulated files from moving to approved media.
Practitioner guidance
- Implement content-based USB policy Classify removable-media rules by file content so regulated data is blocked, warned on, or audited while benign files are still allowed to move.
- Unify endpoint exfiltration controls Apply the same policy logic to USB, browser uploads, cloud sync, email, and AI tool paths so users cannot route around one blocked channel.
- Tune controls to data sensitivity Map high-risk data types such as PII, payment data, and secrets to stricter actions than ordinary files, and log every blocked or warned transfer.
Bottom line: Blanket USB blocking is often too blunt for modern endpoint environments because it disrupts legitimate work while leaving policy gaps around the actual data being copied.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:12 pm
Port control is the wrong abstraction for modern exfiltration risk: security teams do not primarily lose data because USB exists, they lose it because the policy boundary is drawn around the device rather than the content. When a trusted endpoint can still move a spreadsheet with regulated data, the control has already failed at classification time. The right question is whether the policy engine understands what is leaving, not whether the port is open.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams balance USB control with user productivity?
A: Use context-aware policies that distinguish trusted devices, approved business hours, and known locations from higher-risk conditions. That gives teams a way to reduce data leakage risk without treating every removable device or transfer as equally dangerous.
👉 Read our full editorial: Content-aware USB control reduces data loss without breaking work