Treat removable media as a high-risk bridge between trust zones. Restrict which USB devices can enter the environment, scan media before every connection, disable autorun, and require separate administrative approval for any file transfer. Where possible, use one-way transfer processes, logging, and hardware controls so a compromised drive cannot silently seed malware into an isolated system.
Why removable media is a boundary problem, not just a convenience problem
USB transfer creates a bridge between two trust zones that otherwise should not share execution, autorun behavior, or hidden metadata. The main failure mode is not only file copying, but the drive carrying code, device emulation, or tampered content from an internet-connected endpoint into an isolated one. A policy that treats every transfer as potentially hostile keeps the air gap meaningful.
That is why Removable Media and USB Control Guide is the most direct operating model for this problem: the control objective is to decide which media may enter, what may be copied, and how the transfer is verified before the target system trusts it.
How to reduce the chance that a USB drive becomes a malware bridge
The highest-value control is to shrink the set of devices and actions that are even possible. Allowlisting known USB hardware, blocking unknown peripherals, and disabling autorun remove the easiest infection paths. Scanning is useful only when it happens before connection, not after the file has already reached a protected endpoint. Hardware write-blocking and one-way transfer methods further reduce the chance of silent modification or backflow.
For teams that also need to understand the attack mechanics behind bad USBs and device-emulation abuse, USB Drop Attacks Guide covers the threat patterns that make removable media so effective as an intrusion vector.
Where transfers are routine, separate the roles that request, approve, and execute the move. That makes it harder for a single compromised workstation, operator account, or drive to create an unreviewed path into the secure enclave.
What to verify before you trust a transfer into an air-gapped environment
An air-gapped workflow still needs evidence, because the gap only helps if the process around it is observable. Teams should be able to show which device was used, who approved the transfer, what scan was performed, and whether the media was quarantined, reimaged, or destroyed after use. If any of those steps are informal, the transfer process is already a control gap.
This is also where device trust matters. Even when the main subject is removable media, the endpoint that prepares or reviews the drive should itself be controlled and trusted, which is why a broader device trust model such as Device and IoT Identity Guide helps teams think about attestation, lifecycle, and what “known good” really means.
For higher-assurance environments, separate clean staging stations, dedicated scanning hosts, and a documented chain of custody. If the same laptop is used to browse the internet and to prepare media for the secure zone, the workflow is undermined even if the network itself remains isolated.
Risk and Threat Considerations
Removable media is attractive to attackers because it bypasses many perimeter controls and can move code, scripts, or device-like behavior across an otherwise isolated boundary. The risk is greatest when users treat the drive as trusted just because it is physically present or has been used in a previous approved transfer.
Failure mechanism: A compromised or malicious drive can deliver malware, a fake peripheral profile, or manipulated files into the secure zone, especially if autorun, previewing, or unsupervised copying is allowed.
Impact: The result can be silent compromise of an isolated endpoint, credential theft from offline assets, tampering with sensitive data, or a staged path for later persistence and spread.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-10 — Malware Defenses | USB scanning, autorun blocking, and media screening are malware-defense controls. |
| Recommendation — Harden removable media with malware scanning and executable blocking before it reaches secure hosts. | ||
| NIST SP 800-53 Rev 5 | SI-3 — Malicious Code Protection | The question centers on stopping malware carried on removable media into isolated systems. |
| AC-19 — Access Control for Mobile Devices | USB media are mobile devices that need strict boundary controls and usage limits. | |
| Recommendation — Deploy malicious code protection on staging and target systems before permitting file transfer. Restrict removable media use to approved devices and enforce boundary conditions before transfer. | ||
| ISO/IEC 27001:2022 | A.8.12 — Data leakage prevention | The scenario is about preventing data and malware movement across trust boundaries via USB. |
| Recommendation — Apply leakage-prevention controls to removable media workflows and approved transfer paths. | ||
| OWASP ASVS | V13 — Configuration | Disabling autorun and limiting device behavior are configuration hardening steps. |
| Recommendation — Lock down endpoint configuration so removable media cannot auto-execute or bypass review. | ||
Practitioner Guidance
What to prioritize: Start with device allowlisting, autorun suppression, and pre-connection scanning, because those controls remove the most common low-effort paths first. If the environment cannot support all three, treat any remaining transfer as an exception, not normal operations.
What to verify: Confirm that the scanning host is clean, the media is newly inspected before each use, and the transfer path is one-way wherever the use case permits. If you cannot prove the provenance of the drive and the workstation that handled it, do not assume the file set is safe.
Practitioner takeaway: The key decision is not whether USB can be used, but whether every transfer is made observable, bounded, and revocable enough that a single drive cannot silently become a bridge into the protected zone.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org