Endpoints
Removable Media Control
Prevent uncontrolled media from crossing into OT and detect it when it does.
Defensive guide
Why should I care?
Media crosses boundaries that no network control can see.
How to implement it
- Technical enforcement (device control policy)
- Sanitisation kiosk for necessary transfers
- Approved, tracked media for engineering use
What good looks like
- Media use tied to work orders
- Insertion events logged and reviewed
Common failure modes
- Policy without enforcement
- Vendor media used directly on production hosts
How to verify it
- Attempt an unapproved USB insertion on a test host
- Review recent insertion events