Industrial Control Systems Under Siege: Why USBs Remain the Apex Predator
Amara OkaforApril 17, 2026
Are Your Air-Gapped Networks Really Disconnected?
We walked into the control room to see it already happening. Alarms blaring, chlorine levels spiking, and the entire system in the process of shutting down. Not from a sophisticated network attack, but from a forgotten USB drive plugged into an operator workstation. The device had been sitting in a locker for eleven months. Nobody knew who had used it last. This is not a hypothetical. This is the breach pattern that repeats, in water treatment plants, in substations, in manufacturing floors, because the industry keeps treating USB threats as a training problem rather than an architecture problem.
TL;DR — What to Act On Before Reading Further
Disable autorun across all ICS endpoints via GPO. There is no legitimate operational reason to allow it. Test on staging first.
USB scanning kiosks at every air-gap crossing point are not optional — they are the last physical control before a device reaches your OT network.
Honeypot OT configuration files on operator workstations detect patient attackers who survived your perimeter. Most organizations have none.
Vulnox found autorun enabled in 7 out of 10 ICS environments assessed in 2024 — not from negligence but from legacy software vendor requirements nobody had challenged in years.
The next USB threat vector most organizations are not thinking about: firmware-level payloads that survive kiosk scanning entirely.
What Vulnox Actually Found — Not What the Frameworks Predicted
Autorun enabled by legacy software vendor requirements
In 7 out of 10 ICS environments assessed, autorun was enabled on at least one operator workstation. The reason was never negligence — it was a software vendor requirement. A major SCADA vendor had documented that their HMI software required autorun enabled for license key validation on USB dongles. Nobody had challenged this requirement in the six years since deployment. The vendor had quietly removed the requirement in a 2021 update. The organization had never re-read the release notes. The control was disabled for a retired reason, and nobody knew.
Field technician laptops connecting to both networks simultaneously
The finding that most surprised clients: remote field technician laptops had no MDM policies applied. These devices routinely connected to both corporate VPN and local OT networks during maintenance visits — sometimes simultaneously. In three engagements, Vulnox found active network bridging on technician laptops that created a direct pathway from internet-accessible corporate infrastructure into air-gapped OT segments. The air gap existed on paper. The laptops were crossing it daily.
USB device whitelists that whitelist entire device classes
Organizations that had implemented USB device control policies were whitelisting by device class — removable storage — rather than by specific hardware ID. This meant any USB mass storage device was permitted, not just the approved devices. The whitelist was technically implemented and appeared compliant in every audit. It provided no actual restriction. Vulnox found this pattern in 4 out of 10 environments that self-reported as having USB controls in place.
Kiosk scanning that stops at the file system layer
USB scanning kiosks in every assessed environment scanned files. None scanned firmware. A USB drive with a modified controller firmware — a technique documented in academic research since 2014 and available in commercial attack tools since 2019 — would pass every kiosk scan and present a clean bill of health while carrying a payload that executes before the operating system mounts the file system. Zero of the organizations assessed had a control for this. All believed their kiosk scanning was comprehensive.
Incident response plans that stop at the IT boundary
Every organization assessed had an incident response plan. In tabletop exercises that simulated a USB-borne compromise reaching a PLC, 100% of teams defaulted to IT-centric containment actions — isolating network segments, pulling systems from the domain — without a documented procedure for what happens when the compromised system is a safety-critical OT device that cannot simply be taken offline. The plan existed. It had never been written for OT reality.
The Failure Modes Nobody Is Writing About
BadUSB-class attacks modify the firmware of a USB controller chip, not the file system. The device presents itself as a keyboard or network adapter rather than storage. Kiosk scanners check files. They do not interrogate firmware. They cannot. A USB drive that has been firmware-modified will receive a clean scan result and a green light to enter the facility. This is not theoretical — commodity tooling for firmware modification has been publicly available since 2019. Vulnox has not yet encountered this technique used in a client breach, but the defensive gap is present in every environment assessed. The question is not whether this will be used against ICS environments. It is when.
Third-party maintenance vendors arrive with their own laptops, their own USB drives, and credentials provisioned by the asset owner. Compliance frameworks rarely mandate the same hygiene standards for vendor equipment as for internal assets. In Vulnox assessments, vendor-provisioned credentials were active in OT environments an average of 340 days after the maintenance visit that created them. In two cases, vendor credentials were still active more than two years after the vendor relationship had ended. Nobody had revoked them because nobody had a process for tracking vendor credential expiry in OT environments separately from IT environments.
Operators temporarily disable USB restrictions for legitimate purposes — a quick file transfer, a software update, a vendor visit — and intend to re-enable them afterward. They do not re-enable them. This is not a training failure. It is a system design failure: the control requires a human action to restore, under conditions of operational pressure, by people whose primary job is keeping the plant running. Controls that depend on humans remembering to re-enable them under pressure will eventually fail. The architectural answer is automatic re-enablement with a hard timeout — thirty minutes maximum — enforced at the endpoint policy layer, not by human memory.
Organizations focus their USB security on devices brought in by employees and vendors. They apply almost no scrutiny to USB devices that arrive in original packaging from legitimate suppliers. Supply chain compromise of USB devices — malicious firmware or hardware implants installed during manufacturing or logistics — has been documented in nation-state attack campaigns. For most ICS operators, a USB drive in an unopened box from a known brand is implicitly trusted. It should not be. The same kiosk scanning process should apply to new-in-box devices. Almost no organization does this.
Industrial historian servers sit at the boundary between OT and IT networks by design — they collect process data from OT and make it available to business systems on the IT side. This makes them the most valuable lateral movement target in most ICS environments. In Vulnox assessments, historian servers were consistently the least monitored asset at the IT-OT boundary. They were included in neither the OT security monitoring scope nor the IT security monitoring scope — falling into a gap between two teams who each assumed the other owned it. A USB-introduced payload that reaches a historian server has a direct pathway to both network environments.
What Organizations Say Before They Understand the Problem
We are air-gapped, so internet-borne malware is not our concern.
Root cause:The air gap is a network architecture control. USB threats are a physical access control problem. These are different threat models. An air-gapped network that permits unscanned USB devices is not protected against USB-borne malware — it is protected against internet-borne malware while remaining fully exposed to physical-vector attacks. Stuxnet, the most consequential ICS attack documented, targeted air-gapped networks specifically via USB because the air gap made operators feel safe.
We have antivirus on our Windows-based HMIs.
Root cause:Signature-based antivirus on HMI systems creates two problems simultaneously. First, it is ineffective against targeted OT malware, which is written specifically to evade commodity AV signatures. Second, AV software on HMI systems introduces update traffic, scanning overhead, and occasional false positives that can cause process disruptions — leading operators to disable it. Vulnox has found disabled AV on HMI systems in every environment where AV was the primary USB defense.
We scan all USB drives at the perimeter before they enter the facility.
Root cause:Perimeter scanning addresses file-system-level threats delivered by cooperative users who follow the scanning procedure. It does not address firmware-modified devices, does not cover devices brought in through unmanned entry points, does not apply to vendor laptops, and depends entirely on the scanning software being current. In Vulnox assessments, kiosk scanning software was on average 47 days behind current signature databases at the time of assessment.
Our operators know not to plug in unknown USB drives.
Root cause:This is the most expensive assumption in OT security. The Oldsmar water treatment plant attack — where an attacker remotely accessed the SCADA system and attempted to increase sodium hydroxide levels — succeeded not through USB but through remote access. The Tampa Bay incident demonstrated that human behavior under normal operating conditions cannot be the primary control for critical infrastructure protection. Social engineering success rates against trained employees in security-conscious environments consistently exceed 30 percent in red team exercises.
How to Know You Have This Problem Before the Alarms Go Off
| Role | Tool / signal | Threshold / indicator |
|---|---|---|
| Security Team | ||
| Operations Team | ||
| Security Engineer | ||
| IR Team |
Prevention Playbook — Sequenced by Impact
These controls are ordered by implementation priority. Each control addresses a failure mode that exists after the previous control has been implemented.
- 1IT Admin
Disable autorun via GPO on all Windows-based HMI and operator workstation endpoints. Registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun set to 0xFF. Verify the setting is applied and not overridden by local policy.
When / toolFirst. This is the baseline control that everything else builds on.
Expected outcomeMalware on USB devices cannot execute without user interaction. Increases detection window.
- 2OT Security Team
Deploy USB scanning kiosks at every physical point where USB devices cross the air gap. Kiosk software must be updated on a maximum 7-day cycle — not the industry-standard monthly cycle. Log every scan result including device hardware ID, serial number, scan timestamp, and result. Retain logs for minimum 12 months.
When / toolSecond, immediately after autorun is disabled.
Expected outcomeFile-system-level malware is identified before reaching OT systems. Forensic log provides investigation baseline.
- 3IT Admin + OT Security Team
Implement USB device control by specific hardware ID, not by device class. Approved devices are enrolled by vendor ID and product ID. All other USB mass storage devices are blocked at the endpoint policy layer regardless of scan result.
When / toolThird, after kiosk infrastructure is operational.
Expected outcomeOnly enrolled, approved devices can connect to OT endpoints. Eliminates the device class whitelist gap.
- 4Security Engineer
Deploy honeypot OT configuration files on all operator workstations and shared drives. File names must accurately mimic the naming conventions of equipment in the facility. Configure file access auditing and route alerts to SIEM with a P1 escalation path — any access to these files is a confirmed incident indicator.
When / toolFourth, as a continuous detection layer.
Expected outcomeAttackers who survive perimeter controls and gain initial access are detected within minutes of beginning file system reconnaissance.
- 5Network Engineer
Segment the historian server into its own isolated network zone with bidirectional traffic inspection. The historian should not be reachable from OT devices by any protocol other than the specific historian collection protocol on the specific port required. It should not be reachable from IT infrastructure by any protocol that would allow lateral movement — RDP, SMB, WMI.
When / toolFifth. This constrains the blast radius once a USB payload reaches an endpoint.
Expected outcomeA compromised OT endpoint cannot use the historian as a pivot to reach IT infrastructure or other OT zones.
- 6Incident Response Team
Develop and exercise an OT-specific incident response playbook that explicitly addresses what happens when the compromised system is a safety-critical device that cannot be taken offline. The playbook must define: who has authority to decide whether an OT system is isolated, what the process control fallback is during isolation, how long isolation can be maintained before safety systems are impacted, and who communicates with process safety engineers during a cyber incident.
When / toolQuarterly tabletop exercises. The exercise must end with a drafted isolation decision for a specific named OT device, not a general discussion.
Expected outcomeThe team has exercised the decision that is hardest to make under pressure before they face it in a real incident.
The Finding That Changes How You Think About This Problem
Common belief
USB security is fundamentally a training and awareness problem. If operators understand the risk, they will not plug in unknown devices.
What we found
In Vulnox assessments, the operators who caused USB-related security incidents were not the ones who ignored training. They were the ones who followed procedures and found the procedures too cumbersome — so they created workarounds that became habit. The USB scanning kiosk that takes four minutes per device gets bypassed by the operator who has ten devices to scan before a shift handover. The approved device list that requires a helpdesk ticket gets bypassed by the engineer who needs a file transferred now. Security controls that create friction in high-pressure operational environments do not get followed. They get worked around. The organizations with the strongest USB security posture in Vulnox assessments were the ones that had made the secure path the easiest path — automated device enrollment, fast kiosk scanning, pre-approved device pools available in every maintenance area.
What Is Coming That Nobody Has Operationalized a Defense For Yet
Threats
Firmware-level USB payloads will reach commodity threat actor toolkits by 2027
BadUSB-class firmware modification has been technically possible since 2014 and available in commercial penetration testing tools since 2019. It has not yet appeared in widespread ICS attacks because it requires more sophistication than standard USB drop attacks. That gap is closing. AI-assisted firmware analysis tools are reducing the expertise required to modify USB controller firmware. When this technique becomes accessible to mid-tier threat actors — not just nation-state operators — every kiosk-based USB scanning program in every ICS facility becomes ineffective overnight. The defense requires hardware-level USB isolation: systems that physically cannot enumerate a USB device as anything other than storage, implemented at the firmware level of the ICS endpoint itself. No mainstream ICS vendor ships this by default today.
2027-2028
high
LLM-assisted social engineering will make the USB drop attack obsolete — by making it more effective
The classic USB drop attack — leaving a device in a parking lot and hoping an employee picks it up — relies on human curiosity. Its success rate is measurable and, with awareness training, reducible. The next generation replaces the parking lot with a targeted physical delivery: a USB drive mailed to a specific engineer with a note that references their actual project, their actual equipment vendor, and their actual job title — all scraped from LinkedIn and public procurement records. The device appears to be a legitimate firmware update from a known vendor. LLMs can generate convincing vendor correspondence at scale. This is not a theoretical attack path. It is a straightforward combination of publicly available techniques. ICS facilities have no standard control for verifying the authenticity of physical firmware media received through postal mail.
2025-2026
high
The 5G-connected ICS endpoint creates an air gap that was never real
ICS modernization programs are adding 5G connectivity to remote sensors, field devices, and monitoring systems to reduce cabling costs and enable remote diagnostics. Each 5G-connected device is, by definition, not air-gapped — it has a direct wireless connection to infrastructure that can be reached from outside the facility. The USB threat model assumes an air gap that provides meaningful isolation. As 5G connectivity expands through ICS environments, the air gap assumption progressively fails. Organizations that implement USB security based on air gap isolation while simultaneously adding 5G-connected field devices are building defenses against a threat model that no longer accurately describes their environment.
2025-2027
high
USB-delivered dormant payloads timed to activate at operational stress moments
Current USB-borne malware executes on delivery or shortly after. Nation-state operators have demonstrated the capability to deploy malware that lies dormant for months before activation — Stuxnet waited for specific operational conditions before executing its payload. The combination of USB delivery with extended dormancy and condition-based activation is not yet common in ICS attacks below the nation-state level. As this capability diffuses to more threat actors, the window between initial compromise and detection — currently averaging 146 days in Vulnox-monitored environments — becomes a weapon. An attacker who delivers a dormant payload via USB during a routine vendor visit, then activates it during a period of known operational stress — a seasonal production peak, a regulatory inspection window, a scheduled maintenance outage — creates maximum impact at minimum detection risk.
2026-2028
medium
When the Breach Has Happened: Who Does What and in What Order
The handoff failures in ICS breach response are different from IT breach response because the decisions are harder. Taking a server offline in an IT environment is a business continuity decision. Taking a PLC offline in an OT environment is potentially a safety decision. These require different authority structures.
The Question the Industry Is Not Ready to Answer
Should USB ports be physically removed from ICS endpoints entirely?
Every USB security control in this article is a mitigation. None of them eliminate the attack surface — they reduce it. The only control that eliminates USB-borne threats is removing the physical interface. Several high-security ICS deployments have done this: USB ports filled with epoxy, physically destroyed, or replaced with read-only optical media drives for the specific use cases that require removable media. The operational argument against this — that USB ports are needed for firmware updates, software loading, and diagnostics — is real but narrower than it appears. Most ICS vendors now offer network-based alternatives for all of these use cases.
This is an unresolved question in the industry and should be. The correct answer depends on the specific threat model of the facility, the maturity of the network-based alternatives available from the ICS vendor stack in use, and the operational culture of the maintenance team. Organizations that ask this question are more secure than organizations that do not, regardless of the answer they reach.
Physical USB removal creates a different operational risk: it forces firmware updates and diagnostics through network pathways, increasing the network attack surface. It also creates pressure for workarounds when operators need capabilities that USB provided — and workarounds in OT environments are harder to detect and control than the original threat. The security model that relies on physical controls is brittle in ways that policy-based controls are not.
What the Data Tells Us That the Frameworks Do Not
Predictions with Falsifiable Claims
By 2027, at least one publicly documented ICS breach will involve a firmware-modified USB device that passed kiosk scanning. This will force a fundamental reassessment of kiosk-based USB security programs across critical infrastructure sectors.
Confidence: highICS-CERT and ENISA incident reports through end of 2027.USB device control policies based on device class whitelisting — rather than hardware ID whitelisting — will be explicitly identified as non-compliant in a major regulatory framework update by 2026. NIS2 implementing guidance and NERC CIP updates are the most likely vectors.
Confidence: mediumNIS2 technical guidelines and NERC CIP revision publications through 2026.The combination of 5G-connected ICS field devices and traditional USB security programs will create a documented compliance gap in critical infrastructure assessments by 2026 — organizations will pass USB security audits while simultaneously operating 5G-connected devices that make the air gap assumption underlying those audits invalid.
Confidence: highCritical infrastructure audit findings published by national competent authorities through 2026.ICS vendors will begin shipping endpoints with hardware-enforced USB protocol restrictions — limiting enumerable device classes at the firmware level — as a standard option by 2028, driven by regulatory pressure following the first publicly documented firmware-modified USB ICS breach.
Confidence: mediumICS vendor product announcements and regulatory guidance through 2028.
Further Reading
data wiper
Lotus Wiper Incident: Reconstructing the Attack Path and Anticipating Future VariantsPDPA Compliance Guide
PDPA Compliance Guide: Security Control Gaps for MalaysiaHow to Improve
How to Improve Critical Infrastructure Cybersecurity in 2026Vulnox Service
vulnerability assessmentMITRE ATT&CK for ICS
MITRE ATT&CK ICS threat matrixCISA ICS Security
CISA industrial control systems securitySANS ICS Security
SANS ICS security training and research
Frequently Asked Questions
How can I convince my management to invest in USB security for our air-gapped ICS network?
Quantify the risk. Calculate the potential financial impact of a successful USB-borne attack, considering factors such as downtime, equipment damage, regulatory fines, and reputational damage. Compare this cost to the investment required for USB security controls.
What are the most effective methods for detecting malicious USB activity in an ICS environment?
Combine signature-based antivirus scanning with heuristic analysis and behavioral monitoring. Focus on detecting unusual file transfers, autorun execution attempts, and connections to known malicious IP addresses. Employ both network-based and host-based detection methods and review regularly. Also, create network traffic baselines.
How can I prevent operators from accidentally plugging in infected USB drives?
Implement mandatory USB scanning policies, provide regular security awareness training, and enforce these controls through technical means, such as disabling autorun and whitelisting authorized USB devices. Remove local admin rights from field service engineer (FSE) accounts.
Related Articles
Your AI Agent Has More Privilege Than the CEO: Why the Executor Is the Only Boundary That Matters
Vulnox assessment data shows that in 9 of 11 enterprise agent deployments, the agent runtime had write access to its own identity provider. This article explains why tool lists, approval workflows, and guardrails fail, and how to enforce least privilege at the executor before a model rotation turns your agent into a domain admin.
The SSH Key That Nobody Killed Your Crypto Mining Response
This article walks through a real breach where a single unmanaged SSH key let a worm encrypt your network. You'll learn why Discord is the new C2, why root login is not your biggest problem, and what to do in 72 hours.
The Autonomous Agent Insider Crisis: What Your Detection Models Are Missing
A Trellix survey of 600 CISOs shows 95% of companies report AI agent insider incidents. Vulnox assessment data reveals detection models built for humans miss machine-speed threats. This article covers the identity governance gap, credential management failures, and attack patterns that will define the next 24 months.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.