Chapter 7 — Removable media and laptops | Technical OT, IoT and cyber-physical security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Removable media and laptops

Lesson map

Lesson 07 published. Map, example, EX025.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 How malware crosses the gap"]
  N2["7.2 A media routine"]
  N3["7.3 Laptops"]
  N4["7.4 Transferring files without USB"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX025"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 How malware crosses the gap"]
  N2["7.2 A media routine"]
  N3["7.3 Laptops"]
  N4["7.4 Transferring files without USB"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX025"]

[Learning outcomes]
    |
    v
[7.1 How malware crosses the gap]
    |
    v
[7.2 A media routine]
    |
    v
[7.3 Laptops]
    |
    v
[7.4 Transferring files without USB]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX025]

Learning outcomes

You will (1) explain how USB drives and laptops carry malware into plants; (2) apply a scanning and logging routine for media; and (3) decide which laptops may connect to the line.

7.1 How malware crosses the gap

Lines without internet links still receive files: firmware updates, recipe files, vendor tools and photos. Each comes on a USB drive or laptop that has been elsewhere. NIST SP 800-82r3 lists removable media as a common path into OT, and well-known incidents spread exactly this way.

At HPFL a vendor arriving with a recipe file on a personal drive is a routine event. The file may be harmless, but the drive has been in other plants and offices. Treat every file entering the line as needing the same routine, however trusted its source.

7.2 A media routine

Use only drives issued by the site. Before any drive reaches a line device, scan it on a dedicated, up-to-date scanning station outside the line, record the drive number, file names, scan result and person in a log, and keep the drive under control until it is used. Unknown drives found on the floor are handed to security, never plugged in "to see whose it is".

At HPFL the scanning station sits outside the line, and site drives are numbered, such as HP-07. The log lets anyone trace a file back to its source if a problem appears later. Check the log during walk-throughs; a drive missing from it is a finding.

7.3 Laptops

Only ENG-LT and approved vendor laptops connect to line equipment. An approved laptop is patched, runs anti-malware, has no personal software and is checked before each visit. A vendor laptop that cannot meet that standard uses a site-owned laptop with the vendor's tools installed instead.

Keep a list of approved laptops in the register with their owner and the date each was last checked. At HPFL ENG-LT is the only site laptop allowed to program the PLCs. A laptop whose last check is older than the visit is checked again before it connects.

7.4 Transferring files without USB

Some sites move files through a controlled transfer server in the DMZ instead of drives. That keeps a record of every file and removes the need to plug media into line devices at all.

At HPFL the DMZ already holds a file transfer server. Files arriving there can be scanned automatically and logged with sender and time, and line devices fetch them through a documented conduit. Removing drives from the routine also removes the risk of a drive being lost on the floor.

Worked example (synthetic HPFL)

A vendor arrives with a recipe file on a personal drive. Tomás takes the drive to the scanning station, copies the file onto site drive HP-07 after a clean scan, logs "HP-07, recipe_v12.csv, clean, Tomás, 09:30", and hands HP-07 to the controls engineer. The personal drive goes back to the vendor unplugged from anything on the line.

Synthetic case — HPFL. The vendor, drive numbers and file are invented.

Errors and limits

A clean scan only means no known malware was found; new malware can pass. Keep the routine anyway: it cuts most risk and gives a record if something goes wrong.

Exercises

EX025 — Found on the floor. A USB stick labelled "Wages 2026" lies by HMI-1. What do you do? Rubric: 3 = do not plug in; hand to security/supervisor; record where found; 2 = hand in only; 1 = check on office PC; 0 = plug into HMI.
EX026 — Media log fields. List four fields in the media log. Rubric: 3 = drive id, files, scan result, person and time; 2 = three; 1 = one; 0 = none.
EX027 — Clean scan meaning. A colleague says "the scan was clean, so the file is safe". Correct the statement. Rubric: 3 = only no known malware found; new threats possible; routine still reduces risk; 2 = partial; 1 = agree; 0 = none.
EX028 — Vendor laptop refusal. The vendor's laptop has no anti-malware. What alternative lets the work proceed? Rubric: 3 = site-owned laptop with vendor tools, or transfer files via scanning station; 2 = reschedule only; 1 = allow anyway; 0 = none.

Synthesis

Every file entering the line passes a scanned, logged, controlled path; unknown media never touch line devices.

Continue studying — chapter 07 of 18

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →