ExamWizardzExamWizardz
Start free
Security

What is removable media?

Removable media are storage devices that plug in and out, such as USB drives and SD cards; as a threat vector they carry malware in and data out.

What is removable media?

Removable media are storage devices that connect to a computer and leave with their owner: USB flash drives, external hard drives and SSDs, SD and microSD cards, optical discs, and phones or cameras that mount as drives. In security, the term also names a threat vector that bypasses the network entirely. A drive carried into the building and plugged into a workstation never passes the firewall, the email gateway or the web proxy, so it can bring malware in, and carry data out, without touching any of them.

How removable media is used in attacks

  • Dropped drives: an attacker leaves labeled USB sticks in a parking lot or lobby and waits for curiosity to do the rest. In a 2016 study, researchers dropped 297 flash drives around a university campus, and files were opened on at least 45 percent of them.
  • Infected files: a document with a malicious macro, a shortcut file or an executable disguised as a PDF waits for the user to open it.
  • Keystroke injection: a device that looks like a flash drive registers as a keyboard and types commands, the method of tools like the USB Rubber Ducky. The BadUSB research presented in 2014 showed that the firmware on ordinary USB controllers can be rewritten to behave the same way.
  • Crossing an air gap: Stuxnet, discovered in 2010, spread through USB drives and is widely believed to have reached the isolated control systems at Iran's Natanz enrichment plant that way.

The same ports work in the other direction. An insider, or simply a careless employee, can copy a database export to a thumb drive in seconds, and a lost unencrypted drive is a data breach in its own right.

Controls for removable media

  • Device control: endpoint or Group Policy settings that block removable storage, make it read-only, or allow only approved devices by vendor, product and serial number.
  • Endpoint DLP: an agent that blocks or logs copies of sensitive files to USB, even when the laptop is off the corporate network.
  • Encryption: issue encrypted company drives, for example protected with BitLocker To Go, so a lost drive exposes nothing.
  • No automatic execution: current Windows versions don't launch programs from USB flash drives on insertion, and policy should keep AutoRun off; scan media when it is connected.
  • Physical measures: port blockers on kiosks and sensitive systems, and a dedicated scanning station for media entering an air-gapped network.
  • Training: use only issued devices and hand found ones to IT unopened.

Disabling AutoRun and scanning files do nothing against a keystroke-injection device, because the computer sees a keyboard rather than a drive. Device control that allows only approved USB devices, keyboards included, is the technical answer there.

Removable media vs. related vectors

  • Supply chain: hardware or software compromised before it reaches you; a drive left in the parking lot is removable media.
  • Malicious cables and charging ports: a related physical USB risk; the public charging version is often called juice jacking.
  • Network exfiltration: data leaving through uploads or email, which network DLP can see. Copies to USB never cross the network and need endpoint controls.

Removable media on the CompTIA Security+ exam

SY0-801 objective 2.3 lists external media, with malicious USB devices as the example, among threat vectors. The controls come back under objective 4.1, where endpoint DLP blocks copies to USB, and objective 5.6, where awareness training covers found drives. A scenario about a USB drive found in the parking lot points to removable media as the vector and to device control plus training as the fix. A device that types commands like a keyboard is an HID attack that defeats AutoRun settings. Sensitive files copied to a thumb drive on a laptop that is mostly off-site point to endpoint DLP, not network DLP.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

air gap

An air gap is the physical isolation of a system or network from all other networks, including the internet, so data crosses only when carried by hand.

DLP

Data loss prevention (DLP) refers to a set of tools and strategies designed to prevent sensitive or critical information from being lost, misused, or accessed by unauthorized parties.

Group Policy

Group Policy is a set of rules and configurations that administrators can define and apply to user accounts and computer systems within an Active Directory (AD) domain to centrally manage and secure the computing environment.

Human Interface Devices (HID)

Human Interface Devices (HID) are a class of computer peripherals that allow users to interact directly with a computer or electronic system, typically using a standardized USB device protocol. Common examples include keyboards, mice, game controllers, and touchscreens.

threat vector

A threat vector, also called an attack vector, is the path or method an attacker uses to reach a target, such as email, an open port or a USB drive.

USB flash drive

A USB flash drive is a small removable storage device that stores data on NAND flash memory and plugs into a USB port. It is also called a thumb drive.

← Back to the full CompTIA glossary