A colleague hands you a USB stick before a meeting. A supplier brings an update on an external drive. Someone needs to move a large video file without waiting for an upload. None of these moments feels particularly risky. They are ordinary shortcuts that help people get things done.

Yet a familiar connector is not a security guarantee. Removable storage can carry unwanted files between computers, including machines deliberately kept away from the internet. The useful question is not whether USB drives are outdated. It is whether the files arriving on them receive the same scrutiny as information arriving online.

Offline Does Not Mean Harmless

An internet connection is not required for every stage of a malware infection. A drive can carry malicious content from one machine to another, creating a route around controls that inspect network traffic. Disconnecting a system from the internet therefore does not remove the need to manage physical file transfers.

The National Cyber Security Centre highlights this issue in its guidance for operational technology, including equipment used to manage industrial processes. Where removable media remains necessary, it recommends approved devices and external scanning before and after use. The principle is straightforward: check what crosses the boundary, rather than assuming the boundary makes everything inside safe.

For organisations reviewing , this means looking beyond the USB socket. Who supplied the drive? Where has it been used? Which files are needed? Who decides whether those files can enter the next system? Clear answers matter more than a reassuring label on the casing.

Encryption And Malware Scanning Do Different Jobs

An encrypted USB drive can help protect stored information when the device is lost or stolen. That is valuable, particularly when someone carries sensitive business documents between locations. However, encryption controls access to data. It does not assess whether an authorised user is about to open a malicious file.

Malware scanning addresses a different problem by examining content for signs of threats. The two protections should complement each other, not compete. A sensible transfer process considers confidentiality, the trustworthiness of the source and the checks applied before anything is opened.

There is another distinction worth remembering. Some hostile USB devices can imitate peripherals such as keyboards, rather than behaving only as storage. Checking visible files is not equivalent to checking every possible behaviour of the device. This is another reason not to connect an unknown drive simply to investigate it.

Start With Rules People Can Follow

The practical starting point is an approved way to share files. Where a managed online service is suitable, use it instead of passing storage devices around. Where physical media is necessary, provide approved drives and explain when staff must ask the IT team for help.

Keep personal and business storage separate. Treat unexpected devices, including those left in public places or received without explanation, as untrusted. A familiar company logo is not proof of origin. Staff should know where to report a suspicious device without being expected to plug it in first.

For approved media on managed Windows computers, Microsoft documents how to scan specific files and folders with Microsoft Defender. Follow the organisation’s procedure and keep protection updated. Do not disable security controls or bypass warnings to finish a transfer. A scan result is useful evidence, not a permanent certificate of safety.

Put The Checkpoint Before The Sensitive Computer

For a business that regularly receives files from contractors or moves data into isolated systems, relying on each employee to remember a scan may leave gaps. A dedicated checking point can make the process consistent and keep initial inspection away from the equipment the business needs to protect.

approach uses dedicated scanning stations, with multiple detection engines, offline capability and logging. These features support a controlled route for incoming media, rather than making the destination computer the first place an unfamiliar drive is examined.

That does not make hardware a substitute for policy or guarantee that every threat will be detected. The organisation still needs to decide which devices are allowed, what happens when something is flagged and who maintains the scanning environment. Equipment should support those decisions, not obscure them.

An effective workflow also needs an exception route. When a supplier arrives with an urgent update and an unsuitable device, staff need an approved alternative. Otherwise, the pressure to restore service can turn a security rule into something people quietly work around.

Make Checking Repeatable, Not Ceremonial

Picture an engineer bringing a configuration file into a workshop. The useful process starts before the visit: agree the transfer method, identify the required files and establish who will approve them. On arrival, apply the agreed checks and move only the authorised content to its destination.

Keep a record of the transfer and its outcome. If a file cannot be inspected, do not quietly treat that as a successful check. Escalate the exception. If the drive later returns to another environment, reassess it rather than relying on yesterday’s result.

Review the process with the people who actually use it. Check whether scanning queues, unclear ownership or unsupported file formats encourage shortcuts, then adjust the workflow without weakening the agreed controls or ignoring unresolved warnings.

Backups deserve attention too. The NCSC advises disconnecting removable backup media when it is not being used, because malware can spread to attached storage. A backup should provide a recovery option, not remain permanently exposed to the same incident affecting the working machine.

Keep The Convenience, Remove The Assumption

USB storage can remain useful without being treated as automatically trustworthy. For individuals, the lesson is to question unfamiliar devices and use approved sharing methods. For businesses, it is to build a repeatable route for checking, authorising and recording necessary transfers.

The best habit is simple: pause before connecting. Ask where the device came from, why the transfer is needed and which checks apply. A few deliberate decisions can preserve the convenience of removable media without giving every drive an invitation into sensitive systems.