The report was based on cybersecurity threat data collected and analyzed from hundreds of industrial facilities globally during a 12-month period. Along with USB attacks, research shows a growing number of cyber threats including remote access, Trojans and content-based malware have the potential to cause severe disruption to industrial infrastructure.

“USB-borne malware was a serious and expanding business risk in 2020, with clear indications that removable media has become part of the playbook used by organized and targeted attacks, including ransomware,” said Eric Knapp, director of Cybersecurity Research and engineering fellow, Honeywell Connected Enterprise, Cybersecurity. “Because USB-borne cyber intrusions have become so effective, organizations must adopt a formal remove media security program to protect against intrusions and avoid potentially costly downtime.”

Many industrial and OT systems are air-gapped or cut off from the internet to protect them from attacks. Intruders are using removeable media and USB devices as an initial attack vector to penetrate networks and open them up to major attacks. Knapp says sophisticated multi-functional malware can directly impact target systems, download stage-two payloads or open backdoors to establish direct remote access, along with command and control.

The 2021 report analyzes data from Honeywell's Secure Media Exchange (SMX) technology, which is designed to scan and control USB drives and removable media. To reduce the risk of USB-related threats, Honeywell recommends that organizations combat these threats with several layers of OT cybersecurity software products and services.

To read the full report, visit https://www.honeywell.com/us/en