Media inspection station
USB drives, laptops, and files brought into the plant need to be checked before they enter. We install an inspection station for this, to stop infections that arrive on removable media.
When you need it
Where files come in on USB drives and laptops
OT networks are often cut off from the internet. Files still have to get in, though.
Even an isolated network has a way in
In practice, physical isolation is rarely complete: USB media and maintenance laptops bridge the gap regularly. USB media are still one of the most common infection paths into isolated networks, and that has not changed since Stuxnet.
A maintenance technician arrives
The supplier’s technician works on the equipment with their own laptop and USB stick. Before they reached your plant, these devices were at other clients and on other networks.
The target machine cannot protect itself
Many HMIs and engineering workstations run old operating systems that modern endpoint protection does not work on. Without internet access, daily signature updates do not arrive either, and the equipment supplier often prohibits installing third-party software.
The point of entry
What gets inspected
The station typically sits at the point of entry. Anything headed into the plant is scanned there before it connects to any OT machine.
USB drives and other removable media
On arrival, the employee or supplier connects the media to the station and moves on with it only after the scan.
Laptops
A laptop brought in for maintenance is scanned before it enters, because it will be connected to the OT network or directly to the equipment.
Files
A new version of a control program or a supplier’s documentation can also be infected, so files are scanned as well.
Deliverables
What you get at the end
items handed over
- Installation of the inspection station
- Entry procedure for employees and suppliers
- Short training on how to use it
Related services
What goes with the station
The station checks data brought in by hand. Remote access and the target machines’ own protection are handled by other services. The assessment shows where undocumented ways in still exist.
Secure remote maintenance access
If the supplier connects through its own VPN or remote access software, these are replaced by an access point that requires approval and logs access.
OT endpoint protection
Protection for old HMIs, engineering workstations, and industrial PCs that cannot be updated or are cut off from the internet, without slowing operations down.
OT security assessment
An asset inventory and communication map of the OT network, including undocumented external connections.
Frequently asked questions
The questions we hear most
If our OT machines have endpoint protection, do we still need an inspection station?
The two complement each other. Allowlisting endpoint protection stops any program that is not on the list from running on the machine. But many plant machines cannot have anything installed on them, and for those, portable scanning is what remains. The inspection station filters regardless of how the target machine is protected. We wrote about OT endpoint protection in detail in this article.
Our network is isolated. Do we still need it?
That is exactly where it is needed. Isolation keeps out attacks that come over the network, and the station checks the media brought in by hand.
Does the procedure apply to suppliers too?
Yes. We write the entry procedure for both employees and suppliers, because the devices of a technician who comes in for maintenance end up inside the plant just the same. If the supplier connects remotely, that is covered by secure remote maintenance access.
Who keeps the station up to date after handover?
Updating the station is an operations task. Operation after rollout can be requested under a custom agreement.
