Making the USB Port a Checkpoint

TXOne Networks has announced a purpose-built OT security checkpoint for removable media: inspect USB drives and other media at the point of entry, transfer cleared files, and keep a record of what entered the environment — without installing software on production systems or requiring network connectivity.

The problem it addresses is the one every air-gapped plant has and few document. An isolated network still needs files to cross into it: firmware images, PLC programs, vendor patches, configuration backups, laboratory results, recipe files. Those arrive on a contractor's USB stick or an engineer's laptop, and in most plants the control consists of a policy, a sticker on a laptop, and a hope. Air gaps do not fail because someone bridges the network; they fail because somebody carries a file across, which is precisely what the gap was designed to require.

Two design choices in this approach are worth extracting because they generalise beyond any product. The first is agentless operation on production assets. Any OT security control that requires software on a PLC, an HMI or a production PC runs into validation constraints, vendor support conditions and change windows, and is often refused outright on equipment whose warranty depends on it. Moving the control to the entry point rather than the endpoint sidesteps all of that.

The second is the audit record. Blocking bad files is only half the value; knowing what did cross, when and by whom is what makes the control auditable and what turns an incident investigation from archaeology into a query. Anyone working toward IEC 62443 will recognise that removable media handling is a documented requirement rather than a good idea, and the evidence is the hard part.

The obvious caution is that a scanning checkpoint inspects against what it knows. It will not catch a targeted implant in a vendor firmware image, and it should not be presented internally as though it will. What it does reliably is raise the cost of the commodity paths, eliminate the accidental cases, and produce the record — which, in most plants, is a substantial improvement over an unmonitored USB port and a policy nobody enforces.

The company has not published pricing or availability, and technical director Jeff Moncrief's quoted framing is that OT teams describe this as the kind of control they have been looking for. A webinar demonstrating the approach is scheduled for 9 September.