What Micro Secure Digital is
An SD card is a small flash storage device that plugs into a slot rather than a cable. microSD is the reduced-size member of that family, with the same electrical interface as a full-size SD card. The format began in 2004 as TransFlash, a removable card for mobile phones, and joined the SD standard in 2005 under the microSD name.
Because it is inserted and removed by hand, a microSD card is a type of removable media: it can leave the office in a pocket, and copying data to it does not pass through the network.
Where microSD cards are used
MicroSD started as phone storage, but its small size and low cost carried it into many other devices. Many of these cards are also portable storage devices that employees move between machines:
- Phones and tablets: expandable storage for photos, video, and offline content. Some phones can use a card as internal storage.
- Cameras and recorders: action cameras, drones, dashcams, body-worn cameras, and many security cameras record straight to microSD.
- Single-board computers: compact boards boot from a microSD card, making it a system disk for prototypes and edge devices.
- Laptops and readers: built-in card slots, USB card readers, and SD-to-microSD adapters connect cards to ordinary computers.
- Industrial and embedded equipment: kiosks, point-of-sale terminals and network hardware use cards for logs, updates, and configuration.
Capacity generations and speed classes
Generations are backward compatible. A newer card works in an older device only up to the capacity and file system that device supports. Beyond capacity, cards carry speed markings: Speed Class 2 to 10, UHS classes U1 and U3, and Video Speed classes V6 to V90. These matter for cameras recording high-resolution video but change little for data security.
| Standard | Maximum capacity | Default file system |
|---|---|---|
| microSD | 2 GB | FAT12/FAT16 |
| microSDHC | 32 GB | FAT32 |
| microSDXC | 2 TB | exFAT |
| microSDUC | 128 TB | exFAT |
How microSD differs from SD and USB drives
A full-size SD card (32 by 24 millimeters) uses the same technology in a larger body and dominates system cameras and laptops with full card slots. A microSD card in an adapter is electrically identical, so the difference is mechanical, not functional.
What matters for security is the route the card takes to a computer. A rule written only for USB flash drives misses the same card when it arrives by another route:
- In a USB reader it appears as ordinary removable storage.
- In a built-in laptop slot it appears as a drive with no USB device attached.
- Inside a phone or camera connected over a media transfer protocol, it appears as a media device.
Security risks of microSD cards
The traits that make microSD convenient (tiny, cheap, high-capacity, ubiquitous) are the same ones that make it a data leak risk.
| Risk | What it means |
|---|---|
| Concealment | A terabyte fits on a card smaller than a postage stamp. |
| No network footprint | Copies create no email, cloud upload or web request for network controls. |
| Loss and theft | Unencrypted by default; losing a card with customer data is a disclosure. |
| Inbound threats | A card from a partner can carry malware, like any USB drive. |
| Survival after disposal | Deleting or formatting does not reliably erase a card. |
Controlling microSD use in the enterprise
Because the card reaches a computer through a reader, a slot or a phone, control has to sit on the endpoint itself. Device control software treats card readers as removable storage, identifies them by their parameters and allows only approved hardware.
Enforcement works best when it is aware of content rather than treating every write alike. Routine transfers continue, while files matching sensitive-content rules are blocked or quarantined, and every operation is logged for later investigation.
- 1
Inventory readers and phones
List the card readers, built-in slots, and phones in use, and note the vendor and product IDs of each reader.
- 2
Allow only approved hardware
Rules based on device parameters let approved readers pass and stop unknown ones.
- 3
Match access to the need
Grant read-only access where writing is unnecessary, and block cards entirely where they serve no business purpose.
- 4
Check content and keep records
When writing is allowed, check files against sensitivity rules, keep shadow copies, and review the audit log.
What it looks like in Anexet
In Anexet DLP, the devices usage audit and the file operations audit on storage devices decide which cards are recorded, whether data written to them is copied to a shadow copy, and whether writes are checked by content. Filters then match a specific reader or card by its identity fields.
1 / 2
Where to start
Start with the cards that carry the most sensitive data and the routes they actually use: readers, slots or phones. Rules written for every removable device at once end up blocking routine work and get switched off.
Organizational measures close the gaps that software alone does not reach: issuing corporate cards, encrypting media, and securely erasing cards before disposal.
A card the size of a fingernail can hold a whole client database. Control has to reach the reader, the slot, and the phone, not just the USB port.
Anexet TeamHow Anexet handles this
In Anexet, microSD cards fall under device control: card readers and adapters are treated as removable storage, and phones or cameras with a card inside are handled by the same storage-device control tools as any other medium.
Because the product is deployed on-premise, shadow copies of files written to cards and the logs of device events remain inside the organization's own infrastructure.
What is covered
microSD and SD cards in USB readers, built-in card slots, and phones or cameras connected as media devices: everything the operating system identifies as removable storage.
Whitelist and blacklist rules
access to storage devices is governed by whitelist or blacklist rules built on device parameters, such as type, attribute, and value, down to a reader's vendor and product IDs. Reading and writing have separate policies.
Read, write, or block
a policy can grant read-only access, block the device entirely, or permit writing only for approved users, devices, and file types.
Shadow copies of transfers
when writing is allowed, each file written to a card is audited with its name, size, and initiating process, and a shadow copy is captured for review.
Content-aware enforcement
writes can be checked by content using security thesauri, hash banks, digital fingerprint libraries, and sensitivity labels, so routine transfers proceed while sensitive files are stopped.
Audit trail
each connection and file operation is recorded with user, device, and timestamp: a complete, attributable record of what was written to which card.
Anexet DLP
Learn more