Flash memory security tends to fail quietly. The file you deleted is still recoverable, the encryption you specified sits in software that can be worked around, and the card that corrupted in a hot cabinet has just handed someone your calibration data. This guide covers where flash memory data storage is genuinely at risk in industrial applications, which controls close those gaps, and how to choose media that protects data at rest without paying for protection you do not need.
Most of what follows applies to data at rest, because that is where flash media lives in the threat model. If you are working on the wider picture, including secure boot, memory partitioning and data in transit, start with our guide on how to secure embedded memory and come back here for the media itself.
Where flash memory security actually fails
The risk sits in three places. The way flash manages data behind your back, the physical robustness of the media, and the port it plugs into. Software controls sit above all three and cannot see any of them.
The data you deleted is probably still there
Deleting a file on a flash device does not erase it. The controller marks the logical block as invalid and moves on, and the physical page holds its charge until the garbage collector gets round to erasing the whole block it sits in. That can be minutes later, or never, depending on how full the device is.
It gets harder than that. Flash devices reserve capacity for wear levelling and bad block management, and that reserved area is not addressable by the host at all. Overwrite the drive from the operating system as many times as you like, and you cannot reach it. Copies of your data sit in blocks the host cannot see or command.
For most applications, that is a housekeeping detail. If your device stores encryption keys, patient data, machine recipes or anything covered by a retention policy, it is the single most overlooked risk in the whole specification.
Wear is a security problem, not just a reliability one
Flash cells tolerate a finite number of program and erase cycles. As they wear, the error rate climbs, the controller leans harder on error correction, and eventually a read comes back wrong or not at all. JEDEC publishes the endurance and workload standards that solid-state drive ratings are measured against, which is why a rating quoted without the workload behind it tells you very little.
Treat that as a security issue rather than a maintenance one. A corrupted event log cannot be relied on in an investigation. A flight record with holes in it fails an audit. Availability and integrity are two-thirds of the job, and a worn-out consumer card fails both.
Sudden power loss is the same story from a different direction. Pull power mid-write, and you can lose not just the block being written but the mapping table that tells the controller where everything lives. Industrial drives with power loss protection hold enough charge to finish the write in flight, which is the difference between one lost record and an unmountable device.
The port is the easiest way in
A standard USB socket or SD slot accepts anything the same shape. Someone with physical access to your cabinet has a working data path in and out of your system, and no software control on the host can stop a device that has not booted yet.
This is where form factor does more work than encryption. Datakey RUGGEDrive tokens use a unique mating receptacle, so a standard memory stick physically will not go in. An operator cannot walk up and copy your configuration, and cannot introduce anything either. The receptacles are rated for 50,000 insertions, with the Key series rated considerably higher, and IP67 panel-mount versions are available where the same door is exposed to washdown or weather.
It is an approach that holds up under scrutiny. Datakey tokens are in service with NATO member armed forces, and we can talk through the details under NDA.
Encryption that can be worked around
Modern devices ship with encryption features, and that is worth having. What it is not is a finished answer. Software encryption depends on the host being trustworthy, and if the key sits somewhere predictable on the same device, you have locked the door and left the key under the mat.
One correction worth making, because it circulates widely. Cold boot attacks, where memory is chilled to slow the decay of its contents, target volatile memory such as DRAM and SRAM. They are not how NAND flash gets read. Flash has the opposite problem. It keeps data faithfully for years without power, which is exactly why remanence is the concern rather than decay.
Michael recommends deciding early whether your data needs to be unreadable or unwritable, because those are two different products. Engineers often come to us asking for encryption when what the application actually needs is a write-once card that nobody can alter after the fact.
What actually closes the gaps
| Risk | What closes it | Where it lives |
|---|---|---|
| Deleted data still recoverable | Controller-level sanitise or cryptographic erase | Drive firmware |
| Unauthorised read of the media | Hardware encryption with the key held off the host | Self-encrypting drives, encrypted USB and SSD |
| Anyone can plug anything in | Unique mating form factor | Datakey RUGGEDrive and receptacles |
| Records altered after the event | Write-once media, hardware write-protect | WORM cards, X-Mask |
| Malicious write or ransomware in service | Firmware-level detection and response | X-PHY |
| Corruption from heat, shock or power loss | Industrial-grade media with power loss protection | Industrial SSD, SD and microSD |
Encryption at the media, not above it
Hardware encryption runs on the drive controller, using a key the host never handles. The data leaves the controller encrypted and arrives encrypted, so pulling the device and reading it on a bench gets you ciphertext. AES-256 is the sensible default and remains computationally out of reach of brute force.
Where the data itself is classified, Kobra VS encrypted drives add two-factor authentication, so possession of the drive alone is not enough to open it. They are manufactured in Germany and approved for handling classified material at restricted levels. Tell us the classification you are working to, and we will send you the current certificate so you can check it against your own requirements. For rugged and defence programmes, Foremay military grade SSDs offer self-encrypting options.
If your authentication needs to happen at the token rather than the drive, Datakey CryptoAuthentication puts the cryptographic element in the key itself, which is the pattern used for crypto ignition keys and access control in government and military systems.
Making records immutable
Some data should never change after it is written. Calibration certificates, maintenance logs, dosing records, evidential video. Encryption does not help here, because an authorised user with the key can still overwrite the file.
Write once, read many media solves it at the hardware level. Once a block is written, it cannot be rewritten, whatever the host asks for. Flexxon security media covers WORM cards and hardware read-only modes.
Concealment is the related answer where the problem is someone finding the data in the first place. Flexxon X-Mask cards stay invisible to any host that does not have the security tool installed and the correct password, so a card lifted from a device and put into a laptop simply does not present. You can mask the whole card or split it, leaving one partition open and the rest hidden. X-Mask Pro goes further and encrypts the contents automatically the moment the card is removed, or the device loses power, which covers the scenario where the equipment is taken rather than accessed in place.
Detection and reaction inside the drive
The newest layer is a drive that watches its own traffic. X-PHY cyber secure SSDs run threat detection in firmware, below the operating system, and can lock the drive when they see a write pattern consistent with ransomware or an attempt at physical tampering. Because it sits underneath the host, it keeps working when the host is already compromised, which is the scenario every other control assumes will not happen.
When the environment is the attack surface
In defence and aerospace, transport and off-highway applications, the thing most likely to cost you your data is not an attacker. It is a winter start in an unheated cabinet, sustained vibration on a rail bogie, or condensation in a wash down bay.
Industrial grade cards are specified for wide operating temperature ranges, shock and vibration, and conformal coating where moisture is a factor. The military grade industrial memory range is built around exactly these conditions. Treat environmental hardening as part of your security specification rather than a separate reliability line item, because an unreadable record and a stolen one both end the same way.
Michael recommends working out how a device gets decommissioned before you specify the memory, not after. If the drive cannot be verifiably sanitised, you are committed to physically destroying it at end of life, and that is a cost and a logistics problem nobody budgets for at the design stage.
Regulated sectors and what auditors ask for
The specifics vary by sector, but the questions are consistent. Who can read this data, who can change it, how do you prove it has not been altered, and what happens to it at the end of the product’s life.
In the UK, the Information Commissioner’s Office is the reference point for anything involving personal data, including retention and secure disposal. In industrial automation, IEC 62443 sets out the security expectations for control systems, and in medical devices your notified body will want to see how data integrity is maintained across the device life cycle. None of that is satisfied by a product certificate alone, but the right media makes the answer short instead of long.
Nexus is Cyber Essentials certified and has supplied secure memory into regulated programmes since 1987. What that gets you in practice is a supplier who has already had these conversations with your auditors’ counterparts elsewhere, and who will tell you plainly when a product does not meet what you need.
How Nexus helps you get the specification right
Send us the application and the constraint you are actually stuck on, and you get a straight answer from someone who has specified this class of part before, not a link to a datasheet you have already read. Because Nexus represents Datakey, Flexxon, Foremay, Kobra VS and X-PHY across the UK, Ireland, the DACH region, Benelux and Scandinavia, you get a comparison across five ranges rather than a push towards the only line in stock.
Supply commitments matter here as much as the security features do. A memory change in a regulated product sends you back through requalification, so knowing the part will still be there in ten years is part of the security answer rather than separate from it. Our value added distribution page sets out what working this way involves.
Frequently asked questions
Is deleting a file from an industrial SD card enough to remove the data? No. A delete marks the data invalid at the logical level and leaves the physical pages intact until the controller reclaims them, and copies may sit in reserved areas the host cannot address. You need a controller-level sanitise or cryptographic erase to be confident the data has gone.
Do I need hardware encryption if my application already encrypts data in software? Not always, but hardware encryption removes a dependency. Software encryption assumes the host is trustworthy and that the key is stored somewhere an attacker cannot reach. If the device can be removed, opened or reverse engineered, put the encryption on the drive controller where the host never handles the key.
What is the difference between a WORM card and a write-protected card? Write protection is a mode that can usually be switched off, either by a physical switch or a command. WORM is permanent at the hardware level, so once a block is written, it cannot be rewritten by anyone, including you. Choose write protection for operational safety and WORM where the record has to stand up as evidence.
Does an industrial-grade card actually improve security, or just reliability? Both, and they are less separable than they look. Wider temperature tolerance, power loss protection and better wear management stop the corruption that makes logs unusable, and industrial ranges are where the security features such as WORM, hardware encryption and hidden partitions are available at all.
How long will the part I specify stay available? That depends on the range, and it is worth asking before you design it in rather than after. Industrial ranges carry longer availability commitments than consumer parts, and where a manufacturer issues an end-of-life notice, there is normally a last-time buy window that you want to hear about early.
Talk it through before you commit
If you are specifying memory for something where the data matters, the fastest route is a conversation. Send us the application, the environment and the constraint you are up against, and we will tell you which of these controls you actually need and which you can leave out. Get in touch with the team, and we will come back with options rather than a datasheet.
Earlier in the process and just want to see the hardware? Request a memory sample or download the product brochure to compare the ranges side by side.