What is Air Gap?

What is Air Gap?

What is Air Gap? Jonathan Poland

An air gap is a computer network that is physically isolated from other networks, including the internet. This isolation is designed to protect the network and the sensitive data it contains from external threats and vulnerabilities. Air gaps are commonly used in a variety of contexts to enhance information security, including in military systems, medical devices, secure facilities such as prisons, and critical infrastructure such as nuclear power plants.

For example, a military system might use an air gap to protect sensitive information from being accessed by external parties, such as foreign governments or cybercriminals. Similarly, a hospital might use an air gap to protect patient data and ensure the integrity and reliability of its medical devices. In these cases, the air gap helps to reduce the risk of information security breaches and ensure that the systems and data are protected from external threats.

Basically, air gaps are a basic and effective approach to protecting systems and information from external threats. By physically isolating networks from other networks, organizations can reduce the risk of information security breaches and protect sensitive data from external vulnerabilities. The following are illustrative examples of an air gap.

Standalone System

An air gap can be implemented as a standalone system with no networking capabilities whatsoever. For example, a medical device that contains a microcontroller but has no interface to connect to the outside world.

Offline Storage

Data storage devices that are only connected to computers that are offline. For example, a professional musician with a vault of unreleased material that is stored on encrypted data storage devices in a recording studio. Such devices are only connected to musical instruments and computing devices that have no connection to the internet or outside networks.

Stand-alone Network

A network that connects local devices without any physical way to connect to the internet or unsecured networks. For example, the human resources team of a small regional bank want to restrict confidential employee data to three machines that have no outside network connection. The three machines are networked together and attached to various data storage devices. The machines in the network and attached devices have no wireless networking capabilities and are not connected by wire to the internet or the office’s local area network.

Large Networks

An air gap network isn’t necessarily contained to one site and can be geographically distributed at a global, regional, city or campus scale. For example, a globally distributed control system for a pipeline that is completely isolated from unsecured networks. Large air gap networks are often challenging to physically secure. For example, wireless or wired communications running great distances may be intercepted or manipulated.

Physical Security

A hydroelectric dam maintains control systems that aren’t networked to the outside world. These systems are physically secured in a management office that can only be accessed by authorized individuals with a variety of security measures in place such as an access control system and security system.

Segregation Of Duties

A hedge fund is developing financial trading algorithms in a small room with no network connections out and advanced physical security measures such as a mantrap. They often use segregation of duties to ensure that no one person can remove or bring in data to the room. For example, any updates to the system involve multiple trusted people that have different roles such that no single person could install a malicious file.

Signal Blocking

A nuclear power station is completely unconnected to any networks. Efforts are made to block wireless networking signals in sensitive areas of the facility.

Hardware Validation

Modern hardware may contain networking capabilities that is not well documented. This may be done to implement functionality such as remote support or software updates. Alternatively, networking capabilities may be built into things for malicious purposes. As such, implementing a secure air gap network requires carefully reviewing any hardware that comes into contact with the system including external storage devices and peripherals such as a keyboard.

Updates

Air gap networks can only be updated by connecting outside data storage devices. This is a high risk operation and is a common way for air gapped systems to be compromised. Updates to air gap networks require a secure end-to-end procedure that includes a chain of trust for the files you are using and segregation of duties that ensure no single person can add malicious files. The security of updates are also completely reliant on the integrity of the data storage hardware used.

Backups

Air gap networks are commonly backed up locally on the air gap network itself. Implementation of secure offsite backups requires a process with all the same elements as an update process including hardware validation, chain of trust and segregation of duties. Physical security for data leaving a facility is also an important consideration.

Learn More
Strategic Advantage Jonathan Poland

Strategic Advantage

A strategic advantage refers to a position that gives a company an edge over its competitors and makes it likely…

Military Contracts 150 150 Jonathan Poland

Military Contracts

Military spending contracts are agreements between a government or its defense department and private companies or suppliers for the provision…

Business Risk Jonathan Poland

Business Risk

A business risk is a potential event or situation that could negatively impact an organization’s ability to achieve its objectives.…

Compliance Testing Jonathan Poland

Compliance Testing

Compliance testing is the process of evaluating an organization’s compliance with laws, regulations, and other standards to ensure that it…

Key Employees Jonathan Poland

Key Employees

Key employees, or key personnel, are individuals who possess unique skills, knowledge, or connections that make their prolonged absence or…

Performance Risk Jonathan Poland

Performance Risk

Performance risk refers to the potential negative consequences that a business may face if a product, service, program, or project…

What is a Business Case? Jonathan Poland

What is a Business Case?

A business case is a document that presents a proposal for a project, strategy, or course of action. It is…

Market Entry Strategy Jonathan Poland

Market Entry Strategy

A market entry strategy is a plan for introducing products and services to a new market. This can provide an…

Time To Market Jonathan Poland

Time To Market

Time to market is an important metric for businesses because it can affect a company’s ability to remain competitive and…

Content Database

What is an Agent? Jonathan Poland

What is an Agent?

An agent is a person or organization that has been granted the authority to act on behalf of another person…

Process Efficiency Jonathan Poland

Process Efficiency

Process efficiency refers to the effectiveness of a process in achieving its intended outcomes, while minimizing waste and inefficiency. A…

Product Risk Jonathan Poland

Product Risk

Product risk refers to the potential for negative consequences that may result from the development, production, or use of a…

Augmented Product Jonathan Poland

Augmented Product

An augmented product is a product that includes intangible benefits beyond the physical product itself. These intangible benefits may include…

What is Reliability? Jonathan Poland

What is Reliability?

Reliability is a measure of the ability of a product or service to perform consistently and predictably over time. It…

What is Stagflation? Jonathan Poland

What is Stagflation?

Stagflation is a period of high inflation, low economic growth and high unemployment. Stagflation is a economic phenomenon in which…

Price Sensitivity Jonathan Poland

Price Sensitivity

Price sensitivity is a measure of how much the demand for a product or service decreases as the price increases.…

Domain Knowledge Jonathan Poland

Domain Knowledge

Domain knowledge refers to a person’s understanding, ability, and information about a specific subject or area. It is often associated…

Operations Planning Jonathan Poland

Operations Planning

Operations planning involves identifying and implementing strategies and tactics to optimize the core processes and practices that enable a business…