What is Air Gap?

What is Air Gap?

What is Air Gap? Jonathan Poland

An air gap is a computer network that is physically isolated from other networks, including the internet. This isolation is designed to protect the network and the sensitive data it contains from external threats and vulnerabilities. Air gaps are commonly used in a variety of contexts to enhance information security, including in military systems, medical devices, secure facilities such as prisons, and critical infrastructure such as nuclear power plants.

For example, a military system might use an air gap to protect sensitive information from being accessed by external parties, such as foreign governments or cybercriminals. Similarly, a hospital might use an air gap to protect patient data and ensure the integrity and reliability of its medical devices. In these cases, the air gap helps to reduce the risk of information security breaches and ensure that the systems and data are protected from external threats.

Basically, air gaps are a basic and effective approach to protecting systems and information from external threats. By physically isolating networks from other networks, organizations can reduce the risk of information security breaches and protect sensitive data from external vulnerabilities. The following are illustrative examples of an air gap.

Standalone System

An air gap can be implemented as a standalone system with no networking capabilities whatsoever. For example, a medical device that contains a microcontroller but has no interface to connect to the outside world.

Offline Storage

Data storage devices that are only connected to computers that are offline. For example, a professional musician with a vault of unreleased material that is stored on encrypted data storage devices in a recording studio. Such devices are only connected to musical instruments and computing devices that have no connection to the internet or outside networks.

Stand-alone Network

A network that connects local devices without any physical way to connect to the internet or unsecured networks. For example, the human resources team of a small regional bank want to restrict confidential employee data to three machines that have no outside network connection. The three machines are networked together and attached to various data storage devices. The machines in the network and attached devices have no wireless networking capabilities and are not connected by wire to the internet or the office’s local area network.

Large Networks

An air gap network isn’t necessarily contained to one site and can be geographically distributed at a global, regional, city or campus scale. For example, a globally distributed control system for a pipeline that is completely isolated from unsecured networks. Large air gap networks are often challenging to physically secure. For example, wireless or wired communications running great distances may be intercepted or manipulated.

Physical Security

A hydroelectric dam maintains control systems that aren’t networked to the outside world. These systems are physically secured in a management office that can only be accessed by authorized individuals with a variety of security measures in place such as an access control system and security system.

Segregation Of Duties

A hedge fund is developing financial trading algorithms in a small room with no network connections out and advanced physical security measures such as a mantrap. They often use segregation of duties to ensure that no one person can remove or bring in data to the room. For example, any updates to the system involve multiple trusted people that have different roles such that no single person could install a malicious file.

Signal Blocking

A nuclear power station is completely unconnected to any networks. Efforts are made to block wireless networking signals in sensitive areas of the facility.

Hardware Validation

Modern hardware may contain networking capabilities that is not well documented. This may be done to implement functionality such as remote support or software updates. Alternatively, networking capabilities may be built into things for malicious purposes. As such, implementing a secure air gap network requires carefully reviewing any hardware that comes into contact with the system including external storage devices and peripherals such as a keyboard.

Updates

Air gap networks can only be updated by connecting outside data storage devices. This is a high risk operation and is a common way for air gapped systems to be compromised. Updates to air gap networks require a secure end-to-end procedure that includes a chain of trust for the files you are using and segregation of duties that ensure no single person can add malicious files. The security of updates are also completely reliant on the integrity of the data storage hardware used.

Backups

Air gap networks are commonly backed up locally on the air gap network itself. Implementation of secure offsite backups requires a process with all the same elements as an update process including hardware validation, chain of trust and segregation of duties. Physical security for data leaving a facility is also an important consideration.

Learn More
Razor and Blades Jonathan Poland

Razor and Blades

The razor and blades model, also known as the bait and hook model, is a business strategy that involves selling…

Price Umbrella Jonathan Poland

Price Umbrella

A price umbrella is a pricing strategy in which a company sets a high price for a premium product or…

Relative Advantage Jonathan Poland

Relative Advantage

Relative advantage refers to the extent to which a company’s product, service, or offering is superior to those of its…

Research Design Jonathan Poland

Research Design

Research design is the overall plan or approach that a researcher follows in order to study a particular research question.…

Cognitive Abilities Jonathan Poland

Cognitive Abilities

Cognitive abilities refer to the mental processes that allow individuals to acquire, retain, and use knowledge. They are foundational types…

Marketing Technologies Jonathan Poland

Marketing Technologies

Marketing technology, or “martech,” refers to the tools and software used to support marketing efforts, such as advertising, brand management,…

Supply Risk Jonathan Poland

Supply Risk

Supply risk refers to the likelihood that a disruption in the supply of goods or services will negatively impact a…

Cyber Security Jonathan Poland

Cyber Security

Cybersecurity is the practice of protecting computing resources from unauthorized access, use, modification, misdirection, or disruption. It is a critical…

Soft Skills Jonathan Poland

Soft Skills

Soft skills are a broad and diverse set of abilities that are essential for success in many areas of life,…

Content Database

Psychographics Jonathan Poland

Psychographics

Psychographics is the study of personality, values, attitudes, interests, and lifestyles. It is a research method used to identify and…

External Risk Jonathan Poland

External Risk

An external risk is a type of risk that is outside of your control and cannot be influenced or managed…

Incident Management Jonathan Poland

Incident Management

Incident management is a process that involves the organization and coordination of efforts to address and resolve information technology incidents.…

Marketing Costs Jonathan Poland

Marketing Costs

Marketing costs are expenses that are related to promoting and selling products or services to customers. These costs can include…

Business Decisions Jonathan Poland

Business Decisions

A business decision is a commitment made by a company, team, or individual employee to a specific course of action.…

Sustainable Materials Jonathan Poland

Sustainable Materials

Sustainable materials are materials that have a relatively positive impact on communities and the environment when used in the construction…

Intuitive Surgical Jonathan Poland

Intuitive Surgical

Intuitive Surgical is a medical technology company that designs, manufactures, and markets advanced surgical robotic systems. The company was founded…

Data Security Jonathan Poland

Data Security

Data security is the practice of protecting data from unauthorized access, use, modification, destruction, or deletion. It is a key…

Sales Planning Jonathan Poland

Sales Planning

Sales planning is the process of setting revenue and unit targets for a sales team, and developing a plan to…