What is Air Gap?

What is Air Gap?

What is Air Gap? Jonathan Poland

An air gap is a computer network that is physically isolated from other networks, including the internet. This isolation is designed to protect the network and the sensitive data it contains from external threats and vulnerabilities. Air gaps are commonly used in a variety of contexts to enhance information security, including in military systems, medical devices, secure facilities such as prisons, and critical infrastructure such as nuclear power plants.

For example, a military system might use an air gap to protect sensitive information from being accessed by external parties, such as foreign governments or cybercriminals. Similarly, a hospital might use an air gap to protect patient data and ensure the integrity and reliability of its medical devices. In these cases, the air gap helps to reduce the risk of information security breaches and ensure that the systems and data are protected from external threats.

Basically, air gaps are a basic and effective approach to protecting systems and information from external threats. By physically isolating networks from other networks, organizations can reduce the risk of information security breaches and protect sensitive data from external vulnerabilities. The following are illustrative examples of an air gap.

Standalone System

An air gap can be implemented as a standalone system with no networking capabilities whatsoever. For example, a medical device that contains a microcontroller but has no interface to connect to the outside world.

Offline Storage

Data storage devices that are only connected to computers that are offline. For example, a professional musician with a vault of unreleased material that is stored on encrypted data storage devices in a recording studio. Such devices are only connected to musical instruments and computing devices that have no connection to the internet or outside networks.

Stand-alone Network

A network that connects local devices without any physical way to connect to the internet or unsecured networks. For example, the human resources team of a small regional bank want to restrict confidential employee data to three machines that have no outside network connection. The three machines are networked together and attached to various data storage devices. The machines in the network and attached devices have no wireless networking capabilities and are not connected by wire to the internet or the office’s local area network.

Large Networks

An air gap network isn’t necessarily contained to one site and can be geographically distributed at a global, regional, city or campus scale. For example, a globally distributed control system for a pipeline that is completely isolated from unsecured networks. Large air gap networks are often challenging to physically secure. For example, wireless or wired communications running great distances may be intercepted or manipulated.

Physical Security

A hydroelectric dam maintains control systems that aren’t networked to the outside world. These systems are physically secured in a management office that can only be accessed by authorized individuals with a variety of security measures in place such as an access control system and security system.

Segregation Of Duties

A hedge fund is developing financial trading algorithms in a small room with no network connections out and advanced physical security measures such as a mantrap. They often use segregation of duties to ensure that no one person can remove or bring in data to the room. For example, any updates to the system involve multiple trusted people that have different roles such that no single person could install a malicious file.

Signal Blocking

A nuclear power station is completely unconnected to any networks. Efforts are made to block wireless networking signals in sensitive areas of the facility.

Hardware Validation

Modern hardware may contain networking capabilities that is not well documented. This may be done to implement functionality such as remote support or software updates. Alternatively, networking capabilities may be built into things for malicious purposes. As such, implementing a secure air gap network requires carefully reviewing any hardware that comes into contact with the system including external storage devices and peripherals such as a keyboard.

Updates

Air gap networks can only be updated by connecting outside data storage devices. This is a high risk operation and is a common way for air gapped systems to be compromised. Updates to air gap networks require a secure end-to-end procedure that includes a chain of trust for the files you are using and segregation of duties that ensure no single person can add malicious files. The security of updates are also completely reliant on the integrity of the data storage hardware used.

Backups

Air gap networks are commonly backed up locally on the air gap network itself. Implementation of secure offsite backups requires a process with all the same elements as an update process including hardware validation, chain of trust and segregation of duties. Physical security for data leaving a facility is also an important consideration.

Learn More…

Market Position Jonathan Poland

Market Position

The market position of a brand, product, or service refers to its…

Relationship marketing Jonathan Poland

Relationship marketing

Relationship marketing is a type of marketing that focuses on building long-term,…

Change Resistance Jonathan Poland

Change Resistance

Change resistance is the act of derailing, slowing down, or preventing a…

Management by Exception Jonathan Poland

Management by Exception

Management by exception is a management technique that involves automating standard processes…

Dynamic Pricing Jonathan Poland

Dynamic Pricing

Dynamic pricing refers to the practice of changing prices in real time…

Long Tail Model Jonathan Poland

Long Tail Model

The long tail refers to a business model that allows a large…

Price Promotion Strategy Jonathan Poland

Price Promotion Strategy

A price promotion is a marketing strategy that involves temporarily lowering the…

Quality Requirements Jonathan Poland

Quality Requirements

Quality requirements refer to the specific standards that a product, service, process,…

Brand Concept Jonathan Poland

Brand Concept

A brand concept is the overarching idea or meaning that lies at…

Jonathan Poland © 2023

Search the Database

Over 1,000 posts on topics ranging from strategy to operations, innovation to finance, technology to risk and much more…

Buying Behavior Jonathan Poland

Buying Behavior

Buying behavior refers to the actions and decisions made by consumers when…

Change Management Metrics Jonathan Poland

Change Management Metrics

Change management metrics are quantitative measures used to evaluate the effectiveness of…

Income Statement Jonathan Poland

Income Statement

An income statement is a financial statement that shows a company’s revenues,…

What is Dumping? Jonathan Poland

What is Dumping?

Dumping refers to the act of selling a product or service in…

Cell Production Jonathan Poland

Cell Production

Cell production is a manufacturing approach that involves organizing work into small,…

Risk Evaluation Jonathan Poland

Risk Evaluation

Risk evaluation is the process of identifying and assessing the risks that…

What is Risk Communication? Jonathan Poland

What is Risk Communication?

Risk communication involves informing people about potential hazards and the steps that…

Business Scale Jonathan Poland

Business Scale

Business scale refers to the impact that a company’s size has on…