Air-Gapped Networks - Physical Isolation for Security

About 2 min read

An air gap is a security technique that physically and completely isolates a protected system from the internet and other networks. It is the most powerful defensive measure, making network-based attacks impossible in principle, and it is adopted in environments that demand the highest level of security, such as military systems, the control systems of nuclear power plants, and the core settlement systems of financial institutions. As of 2025, research into attacks that bridge the air gap using sound waves or electromagnetic waves is advancing, and it is becoming recognized that physical isolation alone is not foolproof.

Moving Data Across an Isolated Boundary

Even when a control-system network is isolated by an air gap, there is usually still a need to move data between it and the outside, and relying on removable media such as USB drives turns the media itself into a way in. A common answer is to insert a device known as a data diode, which physically allows transfer in one approved direction only and leaves no path at all for the reverse direction. The typical intent is to let readings and logs out of the isolated side while blocking anything travelling toward it.

Air Gap Conceptual Diagram

Implementing and Operating an Air Gap

In an air-gapped environment, data input and output are performed via physical media such as USB drives or optical media. There is a risk that this physical media becomes an attack vector; the 2010 Stuxnet incident is known as a case where it intruded into the air-gapped environment of an Iranian nuclear facility via a USB drive. Multi-layered defense combined with network segmentation is common in practice.

Benefits and Limitations

The greatest benefit of an air gap is that it can physically block remote attacks. Even when ransomware spreads across a network, backups in an air-gapped environment remain safe. On the other hand, high operating costs, the difficulty of real-time data synchronization, and the effort required for software updates are challenges. The cold wallets used for crypto assets are also an application of air gapping; storing private keys in an offline environment reduces the risk of theft. Protect the physical access control system for the air-gapped environment with a strong random password to prevent unauthorized media from being brought in.