Air Gap Network

An air gap is a security measure that involves isolating a computer or network and preventing it from establishing an external connection. An air-gapped computer is physically segregated and incapable of connecting wirelessly or physically with other computers or network devices. An air gap is also known as an air wall and the strategy of using air gaps to protect critical data is also known as security by isolation.

Why are air gaps used?

Air gaps are used to protect critical computer systems and the data they store from malware, keyloggers, ransomware and other types of unauthorized access. This strategy seeks to ensure the total isolation of a given system electromagnetically, electronically and physically. In systems where security is paramount, the air-gapped system should have restricted access so only a few trusted users can access the system and deliver the data. The principle of least privilege limits users’ access rights, which can also help decrease the chances of a cyber attack.

Air gaps also play an important role in confidential computing. Confidential computing is an emerging approach to cybersecurity that runs computational workloads in isolated, hardware-encrypted environments. Air gapping also plays an important role in backup and recovery. For example with 3-2-1 backups, each backup has three copies. While two of the copies can be stored on the same network, the third copy has to be air-gapped and stored in a completely different physical location. This way, even if the network is attacked and the first two copies become compromised, storage administrators can use the air-gapped copy to restore data quickly.

Types of air gaps

There are generally three types of air gaps: total physical air gaps, air-gapped systems isolated within one environment and logical air gaps.

1. Total physical air gaps are air-gapped systems in which hardware or software is physically isolated in its own environment. This type of air gap separates a system completely from other network-connected systems and may also have restricted physical access.
2. Isolated air-gapped systems are separated from other systems in the same environment, perhaps even on the same rack, but aren’t connected to the same network.
3. Logical air gaps separate systems within the same network logically instead of physically. Logical separation methods can be completed using encryption and role-based access control, for example.

Some organizations may also have to handle two levels of information, which are separated into high and low sides. The high side is information or systems that require a highly secured environment – such as critical infrastructure –while the low side is data or systems that can be left connected to a network.

Air gap challenges

Although some organizations believe that air gapping is a viable security measure, air gaps are disappearing due to the following challenges:

• Manual updates : Air-gapped systems can’t connect to the internet to update software automatically. Systems administrators must instead manually download and install new updates and patches. This requires more manual input, and if sys admins become too relaxed on updates, then the software on their air-gapped systems will become out of date, leaving the system unprotected from emerging virus threats.
• Human error and insider attack:. Sending data to an air-gapped system traditionally requires the use of a portable storage device like a USB. If brought on premises, infected USB devices could be used to leak data from an air-gapped system. Additionally, users could accidentally leave doors unlocked or USB ports unguarded.
• Electromagnetic attack: Air-gapped systems are susceptible to electromagnetic leakage, which enables malicious actors to analyze waveforms emitted from the CPU, chassis fans or wires with the goal of attacking the system.
• Supply chain attacks: A virus could be installed in updated software that gets passed along to air-gapped systems.