In a world where cyber threats are becoming increasingly complex, air-gapping remains a critical protection tool for industrial enterprises, critical infrastructure facilities, and financial institutions. However, it requires careful management of data flows rather than simply disconnecting from the network. Many organizations still perceive air-gapping as the ultimate solution, believing isolated systems to be fully protected. However, the reality is different: any environment requires maintenance, configuration updates, and security event monitoring. It is at the intersection of the trusted (isolated) and untrusted (external) domains that vulnerabilities arise, related to the necessity of data transfer.
Why the concept of 'absolute isolation' is a dangerous myth
Organizations often mistakenly consider air-gapped environments invulnerable, ignoring risks associated with access management, log transmission, and software updates. The U.S. National Institute of Standards and Technology (NIST) defines an air gap as an interface separation between systems where data is not transferred directly between them. The key emphasis is on the word "directly": information flows still exist but are implemented via physical media or transit nodes.
Physical isolation does not guarantee absolute security and is not a "silver bullet." It does not protect against supply chain attacks or compromised media. Furthermore, managing an isolated environment requires significantly higher operational costs for security maintenance compared to connected networks. Without timely updates, the system becomes obsolete, and uncontrolled attempts to install patches create gaps in the isolated perimeter.
Analysis of attack vectors on air-gapped systems: how threats overcome the physical barrier
Threat modeling shows that the physical barrier is successfully overcome by targeted attacks via indirect channels. The main penetration vectors are:
- Supply chain compromise: Malicious code can be contained in official software updates or hardware firmware. When an administrator imports them into an isolated network, the threat enters the perimeter.
- Removable media: USB drives and external disks are constantly used to deliver configurations. If the media has previously contacted an unverified environment, it becomes a transport for malware.
The updated NIST Cybersecurity Framework (CSF) 2.0 emphasizes the importance of considering cyber risks as part of corporate governance (the Govern function). Risks of air-gapped systems must be managed systematically rather than remaining a blind spot due to a false sense of complete security.
Organizing secure data and software update imports into an isolated network
Since it is impossible to forgo software updates, organizations must implement a rigorous process of controlled import. A key stage is the application of strict verification and scanning procedures for removable media before transferring updates into the isolated network.
The process should be based on the use of a special sanitization station. This is a dedicated computer intended exclusively for antivirus scanning and file cleaning before they are written to clean media. Only after passing verification can data be transferred to the target system. Any direct use of unverified flash drives or administrator devices must be blocked at the security policy level.
Monitoring without feedback: how to collect logs from an air-gapped environment per NIST SP 800-92
The lack of telemetry is one of the biggest problems for isolated systems. Without feedback on incidents, the security team cannot see anomalies within the perimeter. NIST SP 800-92 guidelines are a fundamental basis for building monitoring and log management processes, which is critical for air-gapped infrastructure.
The solution is to implement centralized log monitoring, where logs are exported from the isolated environment for analysis in a corporate SIEM. Logs are aggregated by a local collector server within the perimeter and then transmitted outward exclusively via a one-way channel, which makes incoming traffic in response impossible.
The role of data diodes in cross-domain architecture
The UK's National Cyber Security Centre (NCSC UK) has developed principles for secure data exchange between domains of different trust levels (Cross Domain Solutions). According to these principles, one of the most reliable tools is the use of unidirectional solutions.
Instead of classic bidirectional firewalls, data diodes are used to extract telemetry from an isolated segment without the possibility of feedback. Such hardware solutions physically guarantee that data transfer occurs only in one direction, preserving the integrity of the air-gapped barrier.
For implementing complex integration scenarios and secure data exchange between isolated segments, Softengi offers custom development and IoT/embedded solutions. This allows for the design of specialized gateways, the integration of monitoring systems, and the creation of secure software for controlled data import and export without violating perimeter isolation.
Security audit and air-gapped environment management checklist
- Presence of a regulated procedure for scanning and sanitization of removable media on a special isolated station before connection to the target system.
- Use of hardware data diodes for transmitting telemetry and logs outward without the physical possibility of incoming traffic.
- Regular backup of configurations and data using a "cold backup" scheme with physical disconnection of media.
- Implementation of centralized collection and analysis of security logs in accordance with NIST SP 800-92 recommendations.
- Restriction and strict audit of physical access to I/O ports (USB, Ethernet) on isolated machines.
FAQ
How can software and operating systems be safely updated in an air-gapped network?
Sanitization stations should be used for rigorous verification and antivirus scanning of update files. Afterward, the verified data is transferred to the isolated network exclusively on specially prepared and formatted removable media.
Can a system be considered 100% secure if it is physically disconnected from the internet?
No, because attack vectors remain via physical media, supply chain compromise (malicious software updates), and service maintenance equipment. Physical isolation is not absolute protection and requires risk management.
How can security event monitoring (SIEM) be configured for isolated servers?
Event logs are collected by a local collector within the isolated network and then exported to an external SIEM via hardware data diodes. This allows telemetry to be sent outward without creating an inbound communication channel.
Expert comment