In modern conditions, where critical infrastructure (essential entities) is a primary target for sophisticated cyberattacks, ensuring reliable visibility in air-gapped networks is a critical element of any defense strategy. Traditional monitoring approaches that rely on cloud computing and automated Threat Intelligence updates prove ineffective in closed circuits. Creating an effective threat detection system in such environments requires rethinking the architecture of log collection and audit data protection at the application software level.
Air-gap specifics: why standard SIEM approaches fail without cloud
According to the NIST CSRC definition, an air gap is an interface separation between systems where data is not transferred directly between them. In such conditions, B2G sector organizations and critical infrastructure face the inability to use cloud-based SIEM solutions, which necessitates building an on-premises log aggregation architecture.
A local SIEM system alone does not guarantee security without properly configured correlation rules. Approximately 53.7% of incidents in closed networks are related to insider actions or credential compromise. Yet, only 27.7% of organizations have correlation rules configured to detect Defense Evasion techniques without access to external signature databases. Once privileges are obtained, an attacker primarily attempts to modify local event logs.
This is why the NIST Cybersecurity Framework (CSF) 2.0 introduces the Govern function, which emphasizes the importance of cyber risks as an integral part of corporate governance. Proper log management becomes the foundation for implementing the Detect function.
Log collection architecture per NIST SP 800-92 in closed circuits
NIST SP 800-92 guidelines serve as the methodological basis for building log collection and management processes in an isolated environment. The log lifecycle covers generation, transmission, storage, and analysis, each of which is adapted to the requirements of a closed circuit.
The number of log sources in large B2G systems can reach thousands of units. This requires deploying a hierarchical structure of collectors that aggregate events from operating systems, network equipment, and application software. It should be remembered that the presence of logs does not equal the presence of a full-fledged SOC (Security Operations Center) — the collected data requires systematic analysis.
Log retention time in critical infrastructure is often regulated by compliance requirements and ranges from 1 to 3 years for retrospective analysis. This requires designing high-capacity local storage with a clear separation into hot (for fast search) and cold (write-protected archive) tiers.
Audit data protection: the role of Row-Level Security (RLS) and ACL at the application level
Audit data security relies entirely on internal access control mechanisms. If a database administrator has full rights, the integrity of the audit is at risk. To prevent unauthorized changes, Row-Level Security (RLS) and Access Control Lists (ACL) are applied at the application software level.
RLS allows for restricting access to sensitive records at the database level, while ACL ensures that application system administrators do not have rights to delete or modify audit logs.
An example of a technological foundation for such tasks is the low-code platform UnityBase, a joint development by companies within the Intecracy Group alliance, where InBase is a key developer. Solutions built on this platform, such as Megapolis.DocNet and Scriptum, use the built-in mechanisms of the UnityBase platform to ensure strict auditing. Thanks to the use of Domain metadata and built-in RLS/ACL, systems reliably record user actions. For projects with high loads or increased security requirements, official documentation recommends using Enterprise or Defence editions of UnityBase, which allow for non-repudiable auditing directly at the system kernel level.
Unidirectional data transmission (data diodes) as a secure aggregation tool
In air-gapped networks, it is critical to securely transfer logs from a protected segment to a monitoring segment without violating isolation. Any bidirectional connection creates a risk of a reverse attack.
The solution is to use unidirectional gateways (data diodes) for log transmission. In such an architecture, centralized event collection from application systems (ERP/ECM) is configured directly into an audit database isolated from external access. Then, via a data diode, data is broadcast to a local SIEM collector, which makes it physically impossible to transmit malicious commands back into the critical circuit.
Mapping detections to MITRE ATT&CK with limited signature updates
Since an isolated SIEM does not have access to cloud-based indicators of compromise databases, there is a need for manual correlation rule management (offline threat modeling). MITRE ATT&CK is used to structure detections and map attacker behavior into a matrix of tactics and techniques.
The focus shifts from searching for known signatures to detecting anomalous behavior of legitimate administrative tools. SIEM rules are adapted to local threats such as:
- Attempts to clear or modify local event logs.
- Creation of new accounts or privilege escalation in a closed circuit.
- Anomalous access activity to file storage or databases.
Log architecture readiness checklist for air-gapped networks
- Separation of duties: application system administrators do not have rights to modify or delete audit logs (ACL).
- Application software supports Row-Level Security (RLS) to restrict access to sensitive records at the database level.
- Log transmission to the SIEM segment is performed via unidirectional gateways (data diodes) to prevent reverse attacks.
- Local SIEM storage is designed for long-term retention (1 to 3 years) in accordance with regulatory requirements.
- SIEM correlation rules are adapted to local threats and updated regularly in manual mode (offline packages).
FAQ
How can correlation rules and signatures be updated in a SIEM without internet access?
Updating correlation rules in an isolated environment is performed by importing offline packages. Packages are downloaded in an external network, verified, copied to an authorized medium, and transferred into the closed circuit in accordance with strict change control policies.
Can local logs be considered secure if the database administrator has full access to them?
No. If a database administrator has privileges to edit or delete audit tables, log integrity cannot be guaranteed. Security requires the use of application software with built-in RLS and ACL mechanisms (e.g., based on the UnityBase platform), which performs logging at the system kernel level and makes it impossible to hide traces.
How can security event transmission be configured via a data diode without losing isolation?
The architecture involves collecting logs from application systems (ERP/ECM) into an internal audit database, from which events are broadcast to the isolated monitoring segment through a hardware-based unidirectional gateway (data diode). This ensures a data flow in one direction only, making reverse attacks physically impossible.
Expert comment