Network segmentation and air gapping both reduce unwanted communication, but they act at different layers. Segmentation keeps systems connected and applies policy to traffic. An air gap removes the automated path itself. The right choice is rarely ideological: it depends on required data flows, operational frequency, failure consequences and the organisation's ability to manage each control.
For most enterprise environments, well-designed segmentation is the foundation. Physical isolation becomes interesting at selected boundaries where continuous reachability delivers little value, a configuration failure would have serious consequences, or the protected system cannot safely participate in a modern connected security stack.
Key takeaways
The short version
- Segmentation controls traffic on connected infrastructure; an air gap removes the continuous path.
- Logical controls are more flexible and observable, while physical isolation can reduce dependence on configuration.
- High-consequence environments often use both controls at different layers.
- Operational usability determines whether either design remains effective over time.
What network segmentation provides
Segmentation divides a network into zones and controls communication between them. Technologies include routed subnets, VLANs, internal firewalls, access-control lists, software-defined policies and host firewalls. A good design starts from required flows and denies communication that has no business purpose.
Its main advantage is precision. Teams can allow a specific protocol between known endpoints, inspect traffic, collect logs and change policy without visiting a site. Segmentation also scales to environments that need frequent communication. The tradeoff is dependency: switches, firewalls, identity systems, rule sets and management planes all need correct configuration and protection.
What physical isolation changes
Physical isolation changes the default from policy-restricted connectivity to no available network path. Software cannot route through a break that is physically open. That property can simplify the question of reachability at one specific boundary, especially when access is exceptional rather than continuous.
The simplicity is local, not universal. A physical control still needs secure authorisation, reliable hardware, installation procedures, status feedback and a response when the control fails. If people routinely work around it, the theoretical assurance disappears.
Comparing the controls
Segmentation is generally better for granular, high-frequency communication. It supports many applications and can enforce detailed policy while preserving availability. Physical isolation is stronger at expressing one coarse rule: the path is absent unless deliberately created.
During an active connection window, the physically isolated boundary becomes connected and needs the same logical protections as any other network. This is why the controls should often be combined rather than treated as alternatives. A firewall can restrict the flows available during a window, while the physical layer removes the path outside that window.
- Choose segmentation for continuous, well-defined business communication.
- Consider physical isolation for infrequent access to high-consequence assets.
- Use both when a temporary connection still requires granular enforcement.
- Avoid designs whose daily operation encourages bypasses or undocumented exceptions.
Failure modes to include in the decision
Logical controls can fail through permissive rules, routing changes, credential compromise, management-plane access or unnoticed dependencies. Physical controls can fail through incorrect cabling, hardware defects, insecure control channels, misunderstood status or permanent manual bypass. Neither category is automatically fail-safe.
The evaluation should ask what happens after power loss, control-channel loss, firmware failure and emergency maintenance. It should also define how operators independently verify the connection state. Evidence matters: a dashboard should reflect the physical state rather than merely the requested state.
A practical selection framework
Map each communication path, then classify it by frequency, data volume, latency tolerance, safety impact and consequence of compromise. Continuous plant telemetry and a monthly vendor-maintenance session should not receive the same design. Apply the least complex control that can reliably enforce the required state.
AIRGAPNET can support the second pattern by making the Ethernet path physically disconnected outside authorised windows. It should be evaluated alongside existing segmentation, identity, monitoring and operational procedures rather than installed as an isolated security decision.
Validate the boundary before rollout
Pilot the control on one well-understood path. Capture normal traffic before the change, agree acceptance criteria with the system owner and observe at least one complete operating cycle. The pilot should test ordinary work, failed authorisation, expired windows and restoration after power or communication loss.
Use the result to update diagrams, procedures and support responsibilities. A review involving network, security, application and operations teams often finds dependencies that no single team could see. Expand only after the organisation can explain both the protection gained and the work needed to keep the boundary reliable.
Decision checklist
Questions to resolve before implementation
- List required source, destination, protocol and timing for every flow.
- Measure the consequence of accidental or malicious continuous reachability.
- Compare logical and physical failure modes, including human workarounds.
- Define protections that remain active during authorised connection windows.
- Test how operators verify and recover the intended state.
- Review the design after network, application or process changes.
Common questions
Questions teams ask first
Is an air gap always more secure than segmentation?
No. It removes selected network paths, but it can introduce operational and transfer risks. The stronger design is the one that fits required communication and can be operated consistently, with other controls covering the remaining attack paths.
Can a firewall create an air gap?
A firewall can deny traffic, but the infrastructure remains physically connected and the result depends on policy and correct operation. That is logical isolation, not a strict physical air gap.
Should OT networks use both?
Often yes. Segmentation supports necessary operations inside and between zones, while physical isolation can protect selected boundaries that only need occasional connectivity. Safety, availability and vendor requirements must be assessed for each environment.
Official references