An air-gapped network is separated from other networks by the absence of an automated logical connection. In the strict definition used by the NIST CSRC glossary, the systems are not physically connected and data crosses the boundary only manually under human control. In practice, teams also use the term for systems whose network path is physically interrupted except during explicitly authorised access windows.
That distinction matters. A VLAN, firewall rule or disabled software interface can reduce reachability, but each still depends on configuration and software behaviour. Physical isolation changes the default state of the path itself. It can therefore be valuable for assets whose compromise would have disproportionate operational, safety or recovery consequences.
Key takeaways
The short version
- A strict air gap removes both physical connectivity and automated data transfer across the boundary.
- Physical isolation and network segmentation solve related but different problems.
- An air gap does not remove risks from insiders, removable media, supply chains or authorised access periods.
- The strongest designs combine isolation with identity, endpoint, monitoring, backup and operational controls.
What an air gap actually means
The defining property is not a special IP range or a particularly strict firewall policy. It is the absence of a continuously available communication path. If two environments can exchange traffic automatically, they are connected even when rules make that traffic difficult or unlikely.
There are several operating models. A permanently isolated environment never receives a network connection. A manually bridged environment transfers approved data through controlled media. A controlled-connectivity environment introduces a physical network path only for a defined task and removes it again afterwards. These models have different assurance, usability and audit requirements, so an architecture document should name the model precisely instead of relying on the label alone.
Why organisations use physical isolation
Continuous reachability creates opportunities for scanning, credential abuse, remote exploitation and lateral movement. Removing that reachability can reduce the time in which a protected system is exposed to network-borne threats. It can also create a clear operational boundary that is easier to reason about than a large set of changing logical rules.
The control is most useful when the protected asset has a narrow and predictable need for connectivity: a backup target that receives scheduled jobs, an engineering workstation that needs occasional updates, an OT cell that requires planned vendor maintenance, or a management interface used only during approved service windows.
- Reduce unnecessary network exposure for high-consequence assets.
- Limit some paths for lateral movement and automated propagation.
- Make connectivity an explicit operational event rather than a permanent condition.
- Support clearer ownership, approval and logging around access windows.
The practical limits of an air gap
Isolation is not the same as immunity. Malware can arrive through removable media, maintenance laptops, compromised updates or people with legitimate physical access. A protected system can also be vulnerable during an authorised connection. If credentials are weak or the connected endpoint is already compromised, a short window can still be enough for an incident.
Operational failure is another risk. Teams may bypass a control that makes routine work too difficult, or reconnect a cable and forget to remove it. The design therefore needs a usable procedure, clear status indication, tested fail-safe behaviour and a way to verify the actual connection state.
Where physical isolation fits in layered security
A mature architecture uses multiple controls because no single layer covers every attack path. Identity and least privilege govern who may request access. Endpoint protection and hardening reduce risk on the systems at each side. Segmentation controls allowed flows while a path is active. Monitoring provides evidence of what happened. Tested backups support recovery when prevention fails.
AIRGAPNET is designed for the connectivity layer: a real Ethernet path can remain physically interrupted by default and be enabled only when access is needed. Its independent control path is intended to keep the authorisation mechanism separate from the protected Ethernet connection. Whether that pattern is appropriate depends on the system, safety constraints, threat model and operating process.
Good candidate use cases
Start with systems that are both valuable and unnecessarily reachable. The business owner should be able to explain why the system needs a network connection, how often it is used and what must happen before the path is opened. If the answer is continuous, high-volume communication, a physical break may be the wrong primary control. If the answer is a short, auditable maintenance or transfer window, it may be a strong candidate.
- Offline or isolated backup and recovery infrastructure.
- Privileged administration and security management systems.
- OT assets with planned maintenance periods.
- Legacy systems that cannot be hardened or patched quickly.
- High-value research, engineering or intellectual-property environments.
Decision checklist
Questions to resolve before implementation
- Identify the exact systems and network paths to be isolated.
- Document every legitimate reason and schedule for reconnection.
- Define who can authorise access and how approval is recorded.
- Secure removable media, update packages and maintenance endpoints.
- Test failure, recovery and emergency-access procedures.
- Monitor the environment while connectivity is active.
Common questions
Questions teams ask first
Is a VLAN an air gap?
No. A VLAN is a logical segmentation mechanism running on connected infrastructure. It can be an important control, but it does not create the absence of a physical or automated logical connection required by a strict air-gap definition.
Can an air-gapped system still be compromised?
Yes. Removable media, insiders, supply-chain compromise, malicious updates, maintenance equipment and mistakes remain relevant. Isolation reduces selected network attack paths; it does not eliminate the need for other controls.
Does an air gap have to be permanent?
A strict air gap is continuously disconnected. Some organisations also use controlled physical isolation, where a path is enabled for an approved task and removed afterwards. The temporary model should be described accurately and governed as a connected state during each access window.
Official references