What is an air gap?
An air gap is a security measure in which a computer or network is completely physically separated from other networks, so that no cable, Wi-Fi, Bluetooth or other wireless connection exists to the internet or the corporate IT network. Data can only reach an air-gapped system through a person physically carrying it across, for example on a USB stick, a DVD or a laptop. As a result the system cannot be reached by remote attackers, and it is strongly protected against malware that spreads over networks.
In the OT world the air gap was long regarded as the defence for industrial control systems. Incidents such as Stuxnet showed that this assumption is too optimistic: an air gap shrinks the attack surface dramatically, but it demands strict procedures for everything that does cross the gap.
🧠 Why would you use an air gap?
An air gap is used where confidentiality, integrity or availability matter so much that no network connection is worth the risk. It protects against:
- Remote attacks - without a route from the internet, an attacker cannot scan, log in or exploit vulnerabilities.
- Self-propagating malware - viruses, worms, ransomware and spyware that jump across networks cannot reach the system.
- Unintended data flows - sensitive data cannot leak by accident through an interface or cloud service.
NIST SP 800-82 Rev. 3 (September 2023), the US guide to OT security, puts it plainly: devices that have no business need to communicate should not be connected. The same guide also states that relying on traditional measures such as air gaps is no longer enough, now that OT is increasingly connected to IT.
🔄 How does an air gap differ from a data diode and segmentation?
The term air gap is used loosely in practice. Strictly speaking, only complete physical separation is an air gap. A firewall or VLAN is network segmentation, even when backup vendors call their isolated storage a “logical air gap”.
| Measure | Connection | Direction of data | Typical use |
|---|---|---|---|
| Air gap | None at all | Manual only (USB, DVD, laptop) | Classified systems, offline backups, stand-alone machines |
| Data diode | Physical, but one-way | Only from inside to outside (or the reverse) | Process data to a historian or SOC, nuclear facilities |
| IDMZ with firewalls | Controlled, two-way | Through proxies and jump hosts | Link between corporate IT and OT following the Purdue Model |
| Network Segmentation | Logically separated | According to firewall rules | Zones and conduits following IEC 62443 |
A data diode is often called an air gap, but it is not one: there is a physical link, it just lets data flow in only one direction, enforced in hardware. A data diode therefore combines much of the protection of an air gap with usable process data outside the plant.
🏭 Where are air gaps used?
| Application | Explanation |
|---|---|
| Nuclear facilities | Safety-critical systems with no connection to external networks; data usually leaves only one-way through a data diode |
| Industrial control systems (ICS) | PLC, SCADA, RTU or DCS systems running fully separate from the corporate network |
| Government and defence | Networks for classified or state-sensitive information |
| Backups | An offline copy that ransomware cannot encrypt, alongside an immutable backup |
| Cryptographic keys | Root CAs and key management used offline only |
| Contingency plans | NIST advises keeping incident response plans on paper or on an offline system |
In practice, fully isolated production networks are rare. Suppliers want remote maintenance, planning wants production figures and quality wants measurement data. Many plants recorded as air-gapped turn out, on inspection, to have a forgotten modem, a 4G router or a dual-homed engineering laptop.
⚠️ How is an air gap bridged anyway?
An air gap is only as strong as the procedures around the people and media that cross it. Well-known examples:
- Stuxnet (discovered in June 2010) - the worm reached the isolated enrichment plant at Natanz via USB sticks and Step 7 project files from contractors, and sabotaged Siemens PLCs there.
- agent.btz (2008) - an infected USB stick at a US military base in the Middle East spread the worm to classified and unclassified networks. The clean-up, Operation Buckshot Yankee, took about fourteen months.
- GoldenJackal (published by ESET in 2024) - this espionage group used dedicated toolsets to steal files from air-gapped systems at a European government organisation via USB sticks, between May 2022 and March 2024.
In addition, researchers at Ben-Gurion University in Israel have demonstrated dozens of covert channels through which malware can leak data from an air-gapped computer: radio signals (AirHopper, 2014), GSM frequencies (GSMem, 2015), power lines (PowerHammer, up to 1,000 bit/s), heat, sound and LEDs. These attacks do assume that the system is already infected and that a receiver is nearby, so for most OT environments the USB stick is the bigger risk.
🔧 How do you implement an air gap responsibly?
An air gap only works as part of defence in depth. A practical approach:
- Inventory every connection - build a complete asset inventory and actively look for modems, wireless adapters and dual network cards. An air gap that nobody checks often exists only on paper.
- Control removable media - use only registered USB sticks and pass everything through a scanning station with several antivirus engines first. See USB Control.
- Manage engineering laptops separately - an engineering station that moves between the office and the plant is the classic bridge. Use fixed, hardened stations that never leave the OT domain.
- Plan updates deliberately - patches and signatures have to be brought in manually. Record who does this, how often and with what verification (hashes, digital signatures).
- Restrict what can run - application whitelisting stops unknown software from starting, even if it arrives on a stick.
- Do not forget monitoring - without a network connection the SOC sees nothing. Collect logs locally or export them through a data diode to a SIEM.
- Train people - awareness among operators, maintenance technicians and suppliers prevents a found USB stick from being tried “just quickly”.
| Point of attention | Without a procedure | With a procedure |
|---|---|---|
| Patches | Years behind, or an unchecked stick from the supplier | Fixed cycle, scanned and hashed files |
| Supplier laptop | Plugged straight into the OT network | Only via a scanning station or a dedicated hardened laptop |
| Logging | No visibility of incidents | Local logging, one-way export |
| Backups | Online and therefore exposed to ransomware | At least one offline copy, tested regularly |
🇳🇱 What does an air gap mean for NIS2 and the Dutch Cybersecurity Act?
The Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, transposes NIS2 into Dutch law. It does not require an air gap, but it does require appropriate measures for, among other things, network security and business continuity. Article 21(2)(c) of NIS2 explicitly mentions backup management and disaster recovery in that context. An offline or air-gapped backup is a common way to demonstrate that business continuity is protected against ransomware.
IEC 62443 does not require an air gap either. The standard works with zones, conduits and security levels; an air gap is the strictest possible separation between two zones, because there simply is no conduit. For most critical infrastructure in the Netherlands, such as drinking water and energy, a fully isolated network is unworkable, so operators choose segmentation with data diodes for the most critical flows.
❗ What are the drawbacks of an air gap?
- Laborious management - updates, licences and configuration changes must be transferred manually, so systems often fall behind.
- Little visibility - log collection, monitoring and incident detection are hard without a network.
- Human error - every physical transfer (“sneakernet”) is a chance of infection or of copying the wrong files.
- False sense of security - organisations that rely on the air gap sometimes invest too little in hardening, detection and incident response.
- No data for optimisation - Industry 4.0 applications need process data that an air gap does not let through.
❓ Frequently asked questions
Is an air gap still secure?
An air gap remains one of the strongest measures against remote attacks, because there is no network route. An air gap is not watertight, however: Stuxnet, agent.btz and GoldenJackal all got in via USB sticks. Its security therefore depends on media policy, hardened workstations and training.
Is a data diode the same as an air gap?
A data diode is not an air gap, because a physical connection exists that lets data through in one direction. A data diode does offer comparable protection against intrusion from outside. That is why it is often chosen when a complete air gap is unworkable.
What is a logical air gap?
A logical air gap is a backup vendors’ term for storage that is reachable only temporarily or through strict access rules. Technically that is network segmentation, not a true air gap. A logical air gap can be useful, but it protects less than a physically disconnected copy.
How do updates reach an air-gapped system?
Updates reach an air-gapped system on controlled media, such as a USB stick or DVD that first passes through a scanning station. Good practice is to verify the origin with hashes or digital signatures and to record who installs the update. Without a fixed procedure, air-gapped systems often fall years behind on patches.
Does NIS2 require an air gap?
NIS2 and the Dutch Cybersecurity Act do not require an air gap. They require appropriate measures for backup management, business continuity and network security, among other things. An offline backup or an air-gapped critical system can help you meet that duty of care.
Can malware steal data from an air-gapped system without USB?
Researchers have shown that malware can leak data from an air-gapped system through radio signals, power lines, heat or sound. These covert channels are slow and require a prior infection and a receiver nearby. In practice, USB sticks and third-party laptops are a much greater risk to an air gap.
📌 In summary
An air gap physically separates a system from all other networks and thereby keeps remote attackers out. In OT a complete air gap is rare, and it is vulnerable to USB sticks, supplier laptops and forgotten connections. Combine the air gap with media policy, hardened engineering stations, offline backups and monitoring, or choose segmentation with a data diode instead.
An air gap is a strong measure for critical infrastructure, but it only protects you if everything that physically crosses the gap is controlled just as strictly.