What does air-gapped mean in cybersecurity?

Air-gapped means a computer or network is physically isolated from all external networks — including the internet, corporate intranets, and wireless connections. No cable connects it to the outside world, and any logical connection is entirely manual. NIST defines an air gap as an interface between two systems where they are not physically connected and any data transfer occurs manually under human control.

How is data transferred to an air-gapped system?

Data reaches an air-gapped system exclusively through manually handled physical media — typically USB drives, optical discs (DVDs or Blu-ray), or paper printouts. The media is prepared on an external machine, physically carried across the air gap, and loaded into the isolated system by an authorized operator. This manual process is the source of both the security and the operational friction of air-gapped environments.

Can air-gapped systems be hacked?

Yes. While air gaps significantly raise the bar for attackers, academic researchers and nation-state threat actors have demonstrated multiple covert channels that leak data from physically isolated systems. Techniques include acoustic attacks (using speakers or fan noise to transmit data via ultrasonic signals), electromagnetic emissions (AirHopper, TEMPEST-class attacks), heat-based channels, and USB firmware implants introduced through the manual transfer process itself.

What is a data diode?

A data diode is a hardware device that enforces unidirectional data flow — it physically allows data to pass in only one direction and makes reverse flow impossible at the hardware level. Data diodes are used to connect air-gapped operational technology (OT) networks to monitoring systems without creating a bidirectional connection that an attacker could exploit. Unlike firewall rules, which are software-enforced, a data diode's hardware design prevents backflow even if software is compromised.

What systems typically use air-gap security?

Air-gapped systems are used in environments where a breach would have catastrophic consequences: nuclear facility control systems (classified networks in nuclear plants), military classified networks (SIPRNet and SAP networks), voting systems, some cryptocurrency cold storage setups, critical infrastructure SCADA systems for power grids and water treatment, and high-security certificate authority (CA) offline root keys in public key infrastructure.

Is air-gapped security still effective against modern threats?

Air gapping remains one of the strongest isolation controls available, but it is not absolute. It is highly effective against remote network-based attacks. Its primary vulnerabilities are the manual data transfer process (USB-borne malware like Stuxnet's initial infection vector), insider threats, supply chain compromises in hardware, and sophisticated covert-channel attacks. Modern best practice treats air-gapped environments as one layer in a defense-in-depth strategy, not as a standalone guarantee.

What Is Air-Gapped Security? Isolation, Risks, and Use Cases

Introduction

In June 2010, a USB drive carrying the Stuxnet worm was inserted into a computer at an Iranian uranium enrichment facility. The plant’s centrifuge control systems were air-gapped — completely disconnected from the internet and any external network. Yet Stuxnet silently propagated, found its target PLCs, and destroyed roughly 1,000 centrifuges over several months before anyone noticed. The attack did not break the air gap; it bypassed it through the one pathway that air-gapped systems cannot eliminate: the human-controlled data transfer process. Air-gapped security remains one of the most powerful isolation controls available — but it has never been, and cannot be, a complete solution on its own.

What Is Air-Gapped Security?

Air-gapped security is a network isolation strategy in which a computer or network has no physical connection to any external network — including the public internet, corporate intranets, and wireless systems. The “air gap” is the literal empty space between the isolated system and everything outside it. NIST formally defines an air gap as an interface between two systems at which they are not physically connected and where any data transfer occurs manually, under deliberate human control.

An air-gapped system does not have:

A network cable connected to any external network
A wireless radio (Wi-Fi, Bluetooth, cellular) that is enabled
An automated data replication channel to external storage

The only way data enters or leaves is through human action — someone physically carries a USB drive, optical disc, or paper from the isolated system to an external system (or vice versa). This manual process is both the security mechanism and the operational bottleneck.

Air-gapped environments are distinct from network segmentation (which isolates networks logically via firewalls while maintaining some physical path) and from unidirectional gateways (which allow automated, hardware-enforced one-way data flow). All three are related isolation strategies at different points on the spectrum.

How Air-Gapped Security Works

A properly implemented air gap follows a four-layer model that addresses both the physical isolation and the operational procedures needed to maintain it.

Layer 1 — Physical isolation. The isolated network is in a physically controlled space — often a locked room with monitored access. All network interfaces on machines in the air-gapped zone are either physically removed or disabled at the hardware level. Network ports are physically blocked. Wireless hardware is removed from the motherboard, not merely disabled in software.

Layer 2 — Controlled data transfer. All software, updates, and operational data that must enter the air-gapped environment pass through a sanitation workstation — a dedicated machine that scans and validates media before it is permitted into the isolated zone. This station uses separate malware scanning tools, file type whitelisting, and sometimes one-way data diodes to pass read-only files.

Layer 3 — Data diode (one-way gateway). For environments that need continuous monitoring data to flow out of the OT network without creating a bidirectional connection, a data diode provides hardware-enforced unidirectional flow. A data diode is a hardware device that transmits signals in one direction using an optical or electronic pathway that physically cannot carry return signals. The isolated network can push telemetry out; no signal can travel back in.

Layer 4 — Operational procedures. The technical controls mean nothing without rigorous human procedures: maintaining a log of every media item that crosses the boundary, restricting which personnel can bring devices into the zone, establishing chain of custody for removable media, and conducting regular audits of what is connected to isolated systems.

A properly implemented air gap uses physical isolation, a sanitation workstation for incoming media, and a data diode for outbound monitoring — the only automated data path is one-way outbound.

Air-Gapped vs Network Segmented vs Data Diode

Approach	Connection Type	Data Path	Enforced By	Typical Use
Air gap	None (physical)	Manual only	Physical absence	Nuclear, military, voting
Network segmentation	Physical, controlled	Bidirectional via firewall	Software/policy	Industrial DMZ, corporate segmentation
Data diode	Unidirectional hardware	One-way outbound only	Hardware physics	OT monitoring, classified outbound feeds
Cross-domain solution	Controlled bidirectional	Filtered bidirectional	Hardware + software	Intelligence community, DoD

Air gaps provide the strongest isolation but the highest operational friction. Network segmentation is easier to operate but depends on firewall policy — software that can be misconfigured or exploited. Data diodes thread the needle: they allow automated monitoring data to flow out of an OT network toward a SOC (Security Operations Center) without creating any path for inbound attack traffic. They are the preferred architecture for critical infrastructure where both isolation and visibility are required. For organizations whose encryption key management demands the highest security tier, offline HSMs in air-gapped environments provide the strongest possible protection for root keys.

Watch to understand how data diodes provide hardware-enforced unidirectional data flow, bridging the gap between air-gapped OT security and the monitoring visibility that modern security teams need.

Real-World Use Cases

Nuclear facility control systems. The control systems managing reactor operations at nuclear power plants are among the most comprehensively air-gapped systems in existence. Physical access controls, media management procedures, and personnel vetting form concentric layers around the control network. The U.S. Nuclear Regulatory Commission mandates cyber defense measures for nuclear facilities that effectively require air-gapping the most critical control functions from any outside network, even operator corporate networks.

Certificate Authority offline root keys. Major public key infrastructure (PKI) operators — including the root CAs that underpin TLS and code signing — keep their offline root signing keys on hardware security modules that are never connected to any network. The root CA generates and signs intermediate certificates during rare, carefully logged ceremonies conducted in physically secure facilities, then returns the HSM to offline storage. The root key itself is air-gapped for its entire operational life.

Cryptocurrency cold storage at scale. Exchanges and custodians managing billions of dollars in digital assets maintain signing keys on hardware wallets or custom HSMs that are never connected to the internet. Transaction signing occurs on an air-gapped machine; the signed transaction is transferred to an online machine via QR code or USB, then broadcast. Even a complete compromise of the exchange’s online infrastructure cannot reach the signing keys.

Military and intelligence classified networks. The U.S. Department of Defense maintains separate classified networks — SIPRNet and Joint Worldwide Intelligence Communications System (JWICS) — that are physically isolated from the unclassified NIPRNet. Data passes between classification levels only through accredited cross-domain solutions that apply mandatory access controls and content filtering at hardware boundaries. These are not simple firewalls; they are dedicated hardware appliances audited for their cross-domain security properties.

Common Mistakes to Avoid

Assuming air gapping alone is sufficient. Stuxnet, USBFerry, and multiple classified nation-state operations have demonstrated that air-gapped networks are regularly compromised — specifically through the media transfer process. An air gap limits the initial attack vector to the physical layer; it does not eliminate insider threats, supply chain compromises in hardware, or the risk of malicious media entering through the sanitation process.

Ignoring electromagnetic emissions (TEMPEST). Declassified NSA research dating to the 1960s established that computers emit electromagnetic signals that can be captured at a distance and used to reconstruct screen content or keystrokes. Modern research (AirHopper, 2014; GSMem, 2015; PowerHammer, 2018) demonstrated that air-gapped systems can be exfiltrated via radio emissions from display cables, RAM bus signals, and power line fluctuations. High-security air-gapped environments require TEMPEST-shielded hardware and facilities.

Relaxing controls for convenience. The most common failure mode in air-gapped environments is “temporary” connections that become permanent — a laptop briefly connected to both networks for a patch, a cellular modem installed for “emergency” monitoring. Once an air gap is bridged, even temporarily, the isolation guarantee is broken. Treat every connection request to an air-gapped system with the same scrutiny as a network penetration attempt.

Not implementing data encryption inside the air gap. An air gap protects against external network attacks. It does not protect against an insider who physically removes storage media. Data at rest on air-gapped systems must still be encrypted with strong keys — a stolen hard drive from an air-gapped nuclear plant should yield nothing to an attacker. Pair air gap isolation with full disk encryption on every machine in the isolated zone.

Getting Started with Air-Gapped Security

Define your threat model explicitly. Air gaps are extreme measures justified by extreme threat models: nation-state adversaries, catastrophic failure consequences, and data where no remote risk is acceptable. For most organizations, the operational overhead of a true air gap is not justified — network segmentation and encryption at rest and in transit cover the vast majority of threat scenarios at far lower operational cost.

If you need an air gap, design the media sanitization process first. The transfer boundary is your highest-risk point. Define exactly what media types are permitted, who can authorize transfers, what scanning process every item must pass, and how media is tracked from preparation through insertion and destruction. Document this process and treat violations as security incidents.

Deploy data diodes for OT monitoring. If you operate industrial control systems or critical infrastructure that requires security monitoring, implement data diodes at the boundary rather than bridging the air gap with a bidirectional firewall. Reference CISA’s Cross-Domain Solutions guidance and NIST SP 800-82 Rev. 3 for OT security architecture recommendations that specify how to achieve both isolation and visibility.

Plan for TEMPEST where warranted. For classified government or defense environments, consult NSA/CISA TEMPEST requirements. Even for non-government high-security environments, consider physical shielding for the most sensitive systems — particularly any machine that handles cryptographic key material or generates regulatory-sensitive output. Pairing air gap isolation with hardware security modules for all cryptographic operations ensures that even if a covert channel leaks some information, the most valuable secrets (private keys, credentials) remain in hardware-protected storage inside the isolated zone.