An air gap is a security measure in which a computer or network is physically isolated from the internet and other untrusted networks, with no wired or wireless connection to them.
How air gaps work
An air-gapped system has no network path to the outside world. Data can only be moved by physical means – USB drives, optical discs or dedicated one-way devices called data diodes. Air gaps are used for military and classified networks, industrial control systems, nuclear and energy facilities, payment and voting systems, cryptographic key storage and offline backups.
Why air gaps matter – and how they are bypassed
Isolation removes the main attack surface, but it is not absolute. Removable media and human behaviour are the weak points:
- Stuxnet (discovered in 2010) is believed to have reached the air-gapped Natanz uranium enrichment facility in Iran on infected USB drives, then sabotaged centrifuges.
- Agent.btz (2008) – a worm spread via a USB drive into US military networks, prompting the clean-up operation Buckshot Yankee and a ban on removable media.
- Espionage frameworks such as those attributed to the Equation Group and later APT tools have used hidden storage on USB drives to carry data across the gap.
Researchers, notably at Ben-Gurion University in Israel, have also demonstrated covert channels that exfiltrate data from air-gapped computers through fan noise, LED blinking, electromagnetic emissions and heat – a form of side-channel attack. These channels are slow and require malware to be planted first. In practice, many “air-gapped” networks have hidden connections such as maintenance laptops or remote vendor access.
Best practices
- Strictly control and scan removable media; use dedicated transfer stations.
- Use data diodes where data must flow in one direction only.
- Regularly verify that no undocumented connections exist.
- Apply physical security and monitoring inside the isolated network too.
