Air Gap

An air gap is a security design in which a system has no network connection to untrusted networks, including the internet. Data moves in or out only by controlled physical means, such as approved removable media.

Why it matters

If a system cannot be reached over a network, remote attacks against it become much harder. Air gaps are used for industrial control systems, key signing, classified environments and some backup stores. A disconnected, offline backup is also a defence against ransomware that spreads across connected storage.

Example

A certificate authority keeps its root signing key on a machine in a locked room with no network card enabled. To sign a new intermediate certificate, staff carry a scanned request on a checked USB drive to the machine, sign it, and carry the result back under a documented procedure.

Common misconceptions

• "Air-gapped means unhackable." Researchers have shown that infected removable media, insiders and even signals such as sound or electromagnetic emissions can bridge gaps.
• "A firewall equals an air gap." A firewall filters connections; an air gap has none.
• "Once isolated, no updates are needed." Offline systems still need patching and controlled media procedures.

Related

• Backup
• Ransomware
• Firewall
• Private key

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.