An air gap is the deliberate separation of a system or network from all other networks — literally a gap of air: no cable connection, no WLAN, no routing. What is not reachable cannot be attacked remotely. Classic fields of use are offline backups, highly critical OT plants and especially sensitive environments.
In practice, logical air gaps dominate today: separation through strict segmentation, unidirectional gateways or temporary connections opened only for defined operations. They trade absolute isolation for operability — and are only as strong as their enforcement.
Physically vs. logically separated
The physical air gap is uncompromising: tape in the safe, offline systems, separate cabling. It protects maximally but turns every data exchange into a manual operation — and exactly there the real weakness arises: USB media and maintenance access have compromised highly isolated plants before. An air gap therefore needs strict media and maintenance processes.
The logical air gap separates by architecture: dedicated credentials and administration domain, no trust relationships, connection initiated only from inside and only for defined time windows — say when the backup repository fetches data and decouples afterwards. Combined with immutability, this yields a backup copy an attacker in the network can neither find nor change.
Where air gaps are used
- Backup: the last copy offline or logically decoupled — core of modern 3-2-1-1-0 strategies.
- OT/production: highly critical control networks without direct connection to IT — transitions only controlled.
- High-security areas: development of sensitive goods, authorities, forensics workstations.
- Key management: offline CAs and hardware security modules beyond any network reach.