An air-gapped network is one kept physically separate from untrusted networks, with no direct connection to the internet or to corporate systems. The separation blocks remote attacks, but data still has to move in and out, so the transfer points become the part of the design that carries the risk.
What the separation actually buys you
The US National Institute of Standards and Technology describes an air gap as a physical separation between systems or networks intended to prevent unauthorised transfer of data. In practice that means no shared cabling, no bridged wireless, no routed path: the isolated environment cannot be reached from a network an attacker can already touch.
That is a genuinely strong control, and it is why air gaps remain standard in the places you would expect. Industrial control systems and operational technology, classified government and defence networks, and parts of critical national infrastructure all use isolation as a foundation.
Isolation exists on a spectrum rather than as an absolute. A physically isolated environment has no network interfaces to the outside at all. A more constrained design permits tightly controlled connectivity through monitored boundaries. The NCSC notes in its guidance on privileged access workstations in operational technology environments that a strict air gap creates real difficulties of its own, because an isolated machine cannot reach the services it needs to stay patched and healthy.
Files still have to cross
This is the part that gets lost when air gaps are described as though isolation were the end of the story. The systems inside are doing work, and work generates traffic in both directions.
Controllers need firmware updates. Engineers need to load configuration changes. Suppliers send drawings, specifications and reports. Maintenance laptops move between environments. Operational data has to come out so somebody can analyse it. None of that stops because there is no cable.
So the files move anyway, usually on removable media, and every crossing is an opportunity. The NCSC is direct about the consequence: USB media is a well-established exploitation route for operational technology networks, as seen in attacks such as Stuxnet, because it provides a route onto the device that avoids network-based controls.
That pattern is well documented. Stuxnet reached Iranian nuclear facilities in 2010 on infected USB drives carried in by people doing routine work. Agent.btz reached classified US military networks the same way. Neither required any clever technique for jumping the gap, because a human being carried the file across on request.
The uncomfortable arithmetic is that isolation does not remove risk so much as concentrate it. You have closed the many remote routes and left a small number of physical ones, and those few now carry everything.
What good looks like at the boundary
The NCSC gives a compact standard for transfers into an operational technology environment. They should be audited, authenticated, automated and inspected, and it is explicit that this includes files arriving from third-party vendors, integrators and suppliers.
Those four words divide the problem up neatly:
- Audited: you can say afterwards what crossed, when and in which direction. A USB stick in a pocket produces no record at all
- Authenticated: you know whose file it is. Supplier files are a recurring weak point precisely because provenance is assumed rather than established
- Automated: the control does not depend on somebody following a procedure correctly at the end of a long shift
- Inspected: the content is checked rather than trusted. This is the one that addresses what is actually inside the file
Two pieces of technology exist specifically to serve this boundary. A data diode provides a connection that can physically only carry traffic one way, which removes the need for anyone to carry media while keeping the return path closed. A cross-domain solution goes further, adding controlled, inspected transfer between networks at different security levels.
Neither examines what is inside a document. A diode guarantees direction; a cross-domain solution enforces policy at the boundary. A spreadsheet with a malicious macro travels through a correctly functioning diode without difficulty, because the diode is doing its job and its job is not that.
That is why inspection is listed separately from the other three. Isolation, direction control and access control all concern where a file may go. Only inspection concerns what the file is, and that is a question about structure and content, not about network topology. A polyglot file that is valid as two formats at once will cross any boundary that is only checking routes and permissions.
Inspection is the fourth word, and the one topology cannot give you. Content disarm and reconstruction rebuilds a document from the components that are safe, so what crosses the boundary is structurally clean rather than merely permitted. See what the Red Eagle Tech CDR API does, with published per-document pricing and self-service signup.
