Background: air-gapped systems

An air gap, air wall, air gapping or disconnected network is a network security measure employed on one or more computers to ensure that a secure computer network is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. It means a computer or network has no network interface controllers connected to other networks, with a physical or conceptual air gap, analogous to the air gap used in plumbing to maintain water quality.

Use in classified settings

An air-gapped computer or network is one that has no network interfaces, either wired or wireless, connected to outside networks. Many computers, even when they are not plugged into a wired network, have a wireless network interface controller (WiFi) and are connected to nearby wireless networks to access the Internet and update software. This represents a security vulnerability, so air-gapped computers have their wireless interface controller either permanently disabled or physically removed.

To move data between the outside world and the air-gapped system, it is necessary to write data to a physical medium such as a thumbdrive, and physically move it between computers. Physical access has to be controlled. It is easier to control than a direct full network interface, which can be attacked from an exterior insecure system and, if malware infects the secure system, can be used to export secure data.

For this reason, some new hardware technologies are also available, like unidirectional data diodes or bidirectional diodes (also called electronic airgaps), which physically separate the network and transportation layers and copy and filter the application data.

In environments where networks or devices are rated to handle different levels of classified information, the two disconnected devices or networks are referred to as low side and high side, low being unclassified and high referring to classified, or classified at a higher level. This is also occasionally referred to as red (classified) and black (unclassified).

Access policies are often based on the Bell–LaPadula confidentiality model, where data can be moved low-to-high with minimal security measures, while high-to-low requires much more stringent procedures to ensure protection of the data at a higher level of classification. In some cases (for instance, in industrial critical systems), the policy is different: data can be moved from high to low with minimal security measures, but moving from low to high requires a high level of procedural safeguards to ensure the integrity of the industrial safety system.

The concept represents nearly the maximum protection one network can have from another (save turning the device off). One way to transfer data between the outside world and the air-gapped system is to copy data on a removable storage medium such as a removable disk or USB flash drive and physically carry the storage to the other system. This access still has to be carefully controlled since a USB drive may have vulnerabilities (see below).

The upside to this is that such a network can generally be regarded as a closed system (in terms of information, signals, and emissions security), unable to be accessed from the outside world. The downside is that transferring information (from the outside world) to be analyzed by computers on the secure network is extraordinarily labor-intensive, often involving human security analysis of prospective programs or data to be entered onto air-gapped networks and possibly even human manual re-entry of the data following security analysis.

Examples

Many of these systems have since added features that connect them during limited periods of time to the organisation's intranet (for the need of surveillance or updates) or the public internet, and are no longer effectively and permanently air gapped, including thermostats with internet connections and automobiles with Bluetooth, Wi-Fi and cellular phone connectivity.

Limitations

Limitations imposed on devices used in these environments may include a ban on wireless connections to or from the secure network, or similar restrictions on EM leakage from the secure network through the use of TEMPEST or a Faraday cage.

Despite a lack of direct connection to other systems, air-gapped networks have been shown to be vulnerable to attack in various circumstances.

Scientists in 2013 demonstrated the viability of air gap malware designed to defeat air-gapped isolation using acoustic signaling. Shortly after that, network security researcher Dragos Ruiu's BadBIOS received press attention.

Software updates

From a security perspective, a major drawback of an air-gapped network is the inability of software to automatically self update. Users and system administrators must instead download and install updates manually. If a strict update routine is not followed, this results in out-of-date software running on the network, which may contain known security vulnerabilities.

If an adversary manages to gain access to the air-gapped network (for instance, by contacting a disgruntled employee or using social engineering) they may be able to quickly spread within the air-gapped network using such vulnerabilities with a possibly higher success rate than on the public Internet.

System administrators may manage software updates in an air-gapped network using dedicated solutions such as Windows Server Update Services or network logon scripts. Such mechanisms would allow all computers on the air-gapped network to automatically install updates after the system administrator downloads the updates from the Internet once. The problem is not completely eliminated, though, especially if users have administrative privileges on their local workstations and are therefore able to install software that is not centrally managed.

The presence of IoT devices requiring firmware updates can also complicate matters, since often such updates cannot be centrally managed.