What is an air gap?
An air gap is a design in which a system or network has no wired or wireless connection to any other network. There is, in effect, only air between it and the outside world. The only way data gets in or out is by someone physically moving it, usually on removable media. Air gaps protect systems where a remote compromise would be unacceptable, such as classified government networks, some safety and industrial control systems, offline root certificate authorities, and offline backup copies kept out of ransomware's reach.
What an air gap stops, and what it does not
An air gap removes the network path, so internet scanning, malware that calls home and remote exploitation have nothing to connect to. It does nothing about people and objects that cross the gap, and real compromises of isolated networks nearly always come through them:
- Removable media: USB drives, external disks and optical discs carrying malware in, or data out.
- Transient devices: vendor or maintenance laptops that touch the internet one day and the isolated network the next.
- Hidden bridges: an undocumented cellular modem, a workstation with one network card on each side, or Wi-Fi or Bluetooth left enabled.
- Supply chain: equipment, firmware or software that arrives already compromised.
- Insiders who copy data out deliberately.
Researchers have also shown covert channels that leak data from air-gapped machines through sound, light, heat or electromagnetic emissions, but these require malware already inside and move data slowly.
Example: Stuxnet
Stuxnet, discovered in 2010, targeted the uranium enrichment plant at Natanz in Iran, whose control systems had no internet connection. Investigators concluded that it most likely arrived on infected USB drives, exploiting a Windows shortcut file flaw that ran code when a drive's contents were displayed. Inside, it spread to the engineering systems and reprogrammed Siemens controllers to damage centrifuges while feeding operators normal-looking readings. The gap itself was never breached; the threat was carried across it.
Controlling what crosses the gap
- Allow only approved, inventoried and encrypted media, and scan every file at a dedicated standalone station before it goes in.
- Disable USB storage by policy, or physically block the ports, on isolated systems.
- Keep maintenance laptops dedicated to the isolated environment; they never leave it.
- Use a data diode when data must flow out continuously, such as plant readings for a business system.
- Inspect physically for undocumented links, and remove or disable wireless hardware.
- Plan patching and log review, because updates have to be carried in by hand and isolated systems tend to fall behind.
Air gap vs. segmentation vs. data diode
Logical segmentation separates traffic on shared hardware with VLANs, ACLs and firewall rules, so a single configuration error can join segments. Physical segmentation uses separate hardware but may still link segments through a filtering device. An air gap is the extreme form of physical separation, with no link at all. A data diode is a controlled exception: a physical link that lets data move in only one direction.
Air gap on the CompTIA Security+ exam
Air-gapped networks are among the architecture choices in SY0-801 objective 3.1, where physical isolation is compared with logical segmentation, and offline or air-gapped backups appear with resilience and recovery in objective 3.4. Wording such as must have no connection to any other network points to an air gap. If malware turns up on an isolated network, expect the cause to be removable media, a maintenance laptop or a hidden connection, not a remote exploit. The trap answer assumes an air-gapped system needs no patching, monitoring or media controls. If the scenario needs data to leave an isolated network continuously with nothing coming back, the answer is a data diode rather than a full air gap.