UK How an air gap works
An air-gapped computer has no connection to the internet or to any network that is not equally trusted. The “gap” is literal: there is air, not a cable or a radio link, between it and the outside world. An air-gapped network applies the same idea to a group of machines that talk only to each other.
Because there is no network path, remote attacks such as phishing links, exposed services and ransomware spreading across a network cannot reach the system. Anyone wanting to move data on or off has to carry it, usually on a USB drive, optical disc or dedicated transfer device, and that step can be controlled, logged and inspected.
The term is also used in plumbing and electronics for a physical clearance. This page covers the computing and networking meaning.
Where air-gapped systems are used
Air gaps cost convenience: no remote access, no automatic updates and slower data transfer. They are used where the consequence of a breach outweighs that cost.
-
//
Defence and government. Classified networks are kept separate from the internet, and mission systems on military vehicles, ships and aircraft often run as closed networks.
-
//
Industrial safety and control. Safety instrumented systems and some control networks in energy, water and process plants are kept isolated, or connected only through one-way links.
-
//
Offline backups. A backup copy with no network link cannot be encrypted or deleted by ransomware on the main network.
-
//
Key storage and signing. Certificate authorities, code-signing systems and cryptocurrency cold wallets keep private keys on machines that never go online.
-
//
Test and medical equipment. Some laboratory and medical systems run older operating systems that cannot be patched, so isolation is the main protection.
Air gaps compared with other isolation
A full air gap is the strictest option, and many sites use a lighter approach. The international OT security standard IEC 62443 groups systems into zones joined by controlled conduits, and an air gap is the extreme case of a conduit with nothing in it.
| Approach | Network connection | Data flow | Main residual risk | Typical use |
|---|---|---|---|---|
| Air gap | None, wired or wireless | Removable media or manual transfer only | Infected media and insiders | Classified systems, safety controllers, offline backups |
| Data diode | One-way hardware link | Out only, or in only, enforced physically | Whatever is allowed in the permitted direction | Sending plant data out of a protected network |
| Segmented network | Through firewalls between zones | Two-way, filtered by rules | Misconfigured rules and remote access paths | Most OT networks under IEC 62443 |
| VLAN separation | Shared switches, separate virtual networks | Two-way where routed | Switch misconfiguration | Separating traffic types on one site |
NIST SP 800-82, the US guide to operational technology security, makes the same point: true air gaps are rarer than people think, because maintenance laptops, vendor remote access and USB transfers often create paths that nobody drew on the network diagram.
How air gaps are bypassed
The best-known attack on an air-gapped system is Stuxnet, discovered in 2010, which reached isolated uranium enrichment controllers on infected USB drives. Most breaches since have followed the same pattern: the gap held, but something crossed it.
The main risks are infected removable media, compromised software or firmware arriving through the supply chain, insiders, and devices with hidden wireless hardware. Academic researchers have also shown that data can leak out through sound, screen brightness or electromagnetic emissions, but those attacks need malware already running and work only at short range and low speed.
That is why procedures matter as much as hardware: a written transfer process, a dedicated scanning station, staff training and regular audits of what is really connected. An air gap that is checked once at commissioning and never again tends to erode, as engineers add a cable or a modem for convenience.
Building an air-gapped computer
Isolation starts with the hardware. A computer that will never connect should not carry radios, and every port that is not needed should be closed, so the build matters as much as the network design.
-
//
No wireless hardware. Specify the system without Wi-Fi, Bluetooth or cellular modules fitted, rather than relying on software to switch them off.
-
//
Locked ports. Disable unused USB, serial and network ports in the UEFI settings, and protect those settings with a password.
-
//
Verified boot. Use Secure Boot with a TPM 2.0 chip for measured boot and disk encryption, so a tampered image or a stolen drive is detected.
-
//
Controlled transfer. Use dedicated, scanned media or a one-way data diode, and log every transfer.
Quick answers on air gaps
Air-gapped computers: common questions
What does air gapped mean?
Physically disconnected from other networks. There is no cable, wireless or cellular link between the computer and any untrusted network, so the only path in or out is something a person carries.
Can an air gap be bypassed?
Yes, but not easily. Most real attacks crossed on infected USB drives, as Stuxnet did around 2010. Researchers have also shown covert channels using sound, light and electromagnetic emissions, which need malware already inside.
Can you update software on an air-gapped computer?
Yes, offline. Updates are downloaded on a connected machine, checked against the vendor’s published hashes or signatures, scanned, and carried across on dedicated media.
Do air gaps stop ransomware?
They stop it spreading over the network. An air-gapped backup cannot be encrypted by ransomware on the main network, which is why offline copies are a core part of most backup plans.
Is an air gap the same as being offline?
Not quite. A laptop with Wi-Fi switched off is offline but can reconnect in a click. A true air gap removes or disables the hardware, so reconnecting needs physical work.
We build industrial PCs for isolated networks as standard practice, without wireless modules where they are not wanted, with unused ports disabled in firmware and the operating system imaged before the system ships.