📖 What is Air Gap?
Air Gap is a security measure that ensures a computer or network is physically isolated from all other networks, including the internet. This creates a physical barrier that prevents remote attacks, making it essential for highly sensitive systems like industrial control systems.
"While air gaps prevent remote hacking, they are still vulnerable to 'sneakernet' attacks via USB drives or other portable media. This is a common test point."
📚 Certification: CompTIA Advanced Security Practitioner+ (CAS-004)
🔑 What are the Key Concepts of Air Gap?
- ▸ Physical Isolation: Complete lack of network connectivity, including wireless, to eliminate remote attack vectors and prevent unauthorized data exfiltration from sensitive systems.
- ▸ High-Security Application: Primarily used in SCADA, ICS, and classified government networks where the risk of remote exploitation outweighs the need for connectivity.
- ▸ Sneakernet Risks: The reliance on physical media like USB drives for updates creates a vulnerability where malware can be manually introduced to the system.
- ▸ Operational Overhead: Air-gapped systems require manual patching and maintenance, which can lead to outdated software if strict physical update procedures are not followed.
- ▸ Side-Channel Exfiltration: Advanced threats may use electromagnetic, acoustic, or thermal emissions to bridge the gap and steal data without a traditional network connection.
🎯 How does Air Gap appear on the CAS-004 Exam?
You may be asked to select the most robust security control for a critical infrastructure system that must be entirely protected from remote network-based exploitation, while identifying the remaining risk associated with physical media.
A scenario might describe a high-security environment where a system is physically isolated; you will be required to identify how malware could still enter the environment via portable storage.
Expect questions regarding the implementation of data diodes to allow one-way data flow out of an air-gapped network, ensuring that no inbound traffic can ever reach the sensitive system.
❓ Frequently Asked Questions
How does an air gap differ from a DMZ or a VLAN?
A DMZ and VLAN provide logical separation via software and hardware configurations. An air gap provides physical separation, meaning there is no physical connection, making it immune to network-based misconfigurations.
Can an air-gapped system be compromised without physical access?
Yes, through highly sophisticated side-channel attacks. These involve monitoring electromagnetic emissions, fan noise, or thermal changes to exfiltrate data, though these are rare compared to USB-based attacks.