📖 What is Air Gap?
Air Gap is a security measure that ensures a secure computer network is physically isolated from unsecured networks, such as the public internet or an unsecured local area network. This physical separation prevents remote attacks and unauthorized data exfiltration.
"While highly secure, air gaps are not foolproof; they can be bypassed via physical media like USB drives or side-channel attacks."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Air Gap?
- ▸ Physical isolation ensures no network connection exists, effectively eliminating remote attack vectors and preventing unauthorized external access to highly sensitive systems.
- ▸ Data transfer relies on removable media, creating a 'sneakernet' that introduces risks of malware infection via USB drives or other portable storage.
- ▸ Side-channel attacks can bypass air gaps by exploiting electromagnetic, acoustic, or thermal emissions to leak data to a nearby listening device.
- ▸ Air gaps are typically implemented in high-assurance environments, such as SCADA systems, nuclear facilities, or classified government networks, to maximize security.
🎯 How does Air Gap appear on the CISSP Exam?
You may be asked to identify the most effective security control for preventing remote exploitation of a critical system where network connectivity is not required for operation, requiring you to distinguish between logical and physical isolation.
A scenario might describe a secure facility using removable media to update software on an isolated system; you must identify the primary risk introduced by this process, specifically the potential for malware introduction via 'sneakernet'.
❓ Frequently Asked Questions
How does an air gap differ from a strictly configured firewall?
A firewall provides logical isolation by filtering traffic based on rules, but the physical connection remains. An air gap provides physical isolation, meaning there is no cable or wireless link, removing the possibility of network-based remote attacks entirely.
What is a data diode and how does it relate to air gaps?
A data diode is a hardware device that allows data to flow in only one direction. It provides a compromise between a full air gap and a network connection, allowing monitoring without risking inbound attacks.