📖 What is Air Gap?
An Air Gap is a security measure that ensures a computer or network is physically isolated from all other networks, including the public internet. This is typically used for high-security systems, such as those controlling nuclear power plants or classified government databases.
"To breach an air-gapped system, attackers must rely on physical access or 'bridging' techniques, such as using infected USB drives via HID attacks."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Air Gap?
- ▸ Physical isolation removes all network interfaces, preventing remote attacks by ensuring no electrical or wireless connection exists between the target and the internet.
- ▸ Bridging the gap involves using removable media, such as USB drives or SD cards, to transport malicious payloads into the isolated environment.
- ▸ Side-channel exfiltration utilizes non-traditional communication methods, including electromagnetic emissions, acoustic signals, or LED blinking, to leak data from the system.
- ▸ HID attacks use devices like the Rubber Ducky to emulate keyboards, bypassing traditional security software to execute commands upon physical insertion.
- ▸ Human-in-the-loop requirements mean attackers must rely on social engineering or insider threats to physically introduce a bridge to the isolated network.
🎯 How does Air Gap appear on the PT0-002 Exam?
You may be asked to identify the most effective method for exfiltrating data from a high-security system that has no network connectivity, focusing on side-channel attacks or removable media.
A scenario might describe a target environment with strict physical access controls and no internet connectivity; expect questions on using HID devices like a Rubber Ducky to automate payload delivery.
Expect questions comparing logical isolation, such as VLANs or firewalls, with physical air-gapping to determine which method provides the strongest protection against remote network exploits and unauthorized external access.
❓ Frequently Asked Questions
How does an air gap differ from a DMZ or VLAN segmentation?
A DMZ or VLAN provides logical isolation using firewalls and switches, but the systems remain networked. An air gap is physical isolation, meaning there is no physical cable or wireless link connecting the system to any other network.
Can an air-gapped system be compromised without physical access?
While extremely difficult, it is theoretically possible through sophisticated side-channel attacks or supply chain compromises where the hardware is infected before it ever reaches the secure facility.
What is the primary weakness of an air-gapped security strategy?
The primary weakness is the human element. Attackers use social engineering to trick employees into using infected USB drives or other removable media, effectively bridging the gap.