Airgapping

Airgapping means: a computer or an entire network is physically separated from the outside world — no internet cable, no WiFi connection, no Bluetooth interface. The name comes from the English and literally describes a gap of air between two systems. Data only comes in or goes out when a human actively transfers it, for example on a USB stick or a DVD. This is not security software but a structural decision.

Protection through physical unreachability

Network attacks work like this: an attacker sends data packets to a target and waits for a response. If the target is not connected anywhere, no packets can arrive. An air-gapped system is therefore completely immune to the vast majority of attacks from the internet — not because it is well secured, but simply because it cannot be reached.

That sounds like a simple solution, but it comes at a high price. A disconnected system cannot receive automatic updates, cannot send data to the cloud, and cannot communicate with other systems. The security gain and the loss of convenience are two sides of the same coin. That’s why only very few, very critical systems consistently rely on airgapping.

How data transfer still works

Anyone working with an air-gapped system must transport data physically. In practice this means: a technician carries an encrypted USB stick from one network to another. This process even has its own name — sneakernet, after the sneakers one walks in. It sounds old-fashioned, but in some environments it is the only acceptable way.

Researchers have shown that the air gap is not absolute protection. An infected USB stick can introduce malware. And attackers have experimentally proven that even completely isolated computers can send data outward — through the heat they emit, through noises from the hard drive, or through electromagnetic radiation. These attack vectors are extremely elaborate and rare in practice, but they show: physical separation is very good, but not perfect.

A related concept is the so-called one-way gateway, also called a data diode. Here, data flows only in one direction — into the secured system, but never out. This allows limited connectivity without an attacker being able to extract data. It is a compromise between true airgapping and a normal network connection.

Where airgapping is used today

Airgapping is not a theoretical concept. Control systems for power plants, water treatment facilities, and chemical plants often run behind an air gap, because a successful attack there would cause physical damage. Military networks and intelligence agencies generally separate their most sensitive systems from the public internet. In some countries, voting machines are also deliberately never connected to the network.

In connection with AI systems, the term increasingly appears in the security debate. Researchers working on particularly powerful models are discussing whether the training infrastructure — i.e., the machines on which a model learns — should be separated from the internet. The idea behind this: if a model can be manipulated during training, it could later exhibit deliberately faulty behavior. Airgapping would be a radical but effective countermeasure.

In everyday IT security, the term also comes up on the topic of backups. A common recommendation is: at least one backup should be kept offline and physically separated — that is, behind an air gap. This way, an attacker who breaches the network cannot simultaneously encrypt or delete all copies.