Air gap

An air gap is a form of physical segmentation in which the protected system or network has no network connection, wired or wireless, to any other network, including the internet. It is commonly used where remote compromise would have severe consequences, such as some industrial control, classified and offline key-management environments. The ISC2 exam outline names air-gapped, beside in-band and out-of-band, as an example of physical segmentation.

An air gap does not make a system unreachable. Data that has to cross the gap does so on removable media and through people: updates are carried in, reports are carried out, and engineers connect maintenance laptops. The control therefore moves to media handling, device control and personnel procedures; it does not disappear. Built-in radios, such as Wi-Fi and Bluetooth interfaces, have to be removed or disabled, or the gap is not real. Researchers have also demonstrated covert channels that carry data across a gap through sound, heat or electromagnetic emissions, though these need malware already inside. Logical network segmentation, by contrast, separates networks only in configuration.

Exam relevance: a scenario is likely to describe malware reaching an isolated network on a removable drive and ask what failed. The expected reasoning is that the gap held while media controls did not. Candidates are expected to reject the idea that air-gapped means unreachable.