An internet air gap is a network design that keeps a system isolated from the public internet. It relies on physical or logical separation, such as disconnected interfaces, restricted routing, or tightly controlled gateways, to limit external reachability and reduce remote attack paths.
What an internet air gap actually does
An internet air gap is not a guarantee of immunity, it is a reachability control. By removing or tightly constraining direct internet access, it reduces the number of paths an external attacker can use to reach a system, but it does not by itself eliminate insider risk, removable media risk, supply-chain risk, or abuse through permitted gateways.
The value of the pattern comes from limiting exposure. In practice, organisations use physical separation, segmented routing, filtered proxy paths, or one-way transfer mechanisms to keep a sensitive environment from being directly addressable from the public internet.
Why an internet air gap is used
The main reason to adopt an internet air gap is to shrink the attack surface of a high-value system. When a service is not internet-reachable, common remote attack paths such as opportunistic scanning, credential stuffing against exposed services, and direct exploit attempts become much harder to execute.
This is why the design often appears in recovery environments, industrial enclaves, research systems, and other places where availability or integrity matters more than convenient connectivity. The control is strongest when the organisation treats internet access as an exception rather than a default.
For recovery-centric designs, Cyber Recovery Vault Guide explains how isolation layers and vault architecture support a logically or physically separated recovery target.
Common implementation models and trade-offs
Internet air gaps are implemented in different ways, and the choice changes the protection level. A true physical gap removes the network connection entirely. A logical gap may still allow controlled synchronisation, but only through restricted routes, hardened gateways, or narrow data flows.
That trade-off matters. The more an environment depends on gateways, replication channels, or administrative access paths, the more the design becomes a controlled boundary rather than a pure gap. Security improves, but so does operational complexity, because every exception has to be justified, monitored, and maintained.
Where organisations need one-way movement or tightly governed transfer patterns, Data Diodes and Unidirectional Gateways Guide is a useful companion for understanding when hardware-enforced one-way flow is a better fit than a conventional firewall rule set.
For backup and recovery environments, Backup Security and Immutable Backup Guide covers the overlap between air-gapped vaults, immutability, and restore integrity.
What an air gap does not solve
An internet air gap does not stop compromise that enters through trusted administrative channels, portable media, software updates, third-party tooling, or stolen credentials used inside the protected boundary. It also does not protect a system if the boundary is bridged too broadly by remote management, shared identities, or permissive transfer infrastructure.
That is why the control should be understood as a boundary reduction technique, not a complete security strategy. The surrounding control stack still needs strong access governance, logging, recovery testing, patch discipline, and clear ownership of every permitted connection into the isolated environment.
Risk and Threat Considerations
An internet air gap lowers direct exposure, but the boundary can create a false sense of safety if organisations assume the system is unreachable and therefore low risk. In reality, the remaining paths into the environment become more important, because compromise often arrives through insiders, trusted operators, supply-chain updates, removable media, or transfer gateways.
Failure mechanism: The protection fails when the gap is only partial, poorly maintained, or routinely bypassed for operational convenience, allowing an attacker or malware to enter through an allowed channel and then persist inside the isolated environment.
Impact: A successful breach can be harder to detect and slower to remediate than a standard internet-facing compromise, especially when the isolated system is relied on for recovery, critical operations, or high-integrity data.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Internet air gaps are boundary controls that limit external reachability. |
| AC-4 — Information Flow Enforcement | Air gaps often depend on one-way or tightly constrained information flows. | |
| CP-9 — System Backup | Air-gapped designs are often used to protect recovery copies from online compromise. | |
| Recommendation — Apply SC-7 to restrict and monitor all paths into the isolated environment. Use AC-4 to enforce approved data flows and block unapproved transfer paths. Protect recovery data with offline or isolated backups under CP-9. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Air-gap boundaries need monitoring to detect unexpected connectivity or bypass paths. |
| CIS-11 — Data Recovery | Isolation is commonly used to preserve restore capability after ransomware or destructive attacks. | |
| Recommendation — Monitor boundary traffic and alert on unauthorized connectivity around isolated systems. Maintain and test recovery copies that remain isolated from routine production access. | ||
Practitioner Guidance
Why practitioners should care: Treat the air gap as an architectural control that must be proven, not assumed. If the design depends on exceptions, gateways, or synchronisation jobs, those paths deserve the same scrutiny as any other privileged access route.
What to watch for: Review whether the “gap” still allows bidirectional access, unmanaged transfers, or shared administrative accounts. Those are the usual points where the control becomes porous in practice.
Practitioner takeaway: The strongest internet air gap is the one with the fewest necessary exceptions, the clearest ownership, and the most tested recovery path.
Related resources from NHI Mgmt Group
- How should security teams secure connected OT devices without relying on the old air gap?
- Why do air-gapped networks still face identity security risk even when they are isolated from the internet?
- How should security teams protect air-gapped systems when USB drives are regularly moved between secure and internet-connected devices?
- What breaks when sensitive military documents meant for air-gapped systems are left on internet-facing systems?