Air-Gapped Computer

What an air-gapped computer is

An air-gapped computer is not just “offline”; it is deliberately separated from external networks so that ordinary remote access paths do not exist. That changes the threat model immediately, because compromise usually has to arrive through a different channel, such as removable media, maintenance workflows, or a trusted operator who bridges the gap.

The value of the design is the reduction of network-borne exposure, but the isolation is only as strong as the surrounding handling process. If media transfer, admin access, or update procedures are weak, the air gap becomes a boundary with routine crossings rather than a true barrier.

How the isolation changes attack paths

Air gaps remove the most common route into a system, but they do not remove every route. Malware can still arrive on USB devices, portable drives, loaded images, diagnostic tools, or other controlled transfer media, and attackers may also target the people and processes that handle those transfers.

This is why air-gapped systems are often discussed alongside offline backups and recovery enclaves. The control is strongest when the environment is designed so that the isolated machine can perform its task without needing frequent, high-trust connections to less trusted systems.

Where air gaps are used

Air-gapped computers are commonly used where confidentiality, integrity, or survivability matter more than convenience. Typical examples include sensitive industrial environments, classified or highly restricted systems, and recovery environments that need to stay available even if the broader network is compromised.

The same design idea also appears in backup and recovery architecture. An isolated copy of data or a recovery system can limit the blast radius of ransomware or destructive malware, especially when the protected environment is kept separate from day-to-day administration paths.

For a deeper treatment of isolated backup design, see Backup Security and Immutable Backup Guide and Cyber Recovery Vault Guide.

What still needs to be controlled

An air-gapped computer still needs governance over data movement, privileged access, and recovery operations. The most important practical question is not whether the machine can reach the internet, but who can introduce data, who can approve changes, and how operators verify that what enters the environment is clean and expected.

That is why air gaps are often paired with immutability, restore testing, separation of duties, and strict handling of removable media. In practice, the security boundary depends on discipline around the edge of the gap, not only on the absence of a network cable.

Related recovery design guidance is covered in Ransomware Response and Recovery Guide and Backup Security and Immutable Backup Guide.

Risk and Threat Considerations

Air-gapped systems reduce remote exploitation, but they create a different risk profile rather than eliminating risk. The main exposure shifts to removable media, trusted insiders, supply-chain contamination, and operational shortcuts that reconnect the isolated system more often than intended.

Failure mechanism: An attacker or careless operator introduces malicious code or tampered data through a transfer device, update package, or maintenance workflow, then the isolated system executes or stores it because the boundary process was trusted too easily.

Impact: Compromise of an air-gapped system can be especially damaging because defenders often assume the machine is out of reach, which can delay detection, extend persistence, and expose sensitive data or recovery capability.

Practitioner Guidance

Why practitioners should care: An air gap is a control objective, not a guarantee. Treat the transfer path, operator process, and recovery workflow as part of the security design, because that is where most real-world failures occur.

What to watch for: Frequent exceptions to the isolation model, unmanaged removable media, weak approval steps, and untested restore procedures are signs that the gap is being relied on as a slogan rather than enforced as a control.

Practitioner takeaway: The safest air-gapped environments are the ones that minimise how often anything has to cross the boundary and can prove that every crossing is deliberate.

Related resources from NHI Mgmt Group

• Why does an air-gapped USB analysis setup reduce risk compared with plugging unknown devices into a normal computer?
• Air-Gapped Signing Computer
• How should security teams govern authentication in air-gapped environments?
• Why do air-gapped deployments create identity governance risk?