Somebody on the board has read about an air-gapped system and asked why your servers aren’t in one. It is a fair question with a slightly unfair answer: an air gap is a very specific thing, it costs real convenience, and most of the exposure you want gone can be removed without one.
What is an air gap?
NIST’s glossary, quoting CNSSI 4009-2022, defines an air gap as “an interface between two systems at which (a) they are not connected physically and (b) any logical connection is not automated.” The glossary adds the plain-English version: data is transferred “only manually, under human control.”
Two tests follow from that definition. Is there a cable, radio or any other physical link? Does anything move data across without a person deciding to? If either answer is yes, you have something else: a segmented network, a firewalled zone, a heavily restricted one. Possibly a good one. Not an air gap.
Why would anyone want one?
Because it removes the network as an attack path altogether. An attacker on the internet cannot send packets to a system that has no connection to receive them. That is why the idea turns up around industrial control systems and other places where a compromise has physical or national consequences.
The price is that the same property makes everything slow. Patching, log collection, monitoring and backups all need a person to carry something across, and every carry is a chance for something unwelcome to hitch a ride.
Air gaps are not unbreakable
The gap blocks the network path. It does not block the person walking across it with a USB drive.
CISA’s ICS-CERT advisory on Stuxnet says that “Stuxnet and other malware take advantage of USB drives to propagate,” and recommends that organisations “establish protective technical measures to disable USB drives.” The advisory is archived (last revised in January 2014), but the lesson has not aged: removable media is how the gap gets crossed.
MITRE ATT&CK documents this as two separate techniques. In T1091, adversaries “move onto systems, including those on disconnected or air-gapped networks” by copying malware to removable media. In T1092, they run command and control between compromised hosts on potentially disconnected networks, relaying data through removable media. For that second one, both the connected host and the air-gapped host have to be compromised first, which tells you the gap has to be breached before it can be abused. Its mitigations are dull and effective: disable Autorun, and “disallow or restrict removable media at an organizational policy level if they are not required for business operations.”
Can software give the same isolation?
Not the same, no. Segmentation, VLANs, firewall rules and access policies are all software (or software-configured) barriers on a connection that exists. They can be excellent. They can also be misconfigured, bypassed through a vulnerability in the thing enforcing them, or quietly widened by someone who needed “just one exception” in 2021.
That is the honest line between the two:
| True air gap | Software isolation | |
|---|---|---|
| Physical connection | None | Yes |
| Automated data path | None | Yes, filtered |
| Depends on correct configuration | Little | Entirely |
| Updates, logs, monitoring | Manual transfer | Automated |
| Main residual risk | Removable media and people | Misconfiguration and software flaws |
| Day-to-day cost | High | Low |
Sometimes you will hear “logical air gap” for the bottom column. By the NIST definition above, it is a useful control with a misleading name. Call it isolation and be accurate about what it gives you.
What you may actually need instead
For most teams, the pain is not that an attacker could reach the network. It is that specific services answer to the whole internet. CISA’s guidance for operational technology puts it first on its list: “Remove OT connections to the public internet,” noting that “OT devices are easy targets when connected to the internet.” Where remote access is needed, it advises a private network connection with a VPN and phishing-resistant MFA, and it recommends segmenting IT and OT networks, with a demilitarized zone for passing control data.
That is not an air gap. It is the realistic cousin: remove the exposure, then control the one path that is left. NIST’s zero trust architecture (SP 800-207) supplies the principle, stating that “there is no implicit trust granted to assets or user accounts” and that network location is no longer the prime component of security posture. Being inside the network earns you nothing; each access is checked.
Here is how a gap and an outbound-only connection differ in shape:
Where SSHepherd fits
SSHepherd® is not an air gap, and we would rather say so than let a diagram imply otherwise. The server is still connected. What changes is the direction: SSHepherd closes the externally exposed listening port, and the server and your administrators each connect outbound to a broker, which joins them only for authorised identities. A scan of the server finds nothing to try, with no network re-architecture and about ten minutes to deploy and protect a server. Sessions can be monitored, recorded and ended on demand. If you have a genuinely air-gapped environment, that is a different design and a different budget. If what you want is for servers to stop answering strangers, see the SSHepherd page.
The bottom line
An air gap means no physical link and no automated data path, and software, however good, cannot reproduce that because it sits on a connection that exists. Most teams do not need the gap. They need to remove inbound exposure, keep removable media on a short leash, and control the one path left.