An air gap does not make a computer unhackable

A heavy steel door and a computer with no network cable seems like a fortress. This is called an air gap. It means the machine has no physical or wireless connection to other networks, especially the internet. For many years, this was seen as the gold standard for high-security sites. The logic was simple. A hacker in another country cannot send a packet of data through a wall of concrete and air. If there is no path, there is no attack. This approach made sense when threats were primarily remote and the primary goal was to stop network intrusions.

Crossing the gap#

The problem is that machines do not exist in a vacuum. People must touch them. A technician might plug in a USB stick to transfer a log file. A contractor might connect a laptop to perform a diagnostic check. These are bridges. An air gap does not stop a piece of malware—malicious software designed to damage or leak data—from hitching a ride on a thumb drive.

Software also needs updates to stay functional. These files often arrive on disks or through temporary connections, creating another opening. Even the maintenance interface, which is a port used for low-level system management, can be an entry point if it is not secured. The air gap removes the easiest route for an attacker, but it does not remove every route. It replaces a digital highway with a few narrow footpaths. An attacker only needs to find one person willing to plug in a found USB stick or one vendor with a compromised laptop.

The Stuxnet precedent#

The world learned this lesson most clearly with a piece of malware called Stuxnet. This software targeted industrial controllers in a nuclear facility. The facility was air-gapped. The attackers did not use the internet to get inside. Instead, they relied on the human element and removable media to jump the gap. Once inside, the software behaved as if it were connected, moving from one machine to another until it reached its target.

This event shifted the perspective of security experts. It proved that isolation is a hurdle, not a wall. The evidence showed that a determined adversary does not need a network cable if they have access to the supply chain or a physical entrance. This changed the way an organisation views its most sensitive assets. Isolation is now recognised as a useful layer of defence, but it is no longer seen as a complete solution.

Relying solely on an air gap often leads to a dangerous drop in vigilance. An organisation might stop applying security patches because it believes the machine is unreachable. It might ignore who enters the server room or which devices are plugged into the ports. This creates a fragile environment where one single mistake provides total access to the system. The belief in absolute isolation turns a secure area into a soft target, as the internal defences are often neglected.

Security should instead rely on layers. This is called defence in depth. One must assume that the perimeter will be breached eventually. Instead of trusting the air gap, a security professional should monitor for strange behaviour on the machine. Access to physical ports should be locked or disabled. Every piece of media entering the room must be scanned and verified on a separate, sacrificial system first. This ensures that if a bridge is crossed, the attacker finds another wall waiting for them.

For those managing isolated systems, start by auditing every single path into the room. Disable unused USB ports physically or via software. Create a strict log for any external device that touches the machine. Treat every update file as if it is hostile until proven otherwise.