Armis Acquires Silk Security

Learn More
Request a Demo

What is an "Airgapped" Network?

Air gapping an OT network is conceptually isolating a device or group of devices from external connectivity. External connectivity can be that of any device or network not defined by the air-gapped network. Although air gapping is a good concept in principle, it can often lead to unintended consequences as it can bring a false sense of security with it.

One will nary find a detractor to air gapping the most critical of infrastructure, including government networks, our nation’s electrical grid, and other critical infrastructure networks from the Internet. But do air gapping networks from other internal networks provide a false sense of security?

It can be argued that simply defaulting to air gapping a network is a leading contributing factor to ICS intrusions as ICS security evolution is lagging, has led to stagnation, a lack of innovation, and a false sense of security.

Let us consider for a second the findings from the Repository of Industrial Security Incidents (RISI): The majority of ICS incidents occur from within the ICS network. But how could this be with a properly constructed air-gapped network? RISI found that removable devices, laptops, diagnostic equipment, and the like have all contributed to critical incidents under the guise of a secure air-gapped network.

Added to these pressures is Industry 4.0, where smart communicating devices are found throughout the OT and IoT networks, offering data to enrich enterprise platforms that allow plants to be more efficient, economical, and productive. Air-gapped networks, by nature, can not participate in offering insightful data into a converged network.

What is left of an isolated, hidden network left to its own ‘devices’? It becomes stagnant and antiquated. It gets left behind with a security posture from a time gone by. It is, in fact, less secure over time. As opposed to passing a false sense of security on to the next Operations Manager in line, a better understanding of how to secure those systems may be a better idea than isolating them.