Highly sensitive local network operations or operations that do not require external network connectivity could be confined to an air-gapped network segment that prevents all communication with external networks, including the Internet.
Control Type: Technical
Control Function: Preventive
Protects: Confidentiality
There may be times when an organization needs to have an entirely isolated network environment to perform any variety of operations. These may include forensic investigations, testing, and highly restricted data operations. In such cases, traditional segmentation via VLANs will not do. The desired network needs to be 100% isolated, with no network interfaces connected to the Internet or any other network segments in the organization. This is what is known as an air-gapped network.
Any organization can implement an air-gapped network segment if they feel it is justifiable. Setting up the air-gapped segment is the same as setting up any other network segment, only there is no integration with other pieces of the organization’s network infrastructure. There is no default gateway pointing the segment’s traffic out to the Internet. There are no trunk links carrying the segment’s traffic to other segments. There is no way for anybody to initiate wireless connections to any nodes within the air gapped segment. There is only a Layer 2 device like a network switch, and one or more devices connected to the switch and assigned IP addresses on the same subnet.
All other networking functionality on air gapped systems should be disabled or just removed, such as wireless network cards. Since there is no way to go out onto the Internet and download software, physical media must be used to transfer data in and out of the air-gapped segment. There could be a single network share that is only accessible by other systems in the air-gapped segment.
Air-gapping should occur at the physical level as well. All nodes in the air-gapped segment should be confined to a single, heavily secured room. Network cables should be clearly marked and kept isolated, and there should be no cables connecting from the air gapped infrastructure to the infrastructure of other network segments. If the nature of operations occurring within the air-gapped segment are of an extremely sensitive nature, the organization may be able to justify tools like faraday material to cut off radio communications into and out of the room.
How secretive an organization needs to get with an air-gapped network depends on what it is being used for. Sometimes there is no security need for air-gapping, it may be preferred for functionality. For example, a college hosting a nursing program may have several simulation technologies that communicate over IP. The only functionality needed is for the sims to be able to talk to one another, and for monitoring systems to be able to talk to the sims. In this case, there is no need for connectivity with other networks since this is all the environment is used for.
