The air gap decays on its own

“Our network is isolated” is the most reassuring sentence you can hear in an industrial audit, and the one that most often turns out to be wrong.

Nobody lied. An air gap is simply not a state you reach once; it is a discipline, and disciplines wear down. Every site that believes it is isolated has a path somewhere that a competent person created for a good reason, fully intending it to be temporary.

The four vectors

They are the same on almost every site, roughly in this order of frequency.

1. USB sticks. The quickest way into an OT system, because a stick walks round every technical control you installed. It carries backups, programs, a supplier’s update, a report someone wants on their laptop. The stick bringing the file into the plant today may well have been plugged into a hotel business-centre PC last week.
2. Supplier files. A patch, a firmware image or a configuration file, sent by a vendor and installed on a production PC. It arrives by email, by download link, or on that same stick, and it is trusted because the vendor is trusted. Trusting an organisation and checking a file are two different things.
3. Contractor laptops and engineering consoles. A machine that was on hotel Wi-Fi, on another client’s network and on the public internet this morning gets plugged into your production network this afternoon, often with administrative rights on the controllers. For as long as that intervention lasts, your air gap is a bridge to everywhere the laptop has been.
4. Hidden 4G and LTE routers. The one that surprises people. A machine arrives from its builder with a cellular modem inside for remote support, sometimes mentioned in a contract annex nobody in IT ever read. It does not defeat your firewall; it just never goes through it. We find these routinely, and they are almost never on a network diagram.

“Just for today”

There is a fifth vector, and it is about behaviour.

A port is opened on the firewall to finish commissioning. A cable is run between two cells to get a signal across while the proper solution is designed. A rule is relaxed for a supplier visit. Each is a reasonable engineering decision taken under pressure, and each is meant to last a day.

They stay. Negligence has little to do with it: nothing raises an event when a temporary arrangement quietly becomes permanent. Nobody is assigned to close it, no ticket expires, and six months later it is part of the architecture, protected by everyone’s fear of breaking something.

That is how an air gap decays without anyone ever deciding to give it up.

What actually works

A policy that says isolation must be maintained changes very little. Three practical habits do.

First, find what already crosses. An asset inventory plus a passive traffic baseline will turn up the 4G router, the forgotten cable and the machine talking to an address nobody recognises. You cannot police a boundary you have never mapped, and this is the only method that finds the paths nobody remembers creating.

Second, make every new connection a decision with a record. That does not mean an approval committee; it means a named person, a reason and an end date. The end date matters most. A temporary connection with no expiry is a permanent connection with optimistic paperwork.

Third, make the abnormal easy to report, and safe. An operator who spots an unexplained device or an unexpected remote session needs somewhere to report it and no reason to fear doing so. If reporting a stray cable gets someone blamed, nothing gets reported, and you lose your best sensor.

Changing how you think about it

The useful shift is to stop treating isolation as a property of the network and start treating it as a property of the way the site manages change. NIST makes a similar point in its OT security guide: as OT systems are increasingly connected to IT networks, relying on traditional measures such as air gaps is not enough.

A plant that keeps an accurate inventory, reviews every new connection and can explain every device on its network is easier to defend than one with a nominal air gap and no idea what is plugged in, even if the second sounds stronger in a management presentation.

“Isolated” describes an intention. What matters is whether anyone would notice the day it stopped being true.

References

• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, September 2023.