Designing Networks for Air-Gapped Operations

Air-gapped networks protect some of the most sensitive work in government and industry: classified systems, weapons and test environments, industrial control systems and research labs. Removing every network path to the outside eliminates whole categories of attack.

It also removes every service the modern IT world assumes is always available. Operating systems expect to reach update servers. Software expects to call home for licenses. Certificates expect to check revocation lists. Clocks expect to reach a time server. An air-gapped network that is not designed for these needs either stops working or, more often, gets a "temporary" connection that never goes away.

This article covers how to engineer an isolated network that stays isolated and keeps working.

Start with what the network needs from outside

Before choosing hardware, list every dependency the systems will have on the outside world. For most environments the list includes:

• Software and security updates for operating systems, applications and firmware.
• Malware signatures for endpoint protection.
• Time for authentication, logs and certificates.
• Name resolution for internal hosts.
• Certificates and revocation for TLS, smart cards and code signing.
• Licensing for commercial software.
• Documentation and tools that administrators normally look up online.

Each item needs an internal source or a controlled process for carrying it across the gap.

Build the services inside

Updates. Stand up an internal update repository, such as a mirrored package repository or a Windows update server, and feed it through the transfer process on a fixed schedule. Test updates on a staging system inside the enclave before deploying them broadly.

Time. Provide an internal time source, such as a GPS-disciplined clock where the facility permits it, or a designated internal server. Kerberos authentication and log correlation both fail quietly when clocks drift.

Name resolution and directory. Run internal DNS and, where needed, a directory service dedicated to the enclave, with no trust to outside domains.

Public key infrastructure. Operate an internal certificate authority, and publish revocation lists inside the network. Plan how revocation information for external certificates, such as smart card certificates, is brought in and kept current.

Licensing. Choose software that supports offline licensing, such as signed license files that can be verified without contacting the vendor. Ask vendors how licenses are renewed and how the software behaves if a license expires; a security tool that stops working on an expired license is a mission risk.

Logging. Centralize logs inside the enclave. Without Internet-based monitoring, the internal log server is your only record of what happened. We cover this in Logging That Helps an Investigation.

Backups. Back up inside the enclave, keep offline copies, and test restores. Isolation does not protect against hardware failure or an insider.

Control the crossing

With no network path, removable media becomes the path, and it works in both directions. Malware has crossed air gaps on USB drives, and sensitive data has left on them.

A sound transfer process includes:

• Dedicated, tracked media, never personal devices.
• A transfer station that scans media with multiple engines before anything enters the enclave.
• Allow-listing of file types, with anything unexpected rejected.
• Logging of every transfer: what, when, who, and why.
• Two-person review for transfers out of the enclave, which is the only defense against data leaving by mistake.

Where data only needs to flow one way, a one-way transfer device enforces that in hardware. In classified environments, moving data between security domains requires an approved cross-domain solution and the authorizing official's approval.

Keep the gap real

Air gaps erode. A vendor needs remote support. An engineer adds a wireless card to save a trip. A printer arrives with a cellular modem for supply reordering. Each change is small, and together they undo the design.

• Verify regularly. Scan the enclave for wireless interfaces, unexpected routes and new devices on a schedule.
• Disable what you do not use. Remove or disable wireless, Bluetooth and unused ports in hardware and firmware where possible.
• Treat every exception as a change. Any new connection goes through configuration management and the authorizing official, not a hallway conversation.
• Test it. Have someone try to cross the gap the way an attacker or a careless user would.

Questions to ask before you build

1. Where will updates, time and certificates come from, and who owns each process?
2. Does every piece of software work, and keep working, without Internet access?
3. How will data move in and out, and who approves it?
4. How will you know if the gap has been bridged?

How CDT can help

CDT engineers isolated and classified environments through our classified network and secure architecture services. For SIPRNet requirements, CipherX provides an already-authorized architecture, and RAVEN-X supports local administration of security infrastructure where connectivity is limited or unavailable.

Sources

• NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security