Air Gaps vs. Reality: OT Security in a Connected World

Introduction

In the ever-evolving landscape of Operational Technology (OT) security, air gaps have traditionally been a prominent defence strategy. However, with the increasing interconnectedness of systems and the rise of sophisticated cyberattacks, the effectiveness of air gaps is being reevaluated. This discussion explores the concept of air gaps, their potential benefits and limitations, and the need for a more holistic approach to OT security.

What is an Air Gap?

An air gap refers to a physical or logical separation between a critical system (e.g., industrial control systems, SCADA, DCS) and other networks, including the internet. In a physical air gap, there’s no physical connection between the systems, while a logical air gap uses software firewalls or other security mechanisms to create the isolation.

How it Works:

Air gaps function by impeding the lateral movement of malicious actors within a network. It aims to prevent malware or unauthorised access from reaching critical systems by creating a barrier of isolation. However, it’s crucial to recognize that air gaps are not foolproof solutions.

Features of Air Gaps:

Reduced cyber attack surface: Eliminates direct internet exposure, making it harder for external attackers to breach the system.
Enhanced data protection: Limits unauthorised data access and exfiltration.
Improved system control: Provides greater control over data flow and system behaviour.
Simplified network management: Can potentially simplify security management as fewer connections need monitoring.

Comparison with other Known Standards:

Network segmentation:
- Similarities: Both isolate networks, but air gaps are stricter, completely severing connections.
- Differences: Network segmentation allows controlled connections between segments, enabling communication while maintaining some isolation.
Firewalls:
- Similarities: Both act as barriers between networks, monitoring and filtering traffic flow.
- Differences: Air gaps physically disconnect networks, while firewalls act as software-based barriers within a single network.
Zero-trust security:
- Similarities: Both aim to minimise trust assumptions and require continuous verification.
- Differences: Air gaps focus on physical isolation, while zero-trust focuses on continuous authorization regardless of network location

Top Benefits of Air Gaps (While Considering Their Limitations)

Improved Security: Air gaps can offer some protection against certain types of cyberattacks by adding a layer of isolation. (However, they are not a silver bullet and should be combined with other security measures.)
Compliance: Some industries or regulations might mandate air gaps as part of their security requirements.
Reduced Attack Surface: By limiting connectivity, air gaps can reduce the potential attack surface for malicious actors. (But vulnerabilities within the isolated system itself can still be exploited.)
Simplified Security Management: Managing a small, isolated network can seem easier than a complex, interconnected one. (However, maintaining and updating software within an air gap can be challenging.)
Improved System Stability: Air gaps can help prevent disruptions from external network issues. (But internal vulnerabilities and human errors can still cause disruptions.)
Potential Cost Savings: Depending on the implementation, air gaps might require less investment in specific security solutions than complex, multi-layered setups. (However, the cost of maintaining and updating isolated systems should be considered.)

Limitations (Cons) of Air Gaps:

Limited Connectivity: Air gaps can hinder essential data exchange and remote monitoring, potentially impacting operational efficiency.
False Sense of Security: Air gaps can create a false sense of security, leading to neglect of other essential security measures.
Incomplete Isolation: Achieving complete isolation is often challenging, and even “air-gapped” systems might have hidden connections or vulnerabilities.
Evolving Attack Vectors: Sophisticated attackers can exploit vulnerabilities in other parts of the system or utilise advanced methods like supply chain attacks to breach the air gap indirectly.
Maintenance Challenges: Updating software and systems within an air gap can be cumbersome and involve additional steps.

Industry Use Cases:

Critical infrastructure: Power grids, water treatment facilities, transportation systems.
Industrial control systems (ICS): Manufacturing plants, energy production facilities, process control systems.
Financial institutions: Banks, financial services companies, handling sensitive financial data.
Government agencies: Protecting sensitive information and critical infrastructure.
Healthcare organizations: Protecting patient data and ensuring system availability for critical medical devices.

Debate:

Effectiveness: While effective against external attacks, air gaps can’t prevent internal threats or vulnerabilities within the isolated network.
Practicality: Maintaining complete air gaps can be challenging in today’s interconnected world, hindering data exchange and operational efficiency.
Cost: Implementing and maintaining air gaps can be expensive, requiring additional equipment and expertise.
Monitoring and visibility: Air gaps can limit visibility into security threats and incidents within the isolated network.
Flexibility: Air gaps may not be adaptable to evolving security threats and changing business needs.

Examples of Historical Cyber Attacks:

Stuxnet (2010): Targeted Iranian nuclear facilities, highlighting the vulnerability of critical infrastructure.
WannaCry (2017): Affected over 200,000 computers worldwide, demonstrating the rapid spread of ransomware.
SolarWinds supply chain attack (2020): Compromised widely used software, emphasising the importance of secure software development practices.
Colonial Pipeline ransomware attack (2021): Disrupted fuel supply in the US, showcasing the impact of cyberattacks on critical infrastructure.
Log4 Shell vulnerability (2021): Exposed millions of devices to potential attacks, highlighting the importance of timely vulnerability patching.

How to Protect/Avoid/Prevent/Cure Air Gap Vulnerabilities?

Multi-layered security approach: Combine air gaps with other security measures like firewalls, intrusion detection systems, and access control.
Regular vulnerability assessments and patching: Identify and address vulnerabilities in hardware and software promptly.
Strict access control and user training: Implement robust access control policies and educate personnel on cybersecurity best practices.
Physical security measures: Secure physical access to air-gapped systems and data storage devices.
Monitor and update security protocols: Continuously monitor systems for suspicious activity and update security protocols regularly.

Conclusion:

While air gaps offer increased security, they are not a silver bullet and should be used as part of a comprehensive OT security strategy. By combining air gaps with other security measures, organisations can mitigate cyber risks and protect their critical infrastructure in today’s ever-evolving threat landscape.

Sources:

Quick Links:

Careers

Partnership

Live Demo