Break your own air gap four ways on paper

short · 30 min · Objective 3.1

Task

Take a design that claims an air gap and find the routes across it. An air gap is the strongest network control there is and the one most likely to be true on the diagram and false in the building.

Steps

  1. Write /tmp/airgap.md describing a plausible isolated environment: what it does, what is on it, and the claim that it has no network connection to anything else.
  2. Now describe how data gets IN — updates, configuration, new files — and how it gets OUT — reports, logs, backups. Every isolated environment has both, and they are the first crossing.
  3. Add the maintenance reality: who supports the equipment, how they reach it, and what happens when the vendor needs access at 2am.
  4. Add the engineering laptop: the machine that is on the isolated network today and the corporate network tomorrow.
  5. Add the infrastructure question: is the isolation physical, or is it two VLANs on shared switches?
  6. For each of the four crossings, write the control that would actually manage it, and mark which of them can be verified by a command rather than by asking somebody.

Verify

grep -ciE "removable|usb|media" /tmp/airgap.md
grep -ciE "dual.homed|laptop|engineering" /tmp/airgap.md
grep -ciE "maintenance|vendor|remote|cellular|modem" /tmp/airgap.md
grep -ciE "vlan|shared switch|logical" /tmp/airgap.md
python3 -c "
import re
t=open('/tmp/airgap.md').read().lower()
need={'removable media':'removable|usb|media','dual-homed host':'dual.homed|laptop',
      'maintenance access':'maintenance|vendor|modem','shared infrastructure':'vlan|shared switch'}
missing=[k for k,p in need.items() if not re.search(p,t)]
print('crossings covered:',len(need)-len(missing),'of',len(need))
assert not missing, 'not covered: '+', '.join(missing)"

All four greps must be non-zero and the assertion must pass. The four crossings are not a list to memorise for its own sake — they are the four ways every real air gap has been crossed, and a design review that checks only for a cable has checked the least likely one.

Notes

The most famous industrial control system attack in history crossed an air gap on removable media. The gap was real, the diagram was accurate, and the data still got in — which is why the lesson calls this a control requiring continuous verification rather than a one-time design decision.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.