Air-gapped network security protects isolated industrial systems from threats that cross physical boundaries. Even without a direct network connection, USB drives, contractor laptops and supplier files can introduce malicious software or unsafe changes.
This guide explains how to control removable media, inspect files, manage engineering access and recover PLC, HMI and SCADA systems. The aim is practical industrial resilience without interrupting essential operations.
In This Guide
Jump to the section you need.
- What Is Air-Gapped Network Security?
- Why an Air Gap Alone Is Not Enough
- Common Paths Into Isolated OT
- A Six-Step Secure File Transfer Workflow
- A Controlled OT Transfer Process
- Inspect USB Devices and Files Before Use
- Protect Engineering Laptops and Contractors
- Backups, Version Control and Recovery
- Monitoring and Safe Offline Updates
- Air-Gapped Network Security Checklist
- How MAC Solutions Can Help
- Building Resilience Beyond the Air Gap
- Frequently Asked Questions
What Is Air-Gapped Network Security?
Air-gapped network security protects industrial control systems by limiting the pathways between isolated OT equipment and less trusted environments. A genuine air gap means there is no direct network link across the boundary. Segmentation is different because controlled network traffic still flows.
Isolation removes many remote attack paths, but malware and unwanted changes may arrive through portable media, replacement devices and supplier files. Managing these routes matters as much as the physical disconnection.
Why an Air Gap Alone Is Not Enough
Manufacturing plants rely on PLCs, HMIs, SCADA and engineering software that periodically require updates, recipes or diagnostic files. An unverified USB device can introduce a threat to an otherwise disconnected system.
A contractor might use the same laptop at several facilities. Unsupported systems, mistakes in configuration and failed backups also create operational risk. Air-gapped network security must address equipment, people, media and day-to-day procedures together.
Common Paths Into Isolated OT
USB drives and portable storage may carry malware, engineering workstations can bridge environments during maintenance, supplier updates can contain unverified code, and recovered backups may reintroduce unwanted configurations.
Begin with an inventory of every route through which information reaches critical equipment. Record the owner, purpose and approval process for each path. Remove unnecessary transfers.
A Six-Step Secure File Transfer Workflow
A dependable workflow makes air-gapped network security easier to operate and audit. Use it for routine updates, contractor visits and emergency changes.
- Approve: Record the owner, purpose, destination and maintenance approval.
- Verify: Check supplier provenance, file version and integrity signatures where provided.
- Inspect: Scan approved files and media at a separate controlled station.
- Transfer: Use designated labelled media and limit permissions.
- Log: Record user, file, scan result, destination and approval.
- Close: Verify operation and revoke temporary access.
A Controlled OT Transfer Process
The following example is a controlled offline hand-off, not a permanent network connection. A network DMZ may help segmented plants, but does not by itself establish an air gap.
1. External Source
Verified supplier files
2. Inspection Point
Review, scanning and approval
3. Controlled Media
Logged offline hand-off
4. Isolated OT Asset
Approved installation and verification
Inspect USB Devices and Files Before Use
Use approved removable media and restrict devices to a documented purpose. Check the source and version of files, scan them at a separate inspection point and verify package signatures where available.
No scanner guarantees that every file is safe. Add allowlisting, restricted execution privileges and traceable engineering approval. MAC’s TYREX USB decontamination solutions are relevant to controlled removable-media workflows.
Protect Engineering Laptops and Contractors
Treat engineering laptops as sensitive assets. Restrict administrator privileges, disable unnecessary interfaces, keep an approved software list and check devices before connecting them to critical equipment.
Contractor access should have a named approver, an agreed maintenance window and a record of work. Remove temporary access afterwards. These measures support air-gapped network security without preventing essential maintenance. If a network connection is deliberately introduced, the system is no longer strictly air-gapped and needs a separately assessed remote-access design.
Backups, Version Control and Recovery
Disconnection cannot prevent accidental programming changes or damaged storage. Retain protected copies of PLC programmes, HMI projects, settings and engineering documentation. Keep one verified recovery copy separated from ordinary administration.
Test recovery on suitable equipment, record approved versions and decide who may authorise restoration. Accurate engineering change records and tested recovery procedures address complementary aspects of resilience.
Monitoring and Safe Offline Updates
Air-gapped network security still needs asset records, local event logs and access reviews. Export evidence through an approved process rather than quietly adding an unrecorded connection. Asset records and visibility checks should be adapted to disconnected equipment.
Offline updates should come from trustworthy suppliers, be checked away from production and installed in agreed maintenance windows. NIST SP 800-82 Revision 3 explains OT security planning around availability and safety.
Air-Gapped Network Security Checklist
Confirm whether systems are genuinely disconnected or merely segmented. Catalogue USB, laptop and supplier transfer paths. Approve and record transfers, inspect authorised media, restrict execution privileges, and test offline recovery.
Review procedures whenever the plant changes equipment, contractors or software. The checklist is a starting point, not a guarantee of complete protection.
How MAC Solutions Can Help
No single product delivers complete air-gapped network security. MAC’s OT cyber security portfolio includes complementary technologies relevant to device protection, USB inspection and operational recovery.
For a broader discussion, consult MAC’s industrial cyber security services. The appropriate controls depend on the site’s architecture and production constraints.
Building Resilience Beyond the Air Gap
Effective air-gapped network security combines physical separation with controlled file movement, trusted engineering access and tested recovery. Start by mapping all pathways into production and work with engineers to put risk-based controls around each one.
Frequently Asked Questions
Can an Air-Gapped OT Network Get Malware?
Yes. Infected media, supplier packages and engineering devices can introduce malware without internet connectivity.
Does USB Scanning Guarantee Safety?
No. Scanning needs to be combined with approved sources, integrity checks, least privilege and change control.
Is a Firewall an Air Gap?
No. A firewall allows controlled network connections, while an air gap has no direct connection across its boundary.
How Often Should Offline Backups Be Tested?
Use a risk-based schedule based on system criticality and acceptable downtime, and retest after significant changes.
