Air Gap Architecture
You build an air gap architecture by cutting all links between your network and the public internet. Teams move data into this closed zone using read-only media or one-way hardware links. Most engineers set up local directory services inside the room to manage user roles. When teams grant broad admin roles for convenience, a single bad command can wipe local databases. How to set up an air gap architecture To start, you remove all wireless cards and external network cables from your servers.
Zero Trust Architecture + Compliance Gap Analysis: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You build an air gap architecture by cutting all links between your network and the public internet. Teams move data into this closed zone using read-only media or one-way hardware links. Most engineers set up local directory services inside the room to manage user roles. When teams grant broad admin roles for convenience, a single bad command can wipe local databases.
How to set up an air gap architecture
To start, you remove all wireless cards and external network cables from your servers. You place these servers in a locked room with strict badge checks at the door. The internal network uses private switches that never route packets to the outside world. Every tool, database, and login server must run on hardware inside this closed loop.
Software updates and patches require a manual transfer process across the physical gap. An engineer downloads the update file on an internet machine and checks its cryptographic hash. Next, the engineer writes the verified file to a clean flash drive or optical disc. They walk the media into the secure room and load it onto a scan station. After a clean virus scan, the team pushes the update to the internal servers.
Managing local roles and data transfer rules
Because cloud identity tools cannot reach the isolated room, you must run local login servers. Admins create user accounts and assign role permissions on an internal directory system. Operators log in from local terminals inside the building to run daily maintenance tasks. Teams also set up internal artifact stores to hold approved container images and software packages.
Some setups use optical data diodes to move log files out of the secure zone. A data diode uses a physical light beam to send data in one direction only. Logs travel out to monitoring teams, but no traffic can ever travel back in. This physical barrier stops external attackers from sending commands to the isolated servers.
Zero Trust Architecture + Compliance Gap Analysis: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What physical isolation solves and what it misses
An air gap stops remote hackers from reaching your servers over the public internet. It blocks automated phishing links, external command servers, and remote data theft over web connections. For high-security sites, physical separation provides a strong boundary against outside network attacks. Still, network walls only control how traffic travels between rooms, not what happens inside.
Once an operator logs in at a local terminal, the network barrier cannot inspect their actions. Native roles decide who can log in, not what individual queries or commands do in flight. An insider with a broad role can still run a drop table statement by mistake. A contractor at an internal desk can still query sensitive tables and read raw card numbers. Static role checks also fail to rewrite sensitive fields like emails or phone numbers in query results. To protect data inside the room, teams need controls over every active command and query.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the difference between a logical air gap and a physical air gap?
A physical air gap uses separate hardware with no network cables linking to the outside world. A logical air gap uses firewall rules and network routing to block traffic on shared hardware.
How do teams patch servers inside an isolated network?
Engineers download patches on an outside machine, verify the file hashes, and copy them to removable media. They scan the media for malware at an entry station before loading patches onto internal servers.
Can malware still enter an isolated server room?
Yes, malware can enter on infected USB drives, vendor laptops, or compromised hardware components. Once inside, bad code or careless admin commands can damage systems unless you control active sessions.