Air Gapped Data Center
An air gapped data center is a facility with no link to the public web. You set it up by removing all outer network cables and wireless gear. Teams use this design to protect critical systems from outside attackers. Still, internal staff still need to log in and fix servers inside the room. When teams grant broad admin roles for local maintenance, one bad command can break production. How an air gapped data center works In a standard setup, servers sit inside a locked room with local switches
GCP Security Command Center: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
An air gapped data center is a facility with no link to the public web. You set it up by removing all outer network cables and wireless gear. Teams use this design to protect critical systems from outside attackers. Still, internal staff still need to log in and fix servers inside the room. When teams grant broad admin roles for local maintenance, one bad command can break production.
How an air gapped data center works
In a standard setup, servers sit inside a locked room with local switches. No router links these local switches to an outside internet provider. Network ports that are not in use stay turned off by default. Wireless cards and Bluetooth radios are removed from every single machine.
To move software updates in, an engineer copies files onto a clean drive. A security scanner checks that drive on a separate staging machine first. Next, the engineer walks the drive into the server room and loads the files. Local directory servers handle user log in checks without calling cloud identity tools.
Admins also run local certificate servers and time clocks inside the isolated room. Every database and server reads rules from this local directory. Operators sit at dedicated consoles inside the building to run daily checks. They log in with cards or hardware tokens to start a session.
Managing local roles and data transfers
Because staff must walk into the room to work, trips take a lot of time. To avoid repeat trips, teams often grant broad admin roles to on-site staff. A single local role might allow full read and write powers across ten databases. Shared admin keys also stay active for months because rotating them offline is slow.
Moving logs out of the room for review takes manual work too. An operator must export log files and carry them out on audit storage media. Because this step happens once a week, nobody sees bad queries right away. Sensitive fields like emails and card numbers also show up in plain text during local checks.
GCP Security Command Center: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What physical isolation solves and what it misses
Physical isolation stops remote hackers from reaching your servers over the internet. It blocks outside phishing links and stops malware from calling home to command servers. For defense, finance, and power grid teams, this wall is a core rule.
Yet physical walls only control how packets enter or leave the building. They do not check what a logged-in user does inside an active session. Once an engineer logs into a local terminal, the database trusts every command. A tired operator can still drop a table or read private national IDs.
Local directory roles only decide who can open a session on a machine. They cannot pause a dangerous delete statement and ask a second person to approve it. They also cannot rewrite phone numbers or card numbers in query results on the fly. True safety requires checking individual commands and masking sensitive fields inside the isolated room.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
How do teams patch servers in an air gapped data center?
Teams download patches on an internet-connected machine and check the file signatures. They copy the verified files onto clean removable media and scan for malware. An operator then carries the media into the room to update the local repo.
Can an air gapped network still suffer a data breach?
Yes, insiders with broad local roles can copy database records onto removable drives. Infected media brought in by contractors can also spread malware across local switches. Limiting query powers and masking results helps reduce this internal risk.
How does user log in work without cloud identity providers?
The facility runs its own local directory and hardware token servers on site. Users log in at local consoles using cards and personal pins. All session checks happen inside the room without any outside network calls.