Air Gapped Devices
You set up air gapped devices by cutting all network links to outside systems. You then move files and updates across using safe local media or one-way links. Teams often use shared local admin roles on these disconnected machines to speed up fixes. When those local roles are too broad, one bad script can wreck critical data. How to set up air gapped devices Setting up air gapped devices starts at the hardware layer. You remove or disable wireless cards and unplug external network cables. Som
Gapped Devices: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up air gapped devices by cutting all network links to outside systems. You then move files and updates across using safe local media or one-way links. Teams often use shared local admin roles on these disconnected machines to speed up fixes. When those local roles are too broad, one bad script can wreck critical data.
How to set up air gapped devices
Setting up air gapped devices starts at the hardware layer. You remove or disable wireless cards and unplug external network cables. Some teams keep a tiny local switch so isolated servers can talk together. That local network still has zero routes to the public web or office LAN.
Next, you set up local user accounts and group roles on each machine. Because the machines cannot reach cloud identity tools, they check logins locally. Some teams place a local directory server inside the dark room for central roles. You also set strict rules on which ports can accept USB drives or disks.
To apply patches, an engineer first downloads files on an internet-connected workstation. The engineer checks the file hashes and scans the bundle for malware. Then, they write the clean files to a locked flash drive or optical disk. Finally, they walk the media into the secure room and run the update.
What local isolation solves and what it misses
Physical isolation stops remote attackers from reaching your servers over the internet. It blocks outside phishing links, remote command servers, and automated web scanners. If a threat actor cannot route packets to a port, remote exploits fail. This setup protects high-value keys, plant controls, and sensitive databases from external network breaches.
Still, physical isolation only controls how packets enter the room. It does not control what an approved engineer does once logged into a console. During an outage, someone has to walk in or use a local terminal. That person usually logs in with a broad root or database admin role.
Gapped Devices: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Native local accounts only check who logs in at the start of a session. They do not inspect individual commands or database queries while they run. An engineer can run a broad table read or drop a table by mistake. Also, sensitive fields like emails or phone numbers show up in plain text. If local logs live on the same machine, an admin can even alter them.
Managing maintenance sessions on isolated networks
To reduce risk during maintenance, teams must tighten how local sessions work. Start by removing shared admin passwords from all isolated machines. Give every operator a unique local account tied to their real name. This step makes sure local audit logs show who ran a session.
Teams should also separate day-to-day check roles from heavy change roles. A read-only role lets operators check app status without changing system files. When a patch or database fix is needed, require a second person to approve. You should also ship logs across a one-way hardware link to a safe store. That way, no one inside the room can erase the history of their commands.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
How do you update software on air gapped devices?
Engineers download patches on an outside machine and scan them for threats. They verify cryptographic signatures and copy the files onto clean removable media. Then they carry that media to the isolated machine and install the update.
Can air gapped devices still get malware?
Yes, malware can cross the gap on infected USB drives or maintenance laptops. Bad insiders or tricked operators can also run harmful scripts during local sessions. Strict media scanning and tight command controls help reduce this risk.
How do teams audit activity on disconnected servers?
Teams set up local system logging to record user logins and process starts. Many sites send these logs out through a one-way optical data diode. Security teams can then read the logs outside without opening an inbound path.