Air-gapped Network File Decontamination
You run air gapped network file decontamination by scanning files on an isolated staging system. You strip active scripts and rebuild clean copies before moving data into your isolated network. Most teams set up a physical kiosk or staging zone to handle these file transfers. Engineers mount removable drives, run antivirus tools, and copy safe files to a clean drive. This process works well for basic file checks. Still, broad permissions inside the isolated network still create big risks once fi
Lock File Integrity: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You run air gapped network file decontamination by scanning files on an isolated staging system. You strip active scripts and rebuild clean copies before moving data into your isolated network. Most teams set up a physical kiosk or staging zone to handle these file transfers. Engineers mount removable drives, run antivirus tools, and copy safe files to a clean drive. This process works well for basic file checks. Still, broad permissions inside the isolated network still create big risks once files arrive. If a user holds admin rights, one bad file or command can damage core systems.
How air gapped network file decontamination works
A secure file transfer starts outside the isolated network. An engineer brings a file on a thumb drive or optical disk to a kiosk. The kiosk does not have a route to the main network. First, the system checks the user role and logs the request. Next, the kiosk runs multiple antivirus engines to look for known threats. Static analysis tools check the file headers to verify the true file type. If a text file hides binary code, the system blocks the transfer right away.
Good workflows also use content disarm and reconstruction. This method does not just look for bad code. Instead, it breaks the file down into raw parts. It strips out macros, embedded scripts, and active links from documents or images. Then, the tool builds a brand new file using only safe, clean parts. Finally, the kiosk writes the clean file to a dedicated internal drive or one-way link. An operator then moves that clean file into the isolated network for use.
What file scrubbing solves and what it misses
File scrubbing stops malware from riding into your network on a thumb drive. It catches known viruses and removes hidden macros from office documents. It also creates an audit log of which user brought a file across the boundary. For compliance and basic safety, this step is vital.
Still, file checks only look at data before it enters the network. They do not control what users or apps do with those files later. Once an engineer logs into an internal server, native roles decide what they can run. Most internal setups grant broad access for an entire login session. They check who logs in, not what each command or query does in flight. An engineer importing a database script can still run a bad query by mistake. Also, internal scripts and files can hold raw sensitive data like emails or card numbers. If a user queries that data, native file checks will not mask those fields. Teams need runtime controls inside the network to inspect commands and rewrite sensitive results.
Lock File Integrity: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
How to tighten internal file and data workflows
Start by separating the role that imports files from the role that runs them. The person who brings a patch in should not hold root permissions on production servers. Set up strict file type rules on your staging kiosk. Block archives with passwords because scanners cannot read inside them. Require a second person to approve any executable file or database script before import.
Inside the air gap, limit what users can do after they log in. Replace shared admin accounts with personal logins tied to your directory. Check every database query and shell command before the server runs it. When users query tables with phone numbers or national IDs, use masking to rewrite matched fields in results. This keeps sensitive records safe even when engineers need to read logs or test files.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev sits inline in the wire protocol beside those services as an open-source proxy, a sidecar for your Postgres or API. On every query an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human review.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is content disarm and reconstruction in an air gap?
It is a process that breaks a file down and strips all active code. The tool then builds a new file with only safe text and basic formatting.
Why are password-protected archives risky during file transfers?
Scanners cannot open encrypted zip files to check for malware or hidden scripts. You should block encrypted archives at the staging kiosk or require decryption during scanning.
Does file scanning protect databases inside the isolated network?
No, file scanning only checks files at the border before they enter the network. You still need runtime checks to control queries and mask emails or card numbers inside.