Airgapped Network
An airgapped network isolates critical servers from the public internet and outside LANs. You build one by removing external network links and controlling local data transfers. Teams often set up local admin accounts for emergency fixes inside the enclave. Broad local roles create huge risks once an operator logs in. A single bad command can wipe tables or expose private rows. How an airgapped network works in practice Physical isolation is the first step in this architecture. Engineers unplu
Network: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
An airgapped network isolates critical servers from the public internet and outside LANs. You build one by removing external network links and controlling local data transfers. Teams often set up local admin accounts for emergency fixes inside the enclave. Broad local roles create huge risks once an operator logs in. A single bad command can wipe tables or expose private rows.
How an airgapped network works in practice
Physical isolation is the first step in this architecture. Engineers unplug external cables and disable wireless cards on every host. No traffic flows between the outside world and the inner zone. All switches and routers inside the room link only to local machines.
Moving software updates into the room requires strict manual steps. Operators copy patches onto clean flash drives or optical discs. A scan station checks the media for malware before anyone loads it. After the scan passes, an admin walks the drive to the target host.
Identity checks must also run without reaching cloud services. Teams host local directory servers inside the isolated room. Operators log in at local consoles using hardware tokens and passwords. The local directory checks the user and grants a machine role. Database engines and app hosts trust this local directory for all logins.
What physical isolation solves and where it falls short
An airgapped network stops remote hackers from reaching your servers over the web. Outside bots cannot scan your ports or steal keys from afar. Phishing links cannot pull data out to an external command server. Physical separation blocks network worms that spread across standard office links.
Still, physical walls only decide who enters the room and logs in. Isolation does not control what commands an admin runs during a session. Once an operator opens a database prompt, native roles grant broad power. A tired engineer can still drop a critical table by mistake.
Local admin accounts also make audit trails hard to trust. Many isolated setups rely on shared root keys for emergency fixes. When five people know the same password, logs cannot name the real user. Auditors see the shared role name instead of a specific person.
Network: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Sensitive data exposure is another major gap inside the room. Local operators often run queries to fix broken app states. Those queries return raw emails, phone numbers, and card numbers on screen. Standard database permissions return the whole row or nothing at all. Masking rules that rewrite matched fields in results are rarely built in.
Managing updates and logs inside the enclave
Keeping isolated systems healthy takes clear daily routines. Teams must collect logs from every host and store them safely. Because cloud log tools are unreachable, admins run a local log server. Hosts send system events to this central box over internal wires.
Reviewing those logs requires manual work or local scripts. Security staff must visit the room or pull log files out on media. If a local admin has root rights on the log box, they can delete files. Separating server admins from log admins is vital inside the room.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev sits inline in the wire protocol beside those services as an open-source proxy, a sidecar for your Postgres or API. On every query an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human review.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the main purpose of an airgapped network?
It protects critical systems by cutting all physical and wireless links to outside networks. This stops remote attackers from stealing data or breaking into hosts over the internet.
How do teams update software inside an airgapped network?
Engineers download patches on an outside machine and copy them to clean removable media. They scan the media at a staging station before loading files onto isolated hosts.
Why do isolated networks still need strict session controls?
Physical walls do not stop human error or insider threats at the local console. Session controls check individual commands and rewrite sensitive fields like card numbers in query results.