What is an air gap?
An air gap is the absence of a network connection. Its defining property is simple: there is no path for a remote command or an exploit to cross.
Physical air gap, defined
In a physical air gap the storage has no active network interface while it is isolated. There is no address to reach, no listening service and no cable or radio link. Reconnection is a separate, controlled event.
- No network interface
- No address to reach
- No listening service
- Independent reconnection
Why true physical air gapping starts at Layer 1
Physical air gapping is a hardware state at OSI Layer 1. Every control above it, from firewalls to identity, only matters once a path exists. Remove the path and those layers have nothing to defend.
Remove Layer 1. Remove the attack surface.
Logical air gap, defined
A logical air gap keeps the network connection and restricts access with software. It is useful, and it is a different thing.
- Network segmentation
- Separate credentials
- Immutability and retention locks
- Delayed or one-way replication
- Air gap scheduling
What is a “virtual air gap”?
It is a vendor term for a bundle of logical controls, not a physical disconnection. Treat any claim that puts “virtual”, “software defined” or “logical” next to “air gap” as logical isolation.
Physical versus logical, side by side
Physical gaps have no network path; logical gaps have a restricted one. They defend against different attackers and fail in different ways.
| Property | Physical air gap | Logical air gap |
|---|---|---|
| Network path | None while isolated | Present, restricted by policy |
| What an attacker needs | A separate, out-of-band reconnection | Credentials, a misconfiguration or a flaw |
| Fails when | The reconnection process is abused | Identity, configuration or the platform fails |
| Best for | The last trusted copy | Fast recovery from limited incidents |
How a logical air gap fails
The difference matters most when an attacker already has privileged access to the connected estate. At that point the logical controls are reachable too.
LogicalAn attacker disables immutability or deletes the retention policy.
PhysicalUnaffected: there is no console to reach.
LogicalRetention locks are shortened, bypassed or expire early.
PhysicalDoes not depend on a policy setting.
LogicalA VLAN, firewall rule or trunk port exposes an isolated segment.
PhysicalNo segment to misconfigure while the interface is inactive.
LogicalA flaw in a controller, hypervisor or network stack bypasses access controls.
PhysicalNothing to reach across a path that does not exist.
How to test a vendor’s air gap claim
Four questions separate a physical claim from a logical one. Ask them in this order.
- 1Does the storage have an active network interface while it is described as air gapped?
- 2Can it be reached, scanned or pinged in that state?
- 3Can any software on the connected estate reconnect it without a separate action?
- 4Who independently audits isolation and reconnection events?
How the standards frame isolation
ISO/IEC 27040 treats isolation, air gapping and immutability as distinct controls. NIST SP 800-207 and SP 1800-11 stress not trusting identity and policy by default, and keeping a recovery source that is not exposed to the same compromise. NCSC guidance asks for at least one backup copy that an attacker with network access cannot reach.
How Firevault applies these principles
Offline Secure Storage® uses a physical air gap: the storage is physically disconnected at the hardware level, and connection windows are identity verified and managed from a separate plane. Control extends physical governance to selected network paths, and Firebreak® isolates segments of an estate during an incident. They complement immutable, network-connected backup rather than replace it.
An air gap is a claim about physics, not a claim about policy.
Questions
A physical air gap removes the network path at the hardware level. A logical air gap keeps the path and restricts it with software, so it depends on identity and configuration holding.
No. Immutability is a logical control on a connected system. It is valuable, and it is not the same as having no network path.
No. They do different jobs. Use both, and document which category each copy falls into.
No. Both restrict a path that still exists. They are segmentation, which is logical isolation.
Sources and further reading
- ISO/IEC 27040:2024, Storage security
- NIST SP 800-207, Zero Trust Architecture
- NIST SP 1800-11, Data Integrity: Recovering from Ransomware and Other Destructive Events
- NCSC, Offline backups in an online world
- CISA, #StopRansomware Guide
About the author
Mark FermorCo-Founder of Firevault. Mark writes on physical control, offline storage and the incidents that show why both matter.
