Due to its unique nature, operational technology (OT) can be tricky to secure. One strategy that has long been deployed to protect OT devices in cyber-physical systems (CPS) is air gapping. Because air gapping as a form of securing systems has been around for a long time, it can be seen as irrelevant in the face of newer forms of cyber protection. But is air gapping still a relevant form of cybersecurity for OT environments? Let’s dive into the topic of air gapping - from what it is to its practical application today.
Air Gapping OT Environments
OT environments controlling the physical operations in industries from power grids to industrial manufacturing are high-risk targets for cyber criminals. This is because they manage and control physical devices that ensure the safety and reliability of critical infrastructure. Consequences of cyber attacks to these environments may include facility shutdowns, equipment malfunctions, and even could cause power plant explosions.
An air gapped network aims to protect these operations from such an event. As air gapping is most typically used in military or government systems, protecting the physical operations of these critical functions is paramount.
What is Air Gapping?
Air gapping is one method of securing devices by isolating a device or group of devices from connectivity outside of the air-gapped network, meaning data is not entering or exiting the air gapped environment. Because an air-gapped network is separate from all other networks, air gapped devices cannot be reached by any assets that are not connected to the air gapped environment, securing them from potential threats that could infiltrate the network connection.
Think of air gapping like a physical fortress - protected from attacks unless accessed physically.
How Practical is Air Gapping in OT Environments?
Air gapping has long been a strategy used to protect OT devices specifically because OT devices typically lack built-in security measures, communicate in diverse protocols, and require meticulous management and a high level of cybersecurity due to the critical operations they control. Since air gapping can provide the most secure form of defense, in theory, it can also be seen as impractical because of the interconnectivity of IT and OT in modern systems.
This connectivity, data sharing, and remote management are a basic requirement in today’s industrial systems, all of which can be restricted by the needs of air gapping. Therefore, air gapping requires thoughtful consideration of where it can be applied in an OT environment.
Is Air Gapping Still Relevant?
Despite what some may believe, air gapping is still a useful and practical cybersecurity strategy. The fundamental advantage it provides by preventing unauthorized access to a system is very useful in OT environments. Cyber threats in OT environments are rising and the severity of an OT system breach makes it unlikely that air gapping will ever be completely abandoned as a strategy.
With this in mind, however, and with the growing interconnectivity of today’s technology, air gapping cannot be the only cyber resilience strategy employed in OT environments, particularly not when protecting critical infrastructure. Air gapping should be seen as one of many effective ways to prevent attacks to the OT environment.
Modern Approaches and Use Cases to Air Gapping
The world of OT cybersecurity is experiencing a shift from traditional air gapped networks towards hybrid models. While proper air gapping is very effective against cyber threats, in today’s interconnected world air gapped networks must also allow for limited connectivity under controlled conditions that can offer the best of both secure and connected systems.
For example, a power plant may have control systems that operate the machines that are best protected by air gapping in order to mitigate the risk of threats to such a critical system. But it’s equally as important for data analysis and predictive maintenance systems to reside on connected networks in order to leverage real-time data and cloud capabilities that could otherwise be hindered by air gapping.
Taking a modern approach that reaps the benefits of traditional air gapping while embracing the reality of connectivity can streamline operations without compromising on security.
Take Steps to Protect Your Air Gapped Network
While air gapping is not obsolete, it must be paired with other forms of cybersecurity to be truly effective. One of the most important steps to take alongside traditional air gapping is deep asset visibility. Without visibility you cannot be totally sure that every asset is protected. Because OT devices pose challenges for visibility, choosing the right platform with unmatched asset discovery capabilities is paramount.
Consider a solution like Claroty, which offers OT-specific asset visibility capabilities, from broad proprietary protocol understanding to the ability to discover how and when assets communicate, their connectivity paths, and the ability to identify anomalies in your environment.
To learn more about how Claroty further protects air gapped networks and its capabilities for protecting OT industrial and public sector environments, speak with a member of the Claroty team.
