Securing air-gapped networks: data protection in isolated OT environments

An air-gapped network has no direct connection to the internet or other untrusted networks. It is widely used to protect industrial control systems, SCADA networks and safety-critical infrastructure.

The air gap is real but not absolute. Attackers cross it routinely through USB malware, supply-chain compromise, contractor laptops and undocumented wireless paths. Honeywell's 2024 USB Threat Report found that more than 50% of USB malware is now purpose-built for removable media propagation, up from 9% in 2019.

Inside the air gap, traditional security tools fail. Cloud-managed consoles, signature-based antivirus and online backup all assume connectivity that does not exist.

Effective air-gap data protection needs four things: offline-capable behavioral protection, native air-gap backup and recovery, removable-media controls and operator-led recovery for plant staff.

Acronis Cyber Protect for OT is purpose-built for this. Active Protection runs offline. Acronis Cyber Protect Local manages the platform entirely inside the OT network. Universal Restore handles legacy hardware. The supplier is IEC 62443-4-1 certified.

An air-gapped network has no direct physical or wireless connection to the public internet or any untrusted network. Data moves in or out only through controlled mechanisms: removable media, manual file transfers or unidirectional gateways. It is widely used to protect industrial control systems and SCADA networks in manufacturing, energy, water utilities, oil and gas and pharmaceuticals, plus classified government systems and safety-critical infrastructure.

In OT, air gapping aligns with the Purdue Reference Architecture. Levels 0 to 2 are typically fully isolated. Level 3 is often partially isolated through firewalls and DMZs. Levels 4 and 5 connect to corporate IT. True air gapping is rarely absolute in modern plants, which usually run a spectrum from fully air-gapped to hybrid air-gapped (scheduled exchanges) to logically segmented.

Attackers cross air-gapped networks routinely. USB and removable media are the dominant vector. Honeywell's 2024 USB Threat Report concluded that more than 50% of USB malware is now purpose-built for removable media propagation, designed specifically to bypass the air gaps industrial facilities depend on.

Documented campaigns include Zscaler ThreatLabz's analysis of North Korean APT37 deploying USB-based implants against air-gapped systems (December 2025), ESET's GoldenJackal documentation against EU government targets (2022 to 2024) and Kaspersky's reporting on APT31 implants in Eastern European industrial systems. Stuxnet (2010) remains the canonical supply-chain-via-USB case.

Other crossing vectors: OEM service engineers and contractors bringing infected laptops, unvalidated software updates and undocumented wireless capabilities (Bluetooth, cellular modems, Wi-Fi in maintenance tools) that break assumed isolation without anyone updating the asset inventory.

Most enterprise security tools were designed for connected environments. Inside an air-gapped network, several common assumptions break.

1. Cloud-managed consoles cannot see endpoints they cannot reach.
2. Signature-based antivirus goes stale fast when updates do not arrive on the normal cadence.
3. Cloud-first backup assumes the destination is reachable. Air-gapped backup needs local storage as a first-class option.
4. Legacy operating system support is missing in most current tools. OT plants run Windows XP, Server 2003 and older Linux kernels because the OEM-certified application requires that exact version.
5. Operator-led recovery workflows for plant staff are absent. Generic enterprise backup assumes an IT engineer is on the keyboard.

These controls map to IEC 62443-3-3 (SR 7.3 data backup integrity and SR 7.4 system recovery) and NIST SP 800-82 Rev 3 compensating-control guidance.

1. Verified asset inventory of every device on the air-gapped network: PLCs, RTUs, HMIs, SCADA servers, engineering workstations and historians. The exercise often surfaces undocumented wireless or cellular paths.
2. Removable-media controls: sanctioned-only USB devices, sanitization stations at facility entrances, disabled USB ports where not required and audit logging.
3. Offline-capable behavioral protection that detects ransomware behavior, anomalous process activity and unauthorized encryption without cloud signature updates. Acronis Active Protection runs offline by design.
4. Air-gap-native backup and recovery with image-based backup of HMI, SCADA and engineering workstations on local storage, operator-led one-click restoration, dissimilar-hardware restore and backup scanning before restoration.
5. Sanitization of every inbound file: behavioral scan, content disarm and reconstruction, hash verification against vendor checksums.
6. Plant-floor management of protection tools, with the management console running entirely inside the OT network. Acronis Cyber Protect Local delivers exactly this.

Acronis Cyber Protect for OT is the only platform in the OT backup and recovery category designed natively for air-gapped operation. It is deployed in production at ABB, Schneider Electric, Toyota, Tata Steel, Sasol and BDR Pharmaceuticals.

IEC 62443-3-3 SR 7.3 and SR 7.4 cover backup integrity and system recovery. IEC 62443-4-1 covers supplier SSDLC (Acronis is certified). NIST SP 800-82 Rev 3 provides compensating-control language for legacy systems. NIS 2 Article 21 requires business continuity, backup management and disaster recovery for essential and important entities. NERC CIP-007 and CIP-009 cover system security management and recovery plans for the bulk electric system. GxP regulations cover data integrity in pharma. Air-gap-compatible backup is a central technical control supporting all of them.

Air gapping is a strong control but not an absolute one. Attackers cross air-gapped networks routinely through USB malware, supply-chain compromise, contractor laptops and undocumented wireless paths. Treat the air gap as one layer of defense, combined with offline-capable behavioral protection, removable-media controls and robust backup and recovery.

Yes. Active Protection runs offline. Acronis Cyber Protect Local provides plant-floor management entirely inside the OT network. Storage destinations include local disk, NAS, SAN, private cloud or Acronis Cloud, configured per plant policy.

An air-gapped network is the operational environment itself. An immutable backup is a backup copy protected against modification or deletion. An offline backup is a backup copy physically disconnected from production. A complete OT data protection architecture typically uses all three together.

1. Honeywell 2024 USB Threat Report
2. Zscaler ThreatLabz, ScarCruft Ruby Jumper campaign analysis (December 2025)
3. "A survey on malware attacks in industrial air-gap systems," International Journal of Information Security (2025)
4. SANS 2025 State of ICS/OT Cybersecurity Survey
5. NIST SP 800-82 Rev 3, September 2023
6. ISA/IEC 62443 family
7. EU NIS 2 Directive (Directive 2022/2555)
8. NERC CIP-007, CIP-009
9. FDA 21 CFR Part 11
10. Acronis Cyber Protect for OT product page: acronis.com/en/products/cyber-protect-ot/
11. Acronis Manufacturing industry page: acronis.com/en/industries/backup/manufacturing/