Latest articles
Filed from the operations desk this quarter.
Why always-on reachability increases risk, and how exposure time turns that risk into a measurable operating variable.
Piotr Wierzba (recommended: replace this byline with an industry expert) · MAY 12, 2026 · 9 min readThe air gap never disappeared. What changed is the operating model: controlled, auditable connectivity windows instead of permanent isolation.
Piotr Wierzba (recommended: replace this byline with an industry expert) · MAY 19, 2026 · 9 min readA plain-English guide to data diodes, one-way transfer, unidirectional gateways, and the buyer questions that matter in OT and critical infrastructure.
AirGapNet Editorial Team · JUNE 18, 2026 · 11 min readFirewalls are flexible policy controls. Data diodes remove the return path. The right choice depends on whether an OT boundary needs controlled two-way exchange or enforceable one-way transfer.
AirGapNet Editorial Team · JUNE 18, 2026 · 12 min readThe data diode enforces direction; the unidirectional gateway is the deployable system around it. A practical guide to protocols, buffering, deployments and buyer questions.
AirGapNet Editorial Team · JUNE 19, 2026 · 10 min readMonitoring should not require an inbound route into the protected network. One-way log forwarding sends telemetry outward while removing the reverse path the SOC would otherwise need.
AirGapNet Editorial Team · JUNE 19, 2026 · 10 min readRisk = Attack Surface x Vulnerability x Exposure Time. The Time variable is the one most teams never measure. Here is a method to quantify and then reduce it.
AirGapNet Editorial Team · JUNE 20, 2026 · 11 min readA permanent air gap is hard to operate. A time-based one keeps assets disconnected by default and reconnects them under control, shrinking the window an attacker can use.
AirGapNet Editorial Team · JUNE 20, 2026 · 11 min readIf attackers can reach your backups, they will encrypt them too. Combining immutability with one-way replication and disconnection keeps at least one copy genuinely out of reach.
AirGapNet Editorial Team · JUNE 21, 2026 · 11 min readA baseboard management controller can power, reimage and console a server below the operating system. That power, left always reachable, is exactly what attackers want.
AirGapNet Editorial Team · JUNE 22, 2026 · 10 min readA historian holds the data everyone wants and sits where no one should be able to reach. One-way replication lets the data out without giving anyone a route back in.
AirGapNet Editorial Team · JUNE 23, 2026 · 10 min readVendors need occasional access; standing access is what keeps biting. The fix is to make connectivity exist only during approved, time-boxed and provable windows.
AirGapNet Editorial Team · JUNE 24, 2026 · 10 min readZones and conduits turn a flat OT network into a structured one. A practical look at the model, security levels, and which control belongs on which conduit.
AirGapNet Editorial Team · JUNE 24, 2026 · 12 min readNIS2 raises the baseline for cybersecurity risk management and incident reporting across essential and important entities. Here is what it means for operational technology.
AirGapNet Editorial Team · JUNE 25, 2026 · 11 min readA data diode is the right control only for a specific shape of problem. Here are the OT scenarios where one-way transfer genuinely earns its place, and where it does not.
AirGapNet Editorial Team · JUNE 19, 2026 · 11 min readTCP wants acknowledgements; a diode permits none. The interesting engineering of one-way transfer is how it carries real protocols across a boundary that can never reply.
AirGapNet Editorial Team · JUNE 20, 2026 · 11 min readThe Purdue model gives OT teams a shared map of the plant. A practical walk through its levels, the IT/OT DMZ, and how to apply it without treating it as gospel.
AirGapNet Editorial Team · JUNE 21, 2026 · 11 min readConvergence connected the plant to the enterprise for good reasons. Securing it means controlling one boundary well: data out, control firmly held, exposure minimized.
AirGapNet Editorial Team · JUNE 21, 2026 · 10 min readAttackers rarely start in the plant; they arrive from IT. Understanding the pivots they use across the boundary is the key to removing the path rather than just watching it.
AirGapNet Editorial Team · JUNE 22, 2026 · 10 min readMalware is loud only when it can phone home. C2 depends on a persistent path to the attacker, which is exactly what always-on connectivity quietly provides.
AirGapNet Editorial Team · JUNE 23, 2026 · 10 min readThe systems that run physical processes were designed to be reliable and open on a trusted network. Securing them is mostly about who can reach them, and when.
AirGapNet Editorial Team · JUNE 24, 2026 · 11 min readAn air gap stops network attacks, not the USB stick that crosses it. Removable media remains one of the most reliable ways into isolated industrial systems.
AirGapNet Editorial Team · JUNE 24, 2026 · 10 min readNIST SP 800-82 is the reference guide for securing operational technology. A practical look at its themes, its architecture advice, and how to use it alongside other frameworks.
AirGapNet Editorial Team · JUNE 25, 2026 · 12 min readDORA makes digital operational resilience a regulated outcome for financial entities and their providers. Its principles reach any operation that depends on resilient ICT.
AirGapNet Editorial Team · JUNE 25, 2026 · 11 min readAn air gap is the strongest isolation and the hardest to live with. A clear look at what it really protects against, why pure air gaps erode, and what replaces them.
AirGapNet Editorial Team · JUNE 19, 2026 · 11 min readWhen data must move between a high-trust and a low-trust network without leaking the wrong way, a cross-domain solution is the controlled, inspected, assured bridge.
AirGapNet Editorial Team · JUNE 20, 2026 · 11 min readMost OT ransomware does not target controllers directly; it spreads from IT until production has to stop. Understanding the path is how you contain the blast radius.
AirGapNet Editorial Team · JUNE 21, 2026 · 11 min readThe most trusted path into OT is the update. Supply chain attacks exploit exactly that trust, arriving through software, firmware and vendor channels you let in on purpose.
AirGapNet Editorial Team · JUNE 22, 2026 · 11 min readIt can reprogram the controllers that run the process, and it often has a foot in both worlds. The engineering workstation is the pivot attackers want most.
AirGapNet Editorial Team · JUNE 23, 2026 · 10 min readBuilding management systems are operational technology too, controlling HVAC, access and power, yet they are often the most exposed and least defended systems on the network.
AirGapNet Editorial Team · JUNE 24, 2026 · 10 min readIn OT you often cannot patch on demand, and sometimes not at all. Effective OT patch management is as much about compensating controls as about applying updates.
AirGapNet Editorial Team · JUNE 24, 2026 · 11 min readWhen the systems at the center cannot defend themselves, security has to come from the layers around them. Defense in depth, done with intent rather than by accident.
AirGapNet Editorial Team · JUNE 25, 2026 · 11 min readZero trust was built for identity-rich IT. OT has legacy protocols, no identity and real-time limits. What survives the translation, and what you do where it does not.
AirGapNet Editorial Team · JUNE 25, 2026 · 11 min readISO/IEC 27001 gives you a management system for security. Applying it to OT means adapting its risk-based approach to systems where availability and safety come first.
AirGapNet Editorial Team · JUNE 25, 2026 · 11 min readWater systems are critical infrastructure run on lean budgets, with remote sites and internet-exposed controls. Their security often comes down to reducing reachability.
AirGapNet Editorial Team · JUNE 19, 2026 · 11 min readSubstations sit at the grid edge: frequently unmanned, packed with intelligent devices, and increasingly remote-managed. Securing them is a problem of access and reachability.
AirGapNet Editorial Team · JUNE 20, 2026 · 11 min readConnectivity made factories smarter and more exposed. Securing smart manufacturing means letting production data flow out while keeping the floor from becoming a target.
AirGapNet Editorial Team · JUNE 21, 2026 · 11 min readIndustrial protocols were built to be reliable, not secure. Modbus and DNP3 trust whatever can reach them, which is why protecting them is a network problem, not a protocol one.
AirGapNet Editorial Team · JUNE 22, 2026 · 11 min readIIoT sensors talk to the cloud from deep inside the plant, sidestepping the careful boundaries OT spent years building. The fix is to keep their data outbound only.
AirGapNet Editorial Team · JUNE 23, 2026 · 10 min readThe SIS exists to prevent disaster when everything else fails. The Triton attack proved attackers will target it, which is why its isolation is non-negotiable.
AirGapNet Editorial Team · JUNE 24, 2026 · 11 min readEvery OT security control assumes you know what you are protecting. Most programs do not, which is why asset inventory is the unglamorous foundation everything rests on.
AirGapNet Editorial Team · JUNE 24, 2026 · 10 min readIn IT you can isolate and rebuild. In OT, the wrong response can be more dangerous than the incident. OT incident response is a discipline of its own.
AirGapNet Editorial Team · JUNE 25, 2026 · 11 min readA handful of attacks reshaped how the world sees industrial cyber risk. Their details differ, but the lessons converge on the same fundamentals.
AirGapNet Editorial Team · JUNE 25, 2026 · 12 min readNERC CIP is mandatory, enforceable cybersecurity regulation for the bulk electric system. A practical look at its structure and how boundary controls support it.
AirGapNet Editorial Team · JUNE 25, 2026 · 12 min readA practical guide to moving patches, firmware, signatures and engineering files into a protected OT network without opening an inbound route an attacker can ride back.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readCloud analytics needs OT data, but the OT network should not accept a route back. A practical guide to outbound-only telemetry, push patterns, and one-way transfer.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readPassive OT network monitoring gives you visibility into industrial assets and threats without injecting traffic into fragile control systems. Here is how it works, what it catches, and how to feed it data without opening a path back in.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readMITRE ATT&CK for ICS is a knowledge base of how adversaries behave inside OT networks. Used well, it turns abstract threat fear into a concrete map of techniques, detections and controls.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readA plain-English guide to standing up an OT security operations center: passive monitoring, one-way telemetry export, ICS-specific detection, and the standards that frame the work.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readPipelines are long, remote and process-critical. This guide explains the threat model, the SCADA architecture, the controls that matter, and where one-way data transfer fits.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readWi-Fi and private 5G can connect mobile assets, sensors and remote sites that cable cannot. They also add radio attack surface. Here is how to secure OT wireless without giving an attacker a path into the process.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readA practical guide to application allowlisting on OT endpoints: what it is, why it suits long-lived industrial hosts, how it maps to standards, and where one-way transfer reduces the risk it cannot.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readThe CISA CPGs are a voluntary, prioritized baseline of cybersecurity practices for critical infrastructure. This guide explains the OT-relevant goals, how they map to NIST CSF and 800-82, and where one-way transfer fits.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readOT disaster recovery is about restoring physical processes safely, not just rebuilding servers. A plain-English guide to planning, golden backups, recovery sequencing, and how one-way transfer protects the copies you will need.
AirGapNet Editorial Team · JUNE 26, 2026 · 12 min readAn industrial DMZ is the buffer zone where OT and IT meet without touching directly. This is the practical build: brokers, replicated services, and no straight path from Level 4 to the cell floor.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readA jump server is the single brokered chokepoint for human access into an OT zone. Done well it enforces MFA, records sessions and removes direct inbound paths; done badly it becomes the foothold attackers want.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readOPC UA can be one of the most secure industrial protocols or one of the most exposed, depending on how security modes, certificates, user tokens and discovery are configured.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readSignalling, interlockings and rolling stock are safety-critical OT. A practical look at the rail threat model, TS 50701 and IEC 62443 zoning, and where one-way transfer reduces exposure.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readShips and ports run real machinery on legacy OT. This guide maps the bridge, the terminal and the dock to practical controls, the IMO and IACS rules now in force, and where one-way data flow reduces exposure.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readWind farms, solar plants and distributed energy resources are remotely managed, internet-connected fleets. Securing them means controlling who can reach inverters, turbine SCADA and DERMS, and letting generation data leave without opening a path back in.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readIn OT, most known vulnerabilities will never be patched on schedule. Triage is the real control: rank by exploitability and consequence, then reduce exposure for the rest.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readCCE assumes a determined adversary gets in. It works backward from the worst physical outcome, then engineers the digital pathways to that outcome out of the system.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readOT risk assessment ranks consequence first. This guide walks the IEC 62443-3-2 method, cyber PHA consequence analysis, likelihood versus impact, and how reducing reachability lowers risk you cannot patch away.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readInfusion pumps, imaging systems and patient monitors are clinical OT. Securing them means asset visibility, network segmentation, and reducing how much these devices can be reached from the rest of the hospital network.
AirGapNet Editorial Team · JUNE 27, 2026 · 12 min readNuclear plants protect digital safety systems with security levels, strict isolation, and one-way data flow. This guide explains the rules, the architecture, and the controls that hold.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readA practical guide to securing process safety in chemical plants: protecting the control and safety systems that keep reactive chemistry inside its limits, after CFATS lapsed in July 2023.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readData centers run on operational technology most security teams never see: the power chain, the cooling plant, and the building and DCIM systems that keep racks alive. Here is how to secure that critical-facility OT without trading away uptime.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readA practical guide to deploying and configuring industrial firewalls in OT, with deep packet inspection of Modbus, DNP3 and EtherNet/IP down to the function code and register.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readIn OT, identity is often shared, local and hard to revoke. Strong IAM and PAM reduce who can reach control systems, prove what they did, and shrink the standing access that attackers depend on.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readA practical guide to segmenting OT and ICS networks: VLANs, zones and conduits, east-west control, deny-by-default policy, and where firewalls and one-way transfer belong.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readProtective relays, PMUs and sequence-of-events records all depend on accurate time. Here is how OT time distribution works, how it is attacked, and how to harden NTP, PTP and GNSS sources.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readA practical guide to standing up an OT security program: who owns what, how IEC 62443-2-1 and the DOE C2M2 maturity model shape the roadmap, and how to fund and measure it.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readA practical guide to OT-specific cyber threat intelligence and hypothesis-driven threat hunting: tracked ICS activity groups, IOCs versus TTPs, ATT&CK for ICS, and the intel sources that actually move OT decisions.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min readA practical guide to device-level firmware integrity in OT and ICS: secure boot, authenticated updates, hardware root of trust, firmware SBOMs and tamper detection, and where one-way transfer reduces exposure.
AirGapNet Editorial Team · JUNE 28, 2026 · 12 min read