Air gaps

An air gap means a system with no network connection to anything else. It is the strongest isolation available and it is not absolute.

Things still cross. USB drives, the maintenance laptop that goes between sites, software updates that have to arrive somehow, the equipment the supplier brings with them. Several well-documented incidents in isolated environments began exactly this way. An air gap removes the ordinary remote path, which is a great deal. It does not remove every path, and treating it as if it did is how the remaining ones stop being watched.