Plenty of plants believe their control network has zero outside connection, right up until someone finds the vendor's cellular modem bolted to a PLC cabinet. Here is what "air gapped" really means, how it compares to a properly segmented network, and which one actually holds up. This guide breaks down air gapped vs segmented ICS networks in plain, plant floor language.
"Don't worry, it's air gapped" is one of the most repeated sentences in industrial security, and one of the most often wrong. A true air gap and a properly segmented network solve the same problem in opposite ways. Only one of them tends to survive contact with reality. That contrast is the whole story behind air gapped vs segmented ICS networks.
Vendors want remote diagnostics. Operations wants live dashboards. Maintenance wants firmware updates without sneakernet. Each of those needs quietly chips away at an "air gapped" network until it isn't one anymore. This tension is exactly what makes air gapped vs segmented ICS networks worth comparing carefully.
This guide breaks down what air gapping and segmentation actually mean, compares them side by side, and works through what real incidents like Stuxnet and the Ukraine grid attacks actually teach us about each approach, mapped onto the zone and conduit model defined in IEC 62443.
Two Ways to Think About Isolation
A true air gap removes the connection entirely. Segmentation assumes a connection is inevitable and controls it instead. Both are trying to solve the same problem, keeping an attacker away from safety and control assets, but they start from opposite assumptions. That difference is the whole argument at the center of air gapped vs segmented ICS networks.
True Air Gap
No physical or logical connection at all. Every transfer happens by hand, on removable media. Genuinely rare in modern plants. This is one end of air gapped vs segmented ICS networks.
Notional Air Gap
Believed to be isolated, but has one or two undocumented connections, a modem, a shared laptop, that nobody has fully mapped. Most real world air gapped vs segmented ICS networks start out looking like this.
Security Zone
A group of assets sharing the same criticality and consequence of compromise, treated as one security unit. Zones like this sit on the segmented side of air gapped vs segmented ICS networks.
Conduit
Every explicit, controlled pathway between two zones. Anything that isn't a defined conduit is assumed to be blocked. Conduits like this define the segmented half of air gapped vs segmented ICS networks.
The Air Gap Myth: Why True Air Gaps Rarely Exist
Stuxnet, discovered in 2010, was built to spread through infected USB drives specifically because its target was believed to be air gapped. It didn't need a network path at all. It needed one person to plug in a drive. Stuxnet is the case most often cited in any discussion of air gapped vs segmented ICS networks.
That single fact undercuts the whole assumption behind air gapping. Removing the network connection doesn't remove the human element, and the human element is usually the real attack surface.
An air gap doesn't eliminate conduits. It just makes them informal, undocumented, and carried by hand instead of engineered and monitored. That distinction is central to the whole debate over air gapped vs segmented ICS networks.
Air Gapped vs Segmented: Side by Side Comparison
Laid out factor by factor, the trade offs between air gapped vs segmented ICS networks become clear fast.
| Factor | Air Gapped | Segmented |
|---|---|---|
| Remote monitoring | Not possible without breaking the gap | Supported through logged conduits, one of the clearest differences in air gapped vs segmented ICS networks |
| Patch management | Manual, relying on physical media, often delayed | Automated through a DMZ patch server |
| Network intrusion risk | Very low, if truly isolated | Reduced, depends on conduit controls |
| Removable media risk | High, becomes the primary vector | Lower, since media can be scanned and controlled |
| Cost to maintain | Low tech cost, high operational friction | Higher setup cost, lower ongoing friction |
| Auditability | Difficult, since informal transfers go unlogged | Strong, since conduits are built to be reviewed, a factor that often decides air gapped vs segmented ICS networks debates |
| Integrity over time | Degrades as informal connections creep in | Holds up if conduit governance is kept current |
Real World Incidents: What They Actually Show
The Incident
Stuxnet malware, discovered in 2010, targeted an industrial facility widely believed to be fully air gapped.
What Actually Happened
The malware spread entirely through infected USB drives carried in by people, with no network path required at any point.
How It's Often Misread
It's frequently cited as proof that plants need tighter air gapping. The real lesson points the other way when weighing air gapped vs segmented ICS networks.
The Real Lesson
Transfers carried by hand need the same rigor as network conduits: scanning stations, controlled media, and logging of what moves and who moved it.
The Incident
Attacks on Ukraine's power grid in 2015 and 2016 hit networks that were segmented, but not tightly enough.
What Actually Happened
Attackers gained a foothold through corporate side phishing, then pivoted into operational systems where remote access pathways were broader than they should have been.
How It's Often Misread
It's often cited as an argument for air gapping instead. That misses what actually failed.
The Real Lesson
Segmentation only works if conduits are as tightly controlled as the zone and conduit model calls for. A diagram showing segmentation isn't the same as segmentation that's enforced, a lesson that applies to air gapped vs segmented ICS networks everywhere.
Which Is Actually More Secure? A Decision Framework
Check for a genuine business case for zero connectivity
Very few facilities have one once remote support and predictive maintenance enter the picture, though some high consequence safety systems genuinely do. This is the first question in any real comparison of air gapped vs segmented ICS networks.
Plan for segmentation if any external data need exists
An engineered, monitored conduit is safer than one that gets created informally out of operational necessity later. This step tends to decide most air gapped vs segmented ICS networks debates.
Treat removable media as the primary risk where a true air gap is chosen
Dedicated scanning stations, single use media, and strict transfer logging matter more than the network boundary itself, whichever side of air gapped vs segmented ICS networks a facility lands on.
Invest in conduit governance, not just architecture
Every conduit needs an owner, a review cycle, and monitoring, or it decays into the same informal risk an air gap has. Governance like this is what actually separates the two sides of air gapped vs segmented ICS networks.
The honest answer is that a rigorously governed segmented architecture generally outperforms a nominal air gap, because it assumes connections exist and builds controls around them instead of being caught flat footed when they appear. That is the real verdict on air gapped vs segmented ICS networks.
Hardening Techniques Worth Knowing
These techniques apply to both sides of air gapped vs segmented ICS networks, not just one architecture.
Locked Physical Ports
Secure unused USB and Ethernet ports against informal connections on either side of air gapped vs segmented ICS networks.
Media Scanning Station
A dedicated checkpoint for every removable media transfer.
MFA Jump Host
Controlled, logged remote access instead of a direct path in.
Conduit Inventory
A living, owned record of every documented pathway across air gapped vs segmented ICS networks.
DMZ Traffic Monitoring
Watch for anomalies at the boundary, not just at the perimeter.
Periodic Physical Audit
Catch undocumented connections vendors or staff may have added.
Do's and Don'ts for Either Architecture
These habits hold up no matter which side of air gapped vs segmented ICS networks a facility chooses.
✔ Do
- Treat every legitimate data need as a conduit to engineer, not one to sneak in informally, on either side of air gapped vs segmented ICS networks
- Scan and log all removable media transfers on air gapped systems
- Review conduit and firewall rules on a fixed schedule
- Monitor DMZ traffic instead of assuming the boundary alone is enough
✘ Don't
- Assume "air gapped" means truly isolated without verifying it, a mistake that undermines both sides of air gapped vs segmented ICS networks
- Let remote access or admin pathways span directly between corporate and control zones
- Treat a network diagram's segmentation as proof it's enforced in practice, a common blind spot across air gapped vs segmented ICS networks
- Skip physical audits for informal connections that accumulate over time
FAQs on Air Gapped and Segmented ICS Networks
These are the questions that come up most often when comparing air gapped vs segmented ICS networks.
External References
These sources go deeper into the standards and practices behind air gapped vs segmented ICS networks.
- Recommended Practice: Defense in Depth, CISA
- ISA/IEC 62443 Series of Standards, ISA
- NIST Cybersecurity Framework, NIST
What we learn today
- True air gaps are rare in practice. Most "air gapped" networks have informal, undocumented connections, which is the starting point for any study of air gapped vs segmented ICS networks.
- Segmentation assumes connections exist and builds controlled, monitored conduits around them instead.
- Removable media is the primary attack surface for genuinely air gapped systems.
- Stuxnet and the Ukraine grid attacks both show the same pattern: assumed isolation that wasn't actually enforced.
- A well governed segmented architecture generally outperforms a nominal air gap in practice, which settles most debates over air gapped vs segmented ICS networks.