In an air-gapped environment, every physical port is a potential crossing point — locks turn unused ports into hardened boundaries

1. The Air Gap Illusion: Why Ports Are the Real Boundary

The operational technology security market is projected to grow from $11.6 billion in 2025 to $32 billion by 2034 (12% CAGR), driven by ransomware attacks on manufacturing, energy, and water utilities, and by mandatory compliance frameworks such as IEC 62443 and NIST SP 800-82. Yet the hardening of the physical layer — the one place where an isolated network still touches the outside world — remains the most under-invested part of OT security programs. The market data explains why this matters: ransomware demands against manufacturers averaged $1.16 million in 2025, more than double the prior year, and 25% of OT incidents caused full-site shutdowns, with an automated assembly line outage costing $2.4 million per hour.

The "air gap myth" is simple: organizations assume that because a network has no internet connection, it is unreachable. The reality, documented repeatedly since Stuxnet, is that air gaps are crossed through the physical layer — the exact layer that logical security controls cannot see. A USB stick, a maintenance laptop, a patch cable into the wrong port, or an unrecorded Bluetooth adapter all bypass firewalls, NAC, and antivirus by simply not using the network at all. The port is the boundary. Every unused RJ45 port, USB socket, and serial connector on an OT workstation is a potential crossing point that a mechanical lock can close for cents to a few dollars per port.

For the fundamentals of why port-level physical security matters across all network environments, see our guide to RJ45 port locks and network security.

2. What an Air-Gapped Network Really Requires

An air-gapped network has no direct physical or wireless connection to the public internet or any untrusted network. Data moves in and out only through controlled mechanisms: sanitized removable media, manual file transfer, or unidirectional gateways (data diodes). In industrial settings, this maps to the Purdue reference model — Levels 0-2 (field devices, controllers, HMI) are typically fully isolated; Level 3 (site operations) sits behind a firewall and DMZ; Levels 4-5 (enterprise IT) connect normally. In practice, "absolute" air gaps are rare; most facilities run a spectrum from full isolation to time-based exchange to logical segmentation.

The operational reality of an air gap is demanding: no remote access, no cloud tools, manual patching, and physical presence required for every change. That is precisely why OT networks run legacy operating systems — Windows XP, Server 2003, old Linux kernels — that OEM-certified applications require and that cannot run modern endpoint agents. And it is why the physical controls that do work on such systems — port locks, media control, and documented procedures — are the backbone of OT hardening rather than an afterthought. For industrial environment cabling considerations that support these networks, see our hybrid fiber optic cable analysis for harsh industrial environments.

3. The Threat Model: How Air Gaps Get Breached

An honest air-gap security program starts from the assumption that the gap will be crossed. The vectors are well documented:

Vector	How It Works	Evidence
USB / removable media	Infected drives carried in by personnel or contractors; the dominant crossing vector	Stuxnet (2010); APT37 USB implants (2025); GoldenJackal against EU government targets (2022-2024)
Contractor / maintenance laptops	OEM service engineers connect infected laptops directly to OT equipment for diagnostics	Industry data: ~27% of OT incidents involve USB and contractor laptops
Undocumented wireless paths	Bluetooth, cellular modems, and Wi-Fi in devices added without updating the asset inventory	Acronis lists undocumented wireless as a top cause of "assumed isolation" failures
Supply chain	Compromised software updates or hardware implants entering through procurement	APT31 implants in Eastern European industrial systems (Kaspersky)
Side-channel leakage	Acoustic, electromagnetic (TEMPEST), and optical emissions exfiltrate data from sealed rooms	Researcher-demonstrated; requires proximity and high technical capability

Two implications follow. First, media and physical access control are the highest-leverage controls an OT team can deploy — they directly address the top three vectors. Second, because most vectors begin with someone physically inserting or connecting something, mechanical port security is the control that closes the gap at the exact moment of crossing. For media-path security in PoE-heavy industrial deployments, see our PoE cabling design patterns for cameras and access points.

The air gap is crossed through physical vectors — which is exactly where port locks and media controls operate

4. Physical Port Security Layers for OT Workstations

Port security for air-gapped workstations is a layered set of mechanical controls that block insertion, removal, and media access without interfering with authorized operations.

Layer	Control	What It Blocks	Typical Cost per Port
RJ45 network ports	Keyed RJ45 port locks	Insertion of patch cables into unused switch, HMI, and engineering workstation ports; prevents rogue device connection and accidental mis-patching	€0.45-€3.30, reusable
USB ports	Keyed USB port locks	Insertion of USB drives, wireless adapters, and charging-based attack devices into OT endpoints	€1.50-€4.00, reusable
Serial / console ports	Dust caps and lockable connectors	Direct console access to PLCs, RTUs, and switches that bypasses the network entirely	€0.20-€2.00
Media slots (SD, optical)	Locking slot covers	Bootstrap media and removable storage that can execute code before the OS loads	€1.00-€5.00

The engineering choice between hardware locks and software blocking is decisive in OT: legacy systems that cannot run endpoint agents make hardware USB and RJ45 locks the only universal control. Hardware locks also survive OS reinstalls, work before boot, and provide physical audit evidence. For a detailed comparison of hardware USB locks versus software blocking, see our physical USB port locks vs software blocking analysis. For shielded copper environments where grounding discipline is part of the physical layer, see our STP cabling and network performance guide.

Keyed RJ45 and USB port locks turn unused ports on OT workstations into auditable physical barriers

5. Deploying Port Locks in Air-Gapped Environments

Port lock deployment in an OT plant requires more discipline than in an office — operators must never be locked out mid-process, and every lock position must be documented for audits.

For the full field workflow, see our RJ45 port lock installation and removal guide and our port lock deployment guide. For labeling systems that keep audits traceable, see our port numbering and labeling system guide and our cable color coding best practices.

6. Standards and Compliance: IEC 62443, NIST SP 800-82

Physical port security maps directly into the compliance frameworks that govern industrial networks, and those frameworks are tightening. The IEC 62443 series expanded from four to six parts in 2025-2026, with the updated IEC 62443-2-1 (published January 2025) covering organization-wide security management, new IEC 62443-1-6 addressing IIoT device security, and IEC 62443-6-2 adding supplier conformity evaluation.

Framework	Relevant Requirements
IEC 62443-3-3	SR 3.x network segmentation (zone-and-conduit), SR 2.5/3.7 removable media controls, SR 7.3 backup integrity, SR 7.4 system recovery
IEC 62443-2-1 / -1-6	Organization-wide OT security management; new IIoT device security requirements (2025-2026 updates)
NIST SP 800-82 Rev 3	ICS security guide with compensating controls for legacy systems; physical access and port control expectations for control centers
NIS 2 Directive	Article 21 mandates business continuity, backup management, and incident recovery for critical and important entities
NERC CIP-007 / CIP-009	Security management and recovery plans for bulk electric systems, including port and access control expectations

In practice, auditors accept physical port locks as evidence when they are documented, keyed, and tied to a written policy — "only authorized OT personnel may remove port locks" — with an audit log of key custody and port changes. For the standards landscape of structured cabling that underpins these OT networks, see our TIA-568 vs ISO/IEC 11801 standards comparison.

7. Building a Realistic Air-Gap Security Program

Port locks are the physical layer of a program that must also cover media, people, and recovery. The six controls that Acronis and the broader OT security community converge on are:

• Verified asset inventory: catalog every device and connection in the air-gapped network, actively hunting undocumented wireless or cellular paths
• Removable media control: allow only sanitized, approved USB devices; operate a sanitization station at the facility entrance; disable or lock non-essential USB ports; enable audit logs
• Offline behavioral protection: use anti-ransomware and anomaly detection that works without cloud signature updates — critical for legacy OS endpoints
• Air-gap-native backup and recovery: mirror backups of HMI, SCADA, and engineering workstations to local storage; enable operator one-click recovery, dissimilar-hardware restore, and restore-before-recovery malware scanning
• Inbound file sanitization: behavioral scan, content disarm and reconstruction (CDR), and hash verification against vendor checksums for every file entering the gap
• Floor-level management: keep the security management console inside the OT network with no cloud dependency

These controls map to IEC 62443-3-3 SR 7.3/7.4 and NIS 2 Article 21, and they close the loops that port locks open — because a lock prevents insertion, but only media control, backup, and recovery make the plant resilient if a crossing still occurs. For day-to-day network operations inside and around OT zones, see our network cable installation and maintenance best practices and our cable tracing guide for accurate port mapping.

Key Questions

Q1: Are air-gapped networks actually secure?

Air gaps are a strong control but not absolute. They eliminate remote attack paths, but USB media, contractor laptops, supply chains, and undocumented wireless paths still breach them — over 50% of USB malware now targets removable media (Honeywell 2024). Treat the air gap as one layer of defense, not the whole program.

Q2: How do air-gapped networks get breached?

The dominant vectors are USB drives and removable media, infected contractor laptops (together roughly 27% of OT incidents), supply chain compromise, and undocumented wireless paths. More exotic attacks use acoustic, electromagnetic (TEMPEST), or optical leakage. Stuxnet in 2010 remains the canonical USB-borne air-gap breach.

Q3: What is physical port security and why does it matter for air-gapped workstations?

Physical port security uses mechanical devices — keyed RJ45 port locks, USB port locks, dust caps, and serial port protection — to control what can physically connect to OT equipment. It matters because software cannot block a physical insertion: a rogue USB drive or a patch cable bypasses every logical control at the moment of crossing.

Q4: How do RJ45 port locks protect air-gapped workstations?

A keyed RJ45 port lock occupies the network port and can only be removed with its matching key, preventing anyone from plugging a cable into an unused port. In OT environments this stops accidental mis-patching and deliberate insertion of unknown devices into engineering workstations, HMIs, and SCADA servers.

Q5: Should I use USB port locks or software blocking for OT media control?

Hardware USB locks are the right baseline for air-gapped environments because they work on legacy operating systems that cannot run endpoint agents, survive OS reinstalls, and give physical audit evidence. Software blocking adds logging and policy on capable endpoints. The strongest deployments use both, plus a media sanitization station at the entrance.

Q6: What does IEC 62443 require for air-gapped OT environments?

IEC 62443 requires zone-and-conduit segmentation (SR 3.x), removable media controls (SR 2.5/3.7), and backup integrity and recovery (SR 7.3/7.4). The 2025-2026 revisions — updated IEC 62443-2-1 and new IEC 62443-1-6 for IIoT devices — expanded the framework from four to six parts with more explicit requirements for isolated industrial networks.

Q7: Do air-gapped networks need backups?

Yes — and they are often neglected. IEC 62443-3-3 SR 7.3/7.4 and NIS 2 Article 21 explicitly require backup integrity and recovery for critical entities. Air-gapped OT networks need local, offline-accessible backups of HMI, SCADA, and engineering workstation configurations with operator-driven recovery and restore-before-recovery scanning.

Q8: How do I deploy port locks without disrupting OT operations?

Audit every workstation and port first and classify ports as active or locked. Test lock samples on representative equipment before bulk ordering. Implement key custody with spares, label every port and lock position, and schedule rollouts during planned maintenance windows so operators are never locked out mid-process.