SysAdmin Weekly - 057 - Is Your Air Gap Actually an Air Gap? Port 22 Says No

[asyrewicze]

Hey everyone!

This one has been a long time coming. Eric and I have had the air gap argument privately for years, so this week we ran it on the show. Short version: the term got laundered somewhere around the ransomware boom, and most of what gets called an air gap today is a network segment with a management hole in it.

Here is what we covered:

• What the word actually means. Two completely separated systems, no network path, data moves by sneaker net. Then the three things people call air gaps instead: logical (firewall rules), network (VLANs), and virtual (object storage). Useful controls, all of them. Just not air gaps.
• Every hole you poke to manage the thing. Patching wants SSH or RDP. File movement wants SMB or SCP. DNS and NTP have to work. License activation and telemetry phone home. Each one had a good reason, and the one opened during an outage at 2am is the one that never gets closed.
• The lights out board nobody segments. iDRAC, iLO, IPMI. Its own operating system, its own CVEs, and a network path the host OS cannot see. Andy's MSP-era question still lands: when was the last time you patched a BMC? Or switch firmware? Or a printer?
• Breakout attacks make the VLAN argument moot. Eric's position is that he will not sign his name to "nobody can break out of this hypervisor" or "nobody can get onto the fabric of this switch." If a VM has network access, the management OS does too.
• What to do instead. Zero trust, just in time administration, just enough admin, and assume breach. The Windows Firewall fight from twenty years ago is the precedent: annoying to manage, and it shrinks the blast radius anyway.
• Real air gaps, and what they cost. Hardwired links sharing nothing, not even power. One person in the room at a time. A man trap where a guard weighs you going in and weighs you coming out. Possible, absolutely. Practical, almost never.
• Sneaker net is still an attack surface. Stuxnet is the famous one, and the 2008 Agent.btz breach of US military networks started with a poisoned USB drive in a parking lot and spread by writing autorun files to every clean drive it touched.

Plus the usual: an AirTag hidden in a shipment of rare books leading 404 Media to an Amazon AI scanning facility, Bill Gates announcing he is shocked to be the first person raising the alarm on AI and jobs (he is not), a new ncurses utility for tracking Claude Code usage, and Eric wrestling WordPress articles into Hugo one image at a time.

Relevant Links Below!

Podcast Episode - YouTube
Podcast Episode - Spotify

Two questions for you all. First the real one: if you have a genuine, fully isolated air gap, tell us about it. What is inside it, and what does it cost you operationally to keep it honest? Andy wants to hear from the people who actually pulled it off.

And second, the one Andy asked on air and immediately regretted: if the thing you hate most in IT is NOT printers, what is it, and how do you justify that position?