Changes

An '''Air-Gap''' refers to the physical separation of an [[electronic]] device such as a [[computer]] from all [[network]]s.  A device may be vulnerable to intrusion or spying, but in theory, this is a logical "low-tech solution to a high-tech problem" which prevents all spying and attack attempts.<ref>https://www.techopedia.com/definition/17037/air-gap</ref>

An '''Air-Gap''' refers to the physical separation of an [[electronic]] device such as a [[computer]] from all [[network]]s.  A device may be vulnerable to intrusion or spying, but in theory, this is a logical "low-tech solution to a high-tech problem" which prevents all remote spying and attack attempts.<ref>https://www.techopedia.com/definition/17037/air-gap</ref>

==Problems with an air-gap==

==Problems with an air-gap==

The obvious problem is that while "they" cannot access the potentially vulnerable device, that device also cannot access other harmless servers and resources on the [[Internet]] or [[LAN]].  Only off-line activity is possible.  However, even an air-gapped device can be monitored.  Delayed reporting strategies can be used, such as having [[spyware]] record activity which may be physically retrieved at a later time.  Another such strategy would be loading logs onto the user's external device, such as a [[flash drive]], and retrieving it from that device once it is connected to a networked computer.<br />

The obvious problem is that while attackers cannot remotely access the air-gaped device, that device also cannot access other harmless servers and resources on the [[Internet]] or [[LAN]].  Only off-line activity is possible.  However, even an air-gaped device can be monitored.  Delayed reporting strategies can be used, such as having [[spyware]] record activity which may be physically retrieved at a later time.  Another such strategy would be loading logs onto the user's external device, such as a [[flash drive]], and retrieving it from that storage device when it is later connected to a networked computer.<br />

Other strategies which would not use [[spyware]] include either attaching monitoring hardware directly to the device, or even recording [[electromagnetic]] emissions from a [[computer]] [[keyboard]]. This can be dome over some distance, and although it can prove difficult to separate out from ambient interference, can be used effectively to determine the binary output of the keyboard.  These binary signals can then be translated into the letters they represent.<ref>http://www.tripwire.com/state-of-security/latest-security-news/air-gapped-computers-can-be-compromised-using-em-side-channel-attacks-says-researchers</ref><ref>http://www.techrepublic.com/article/air-gapped-computers-are-no-longer-secure</ref>

Other strategies which would not use [[spyware]] include either attaching monitoring hardware directly to the device, or even recording [[electromagnetic]] emissions from a [[computer]] [[keyboard]]. This can be dome over some distance, and although it can prove difficult to separate out meaningful EM pules from ambient interference, this can be used effectively to determine the binary output of the keyboard.  These binary signals can then be translated into the letters they represent.<ref>http://www.tripwire.com/state-of-security/latest-security-news/air-gapped-computers-can-be-compromised-using-em-side-channel-attacks-says-researchers</ref><ref>http://www.techrepublic.com/article/air-gapped-computers-are-no-longer-secure</ref>

==References==

==References==