An air gap has a human-sized opening
An “air-gapped” network has no direct connection to the internet or other outside networks. That blocks ordinary online attacks—but it does not stop information from crossing on a device that people carry between systems. A laptop, USB drive, or other removable media can act as a bridge, even when the computers themselves have no cable between them.
At Natanz, an infected laptop was connected to the facility’s isolated network. The connection gave Stuxnet a route into computers that were not directly online. When the laptop was later taken home and connected to the internet, it carried the malware beyond the facility’s boundary.
The security boundary moved with the laptop
The key weakness was not a hidden internet connection inside the protected network. It was the assumption that a device could move between environments without carrying anything dangerous with it. Malware can remain on a laptop while it is offline, then become a risk again when that computer reaches another network.
That makes isolation a matter of controlling devices and procedures as well as cables: equipment moving into or out of a restricted site must be treated as a possible path for infection. A network can be physically disconnected and still be connected indirectly by the people and machines that move between it and the outside world.
