Is Your SCADA System Really Air Gapped, or Do You Just Think It Is? 

I have been handed VPN credentials for a tank system about ninety seconds after being told the plant was air gapped. Not by anyone trying to mislead me. By an operator who believed it, because that is what he was told when the system went in, and nobody has revisited the claim since.

That’s the thing about an air gapped SCADA system. Almost everyone who says they have one means something looser by it, usually that nothing is plugged straight into the internet. That’s worth something. It isn’t what the word means, and the difference matters a lot more than it sounds like it should.

We call it the air gap illusion, and it isn’t anybody’s fault. The gap closed one reasonable decision at a time. What follows is what the term actually requires, what’s almost certainly already connected at your plant, and four questions that settle it in about five minutes.

What “Air Gapped” Actually Means, and Why Almost Nothing Meets the Bar

The term comes from a literal idea: a gap of air where a cable would otherwise be. Isolation enforced by the absence of a connection, not by a rule about one. That distinction is the whole thing. A firewall is a decision about what’s allowed across a path that exists. An air gap means there’s nothing to decide, because there’s nothing to cross.

It’s easier to understand by subtraction. To be genuinely air gapped, you need dedicated machines fully isolated from every internet connection, someone watching them around the clock, no off-site backups, no text messaging service, no remote access of any kind, and no laptop that’s ever touched another network. Miss one item and the gap is gone.

You are not air gapped. It’s just an air gapped illusion. 

This is not a small-utility problem. It is an everybody problem. A former director of the federal cybersecurity center at DHS put it bluntly in ISA’s writeup on the air gap myth: across every assessment his teams ran, they never once found an operations network truly separated from the enterprise network. On average they found “11 direct connections between those networks,” and in the worst cases, up to 250.

Those were large organizations with security budgets and dedicated staff. If they could not maintain a real air gap, the odds that a water system running on one operator and a part-time IT contractor has one are close to zero.

The Air Gap Illusion: Seven Ways Your Air Gapped SCADA System Is Already Connected

Every one of these showed up for a good reason. Somebody wanted alarms on their phone, or a contractor needed to fix something without driving four hours. That’s why nobody remembers adding them, and why the claim survives long after it stopped being true.

1. Alarm Callouts and Texting Services

The moment your system can send you a text at two in the morning, it’s talking to something outside the plant. That message has to reach a phone carrier, which means a path exists in the other direction too.

2. Remote Access for You or Your Integrator

If anyone can log in from home, from a truck, or from an office two states away, there’s a door. It may be a well-built door with good credentials on it. It’s still a door, and it’s the one attackers spend the most time knocking on.

3. Cellular Modems at Lift and Pump Stations

Remote sites are where this hides best. A modem at a lift station is a connection to a carrier network, and it usually got installed by whoever was closest to the problem that week. Nobody thinks of it as part of the SCADA system, which is exactly why it never comes up when someone says the plant is air gapped.

4. The Engineering Laptop

This is the one I’ve seen cause the most real damage. A laptop picks up email at the office, sits on hotel WiFi, then plugs into your panel to reprogram a PLC. Whatever it collected along the way now has a ride straight past every firewall you own.

5. Off-Site Backups and Compliance Reporting

Historical data that leaves your building for a backup service or a compliance report is a data flow out of your control network. Turbidity and residual numbers going to a third-party reporting engine is a connection, no matter how routine it feels.

Everything that you add to your system just creates another opportunity for malicious activity. 

6. Vendor and Contractor Access

Your PLC vendor, your integrator, and your reporting software provider may each hold their own way in, granted at different times by different people. Nobody keeps a master list. When one of those companies gets compromised, their access to your plant is part of what the attacker inherits.

7. The Flat Local Network Itself

Even with everything above locked down, most plants run one network where everything can see everything. That was intentional, so the SCADA server can reach every PLC and RTU. It also means the network is only as segmented as your firewall configuration says it is.

What Happens After One Door Opens

Once somebody is on your local network, the design that makes SCADA work starts working for them. A flat control network exists so the master server can see every PLC and RTU. That visibility is the feature. It’s also a major vulnerability, and it doesn’t care who’s using it.

I watched this play out at an oil company with a few thousand sites that considered itself pretty well air gapped. Ransomware came in on a laptop that got plugged into the network, moved to the main database, and took the SCADA historian with it. Getting operational again took weeks. Nobody had to defeat seven layers of security. They got onto one machine and the network handed them the rest.

In Minnesota this past July, the FBI described attackers reaching internet-facing devices and then changing IP addresses and passwords, leaving operators without monitoring or control. How they got in hasn’t been confirmed, and I broke down the details in this look at the Minnesota water utility cyberattacks and SCADA architecture. What’s worth carrying into your own plant is narrower than attribution anyway.

Segmentation on paper doesn’t always survive contact with reality, either. Plenty of systems look properly divided until you trace where the zones actually route.

Everything’s segregated, but once I route it through the same firewall, it can see everything.

Your exposure isn’t one device. It’s everything that device can reach. That’s the question worth asking about every pathway on the list above, and it’s why CISA’s primary mitigations for operational technology put network segmentation and an IT/OT DMZ near the top.

Why a VPN Doesn’t Close the Gap

VPNs come up every time this conversation happens, usually as the reason a plant considers itself covered. To be fair, a VPN is a real control. CISA recommends one with multifactor authentication when remote access is necessary, and it’s a significant step up from leaving a port open. What it doesn’t do is put the gap back.

The tunnel itself is rarely the weak point. The problems sit at either end of it:

• The device connecting in may already be compromised. That laptop was on cellular or hotel WiFi an hour ago. The VPN faithfully encrypts whatever it’s carrying and delivers it to your control network.
• Credentials get reused and shared. A password that also protects an email account, or one a former employee still knows, is all the front door anyone needs.
• Once inside, most VPNs grant the whole network. People log in to reach one HMI and land with visibility into every device on the LAN, because that’s how the tunnel was configured.
• The gateway itself is a target. VPN appliances have their own vulnerabilities, and remote-access gateways sit high on the list of things attackers scan for.

The VPN is just the same as if you took that computer and plugged it right into your network.

Better remote access looks like certificate-based authentication paired with multifactor, and permissions scoped to the one screen or the one PLC somebody actually needs rather than the entire network. That’s a meaningfully stronger setup. It’s still remote access, and it belongs on your list of pathways rather than in the column of things that cancel one out.

Buying Security Products Is Not the Same as Being Secured

Think about what it takes for home security to actually work. You can buy the deadbolts, the smart locks, and the cameras, and still be wide open if the locks don’t auto-close, the cameras only record when somebody remembers to arm them, and the recorder sits on a shelf where anyone who breaks in can walk off with it. That last one happens more than you’d think. The hardware was never the hard part.

Same story with a firewall, a security appliance, or a managed switch sitting in your panel. Somebody has to implement it properly, keep it maintained, and actively scan for what’s changed.

The security appliance you bought last year is not watching for the same threats that we’re seeing today.

Four Questions That Tell You Whether You Are Actually Air Gapped

Here’s the test I walk operators through, and it takes about five minutes. Answer yes to any single one of these and you aren’t air gapped:

1. Is anyone sitting in front of your control system around the clock, in an operations center, watching it? Not on call. Physically watching it.
2. Do you have any callout, texting, or alarm notification service at all?
3. Can anyone reach any part of your system remotely, including you, your integrator, or a vendor?
4. Is any laptop allowed to connect to your network after it’s been on the internet, including a contractor’s or an engineer’s?

Most plants answer yes to three of the four. That isn’t a failure and it doesn’t mean anybody made a bad decision. Every one of those yeses bought you something real: an alarm that wakes you up, a fix that didn’t require a four-hour drive, a compliance report that files itself. What it means is that the word air gapped is doing damage, because a claim nobody has tested is what stops the real conversation from happening.

Once you know where you stand, there are two honest paths, and one of them doesn’t involve a company like mine:

	Genuinely air gap it	Defend the connections you have
Cost	High. Dedicated hardware, staffing, and no shared services.	Moderate. Segmentation, access control, active monitoring.
Staffing	An operations center staffed around the clock.	Someone accountable for reviewing access and alerts.
Remote access	None. No texting, no callouts, no logins from home.	Allowed, scoped narrowly, and monitored.
Realistic for a system under 10,000 people	Rarely.	Yes, and it is where most utilities should be aiming.

If you go the first route, go all the way: a dedicated network operations center, no laptops in, and a security team whose job is actually making you air gapped. If you go the second, the work is knowing every pathway and watching them. What doesn’t work is a system built like column two while everyone describes it like column one.

The EPA offers a free water cybersecurity assessment tool that walks you through your own risk picture and produces a mitigation list you can hand to a council or a board.

What Isolation Looks Like When You Design For It

The reason I built SimpliScada the way I did is that the pathway problem is an architecture problem, not a discipline problem. Instead of one large network where every site can see every other site, each hub runs as its own isolated network, so a pump station has no route to a tank site unless the process genuinely requires those two to talk. Connections run outbound only, which means there’s no inbound port sitting at your plant waiting to be found, and every device carries its own certificate that can be revoked in a single click if you think it’s been compromised. What changes is the blast radius: one compromised device is one device, not a doorway into everything downstream of it. It doesn’t make anyone invulnerable, and I wouldn’t trust a vendor who told you otherwise. It removes a category of pathway that most plants are currently maintaining by hand, and it’s worth understanding how the hub and platform are put together before you take anyone’s word for that, mine included.

We don’t open back doors even for our own users. Everybody goes to the front door, and we make sure our front door looks like Fort Knox.

Integrators evaluating this across a client roster can go deeper through our SCADA Partner Program.

Air Gapped SCADA FAQs

Can an air gapped SCADA system still be hacked?

Yes. The most documented example is Stuxnet, which reached isolated centrifuge controllers in Iran through infected removable media rather than a network connection. A USB drive carrying a configuration file or a patch is a transfer path, and so is any laptop that moves between networks. Isolation reduces exposure. It does not eliminate it.

Does a firewall make my SCADA network air gapped?

No. A firewall filters traffic on a connection that exists, which is the opposite of an air gap. Firewalls are worth having and most plants should have more segmentation than they do. Calling a firewalled network air gapped is where the trouble starts, because it stops anyone from asking what the firewall is actually configured to allow.

Is a cellular modem at a lift station a security risk?

It’s a pathway, and whether it’s a meaningful risk depends on how it was installed. Ask who configured it, whether the default password was changed, whether it accepts inbound connections, and whether anyone reviews its logs. Modems installed quickly to solve an immediate problem are the ones that go unmanaged for years.

Do we have to remove remote access to be secure?

No, and for most utilities removing it would make operations worse. The goal is scoping it correctly: certificate-based authentication with multifactor, permissions limited to the specific screen or device somebody needs, and a current list of who holds access. Remote access you can inventory and revoke is far safer than remote access nobody tracks.

If we are not air gapped, what should we fix first?

Start by writing down every way into your control network: remote logins, vendor access, cellular modems, forwarded ports, backup and reporting flows. Then remove the ones nobody needs anymore, which is usually several. Free assessment tools from EPA and AWWA can structure the rest once you know what you’re protecting.

Where That Leaves You

If you went through those four questions and answered yes to a few, nothing about your plant got less safe in the last ten minutes. You just have an accurate picture instead of an inherited one. The pathways were always there. Now they’re on a list where you can decide which ones still earn their place.

For the integrators reading this, you’re often the one being asked to vouch for the air gapped claim on a system you didn’t install. Walking a client through those four questions is a better use of a site visit than almost anything else you could do that day.

If you want a second set of eyes on your own list, that’s a conversation I’m always up for. Get in touch and we’ll go through your actual sites and connections, or book a free demo and I’ll show you what the isolation model looks like on a working system. Integrators, ask us about a demo unit for the bench.