Imagine I have the research papers on designing COVID-19, the cure and some nuke launch codes on my laptop and want to often communicate those to another computer at my home. I already installed a physically separate STP cable network. Now what? My previous experiment in the field resulted in the conclusion that un-updated OSs are worse than being online all the time. Because 2 years later you plug in an empty USB thumbdrive and things break.
The point at which you can exchange the data makes it a "non-air-gapped interface".
The definition of an air-gap as per RFC 4049 is:
An interface between two systems at which [..] they are not connected physically [..]
Normally, when dealing with highly sensitive data, you don't save it on an end-device. There are Product Data Management solutions with comprehensive permission management that will run on a seperate server and store your files encrypted.
Any given user will never get access to the actual files but only to specific functions that can be applied to that file. In this way, you can ensure that some users can only view partial data whereas other users, if necessary, can commit write changes to the PDM solution that will then be applied to the actual file if found legitimate.
That said, data confidentiality is a very complex topic that does not have a perfect solution. If you cannot guarantee the legitimacy of an access, there is no way.
If a user cannot copy the data, he/she will pull out his/her smartphone and make a photo. Once you hand the data to anyone who is not 100% trustworthy, mark it as "considered to be gone".
-
Thank you for the answer! My use case is different. I have not users. I have no database. I want to design a theoretically secure home surveillance. And the logging server needs to be updated sometimes(not for security reasons but due to 'I need ...'). Recorded video files are a completely different issue. – Vorac Jun 17 '20 at 17:55
how to airgap in personal/micro environments?
expressed in a needlessly elaborate way. A good answer would point to papers, tutorials or technologies. – Vorac Jun 18 '20 at 17:25