# Physical Network Security

## Air-Gapped Networks

True air gap: no WiFi, no Bluetooth, no USB (unless sanitized), no internet.

Design:
- Physical barriers: locked server rooms/cabinets
- Data diodes for one-way data flow (Owl Cyber Defense, Waterfall Security)
- Offline patch management with dedicated update stations
- Supply chain verification for all hardware
- Disable all wireless radios, USB ports, audio jacks (acoustic covert channels exist)

Guide: https://cybersguards.com/air-gapped-networks/

## TEMPEST Shielding (NSA Emanation Security)

Prevents electromagnetic emissions from being intercepted.

Levels:
- Level A (NATO SDIP-27 Level A): full protection, shielded rooms
- Level B: reduced protection for less sensitive environments
- Level C: minimum protection

Implementation: Faraday cages, shielded cables, filtered power lines. SCIFs per ICD 705.

For home lab (practical alternatives):
- Shielded Ethernet cables (STP/FTP)
- Keep sensitive equipment away from windows
- Small Faraday enclosure for specific devices

Caveat: Ben Gurion University research shows low-frequency magnetic fields from CPUs penetrate metal shields. Faraday alone does not guarantee air-gap integrity.

References:
- https://www.majr.com/tempest-shielding/
- https://www.euro-emc.co.uk/product/tempest-shielding
- ODINI paper: https://arxiv.org/pdf/1802.02700