057 - Is Your Air Gap Actually an Air Gap? Port 22 Says No

Somewhere inside that isolated network, port 22 is open, and it has been open since the outage six months ago that nobody wrote up.Andy Syrewicze and Eric Siron take apart a term the industry uses constantly and almost never earns. They walk the management plane hole by hole: SSH and RDP so somebody can patch the thing, SMB for the files that have to move, DNS and NTP because nothing works without them, and the iDRAC, iLO, and IPMI boards that get parked on the management VLAN and then never patched at all. The argument they land on is not that a real air gap is impossible, it is that calling something an air gap ends the conversation, and a promise nobody re-verifies is worse than a risk everybody can see.Chapters:00:00:00 - Cold Open: Your Air Gap Probably Is Not an Air Gap00:01:12 - Welcome and Show Plugs00:04:19 - News React: An AirTag, a Rare Book, and an Amazon Scanning Facility00:10:10 - News React: Bill Gates Changes His Mind on AI and Jobs00:13:03 - What the Entry Level Job Market Looks Like Right Now00:15:05 - When Nobody Is Left Who Knows How to Program It00:19:25 - Nerd Hour: Claude Code, Agents, and Building CC Top00:23:54 - Nerd Hour: Moving Project Runspace to Hugo, JavaScript Free00:28:22 - What an Air Gap Actually Means00:31:22 - Logical, Network, Virtual: How the Word Got Laundered00:32:36 - Every Hole You Poke Just to Manage the Thing00:34:18 - The One Nobody Segments: iDRAC, iLO, and IPMI00:36:26 - A Brief and Deserved Detour About Printers00:37:23 - NTP, DNS, License Activation, and Telemetry00:40:34 - Why Leaving Hyper-V Out of the Domain Is Not Security00:43:16 - VLANs, Switch Fabric, and Breakout Attacks00:44:40 - Assume Breach: Zero Trust, JIT, and JEA00:50:36 - Sneaker Net and Poisoned USB Drives00:52:20 - Stuxnet and the Gap That Was Real00:54:59 - How Would You Even Safely Clean a USB Drive?00:56:58 - Say What You Have, Then Defend It00:57:29 - The Real Danger Is the False Sense of Security01:00:23 - The Windows Firewall Lesson01:03:11 - What a Genuine Air Gap Actually Costs01:04:59 - Wrap Up and OutroResources / Show Notes:- Symantec Security Response, W32.Stuxnet Dossier, the canonical technical analysis: https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en- Ralph Langner, To Kill a Centrifuge, on why post-Stuxnet air gap strategies miss the point: https://www.cs.yale.edu/homes/jf/Langner.pdf- The 2008 USB breach of US military networks, Agent.btz and Operation Buckshot Yankee: https://en.wikipedia.org/wiki/2008_malware_infection_of_the_United_States_Department_of_Defense- Microsoft Security Advisory 967940, the update that killed USB AutoRun: https://learn.microsoft.com/en-us/security-updates/securityadvisories/2009/967940- NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, for naming what you actually have: https://csrc.nist.gov/pubs/sp/800/82/r3/final- 404 Media, tracking a shipment of rare books to an Amazon AI training facility: https://www.404media.co/we-tracked-a-shipment-of-rare-books-it-ended-at-an-amazon-ai-training-facility/- Semafor, Bill Gates has changed his mind about AI and jobs: https://www.semafor.com/article/08/25/2026/this-is-crazy-this-is-insane-bill-gates-has-changed-his-mind-about-ai-and-jobsGates Notes, the essay itself: The turbulent AI era is here: https://www.gatesnotes.com/a-turbulent-ai-era-and-critical-choices-to-make- SysAdmin Weekly, all show links: https://www.sysadminweekly.com- SysAdmin Weekly Newsletter: https://newsletter.sysadminweekly.com- AndyOnTech: https://www.andyontech.com- Project Runspace: https://www.projectrunspace.org- GitHub Discussions, tell us about your air gap and why you have one: https://github.com/ProjectRunspace/sysadmin-weekly/discussions