The need and ability to face the challenge with a clear plan
In today’s technological landscape, organizations managing critical infrastructure face a complex paradox: how to leverage the agility of cloud-native environments while maintaining the absolute control and security typical of a traditional isolated, or “air-gapped,” infrastructure. Simultaneously, the intensification of regulatory pressures such as GDPR, NIS2, and DORA reinforces the need for digital autonomy. This document proposes a “logically air-gapped” governance model designed to address this challenge by extending the principles established by AWS and IBM for Data Vault scenarios across the entire application stack and its associated workflows, enabling organizations to capture cloud-native benefits while ensuring complete, autonomous, and authoritative governance of their data and infrastructure.
This model of autonomy is built upon three core requirements that serve as the foundation for the proposed framework:
- Data Residency: ensuring full control over where information is stored, who can access it, and the governing legal framework.
- Technological Autonomy: mitigating vendor lock-in by embracing open standards and independent infrastructure.
- Operational Autonomy: maintaining the ability to manage digital services independently, free from the interference of third parties.
The central challenge remains the tension between cloud agility and the necessity for such autonomy, as traditional air-gapping—which requires the physical disconnection of systems—is often incompatible with the dynamic nature of modern containerized applications. Consequently, the approach shifts toward a logically air-gapped architecture based on a full-stack governance model, which replaces physical barriers with a robust, software-defined cryptographic perimeter. At the heart of this innovation lies eBPF, or extended Berkeley Packet Filter, a Linux-based technology that enables high-performance, low-impact security and observability at the kernel level, effectively transforming the infrastructure into an environment that remains invisible and inaccessible to unauthorized entities.
Reference Books
A concrete example of this approach’s efficacy is OpenAI, which has adopted the Isovalent networking platform—powered by Cilium—as the standard for its Kubernetes stack. This choice has provided OpenAI with a unified foundation for managing CNI, IPAM, and L4/L7 filtering, ensuring operational consistency across both cloud and bare-metal environments.
It is worth noting that Isovalent was acquired by Cisco in 2024.
Cilium leverages eBPF in a structured and organic manner, translating the raw capabilities of the kernel into an orchestrated platform capable of managing complex data flows, transparent encryption, and network segmentation with high efficiency and scalability.
For a rapidly scaling organization, this uniformity is crucial. It supports security and compliance by eliminating the need to treat each environment as a siloed networking challenge, thereby significantly streamlining troubleshooting for platform teams.
eBPF acts as a fundamental catalyst, providing deep, real-time visibility into network traffic and application behavior, while enabling granular, dynamic security policy enforcement directly at the kernel level.
This “Logically Air-Gapped” governance model reaches its full operational potential through the implementation of “Live Protect.” As a runtime security module, Live Protect elevates protection from the configuration plane to that of dynamic execution. While segmentation and encryption define the perimeter, Live Protect utilizes eBPF within the kernel to monitor, detect, and mitigate threats in real-time as they attempt to bypass perimeter controls. This approach effectively evolves the infrastructure from a merely “protected” environment into a “self-defending” one.
Isovalent Reference Stack
In bare metal scenarios, the solution reaches its peak, extending eBPF capabilities to provide a logically isolated environment that represents the closest digital equivalent to a physical airgap. By eliminating dependency on third-party hypervisors, the company achieves total “governance” through a private control plane and superuser administration functions across the entire application stack. This approach allows for a drastic reduction in the attack surface, ensuring that even non-containerized workloads benefit from granular segmentation, secure host networks, and end-to-end protection managed with total autonomy.
Reference Architecture
Digital autonomy is thus exercised by shifting network and security control into the operating system kernel. This tool enables deep observability without modifying source code, an essential aspect for demonstrating regulatory compliance. Isovalent, through Cilium Enterprise, extends these capabilities with transparent encryption such as WireGuard or IPsec and Egress Gateways, which force traffic toward internal checkpoints, preventing unauthorized exfiltration and ensuring that sensitive information never leaves the defined jurisdiction.
Cisco integrates the execution power of Isovalent with the governance of Cisco Secure Workload to offer a unified security model that covers containerized, virtualized, and bare metal environments. Thanks to the integration between Cilium and systems like SPIRE, the infrastructure assigns unique cryptographic identities to workloads, eliminating dependence on the cloud provider’s proprietary IAM. The integration between Hubble and analytics platforms allows for real-time flow mapping, enabling operators to identify bottlenecks or unauthorized connection attempts in seconds, drastically reducing resolution times.
To ensure technical rigor, this governance model is based on established industry standards. The model aligns with global standards such as NIST SP 800-210, the Gaia-X trust framework, and ENISA’s EUCS requirements, integrating trusted execution environments as recommended by the Confidential Computing Consortium.
In conclusion, digital autonomy does not represent a static state, but a continuous process of control, trust, and resilience. By adopting a “presume breach” mentality and leveraging the combined power of eBPF and Cisco’s governance tools, enterprises can embrace innovation with confidence, while maintaining the rigorous autonomy required to protect critical infrastructure in a transparent and scalable way.
References:
- Use case for logically air-gapped vaults: https://docs.aws.amazon.com/aws-backup/latest/devguide/logicallyairgappedvault.html#lag-usecase
- IBM Air-gap definition: https://www.ibm.com/think/topics/air-gap
- OPENAI: OpenAI Uses Isovalent for a Common Networking for AI Infrastructure: https://isovalent.com/blog/post/openai-isovalent-networking-kubernetes-case-study/
- Cisco Live – Securing Cloud Native with Cisco Secure Workload and Cilium: https://www.ciscolive.com/global/on-demand-library.html
- Cisco Newsroom – Cisco Completes Acquisition of Isovalent: https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m03/cisco-completes-acquisition-of-isovalent.html
- Isovalent Learning Center – eBPF Fundamentals: https://isovalent.com/ebpf/
- Extending Kubernetes Networking to make use of Segment Routing over IPv6 (SRv6) [Francesco Lombardo, Stefano Salsano, Ahmed Abdelsalam, Daniel Bernier, Clarence Filsfils]: https://www.researchgate.net/publication/366846490_Extending_Kubernetes_Networking_to_make_use_of_Segment_Routing_over_IPv6_SRv6
- Isovalent Networking for Virtualization (INV) Integration with Cisco Nexus One Fabric Solution Overview: https://www.cisco.com/c/en/us/products/collateral/networking/cloud-networking/nx-os/isovalent-net-v12n-int-n-one-fabric-so.html
- Isovalent Private Networks and Cisco Nexus One: BGP EVPN Integration for the Enterprise Data Center: Isovalent Private Networks and Cisco Nexus One: BGP EVPN Integration for the Enterprise Data Center | Isovalent Blog
- Cisco Secure Workload – Runtime Threat Detection: https://www.cisco.com/c/en/us/td/docs/security/workload-security/tetration-analytics/3-8/user-guide/b_tetration_user_guide_3_8/m_runtime-threat-detection.html
- Cisco Live: Securing Cloud Native with Cisco Secure Workload and Cilium: https://www.ciscolive.com/global/on-demand-library.html?search=Securing%20Cloud%20Native%20with%20Cisco%20Secure%20Workload%20and%20Cilium
- Cisco Live: Advanced Threat Detection with eBPF: https://www.ciscolive.com/global/on-demand-library.html?search=eBPF