Offline Vulnerability Scan

The scanner relies on a sneakernet protocol to receive updates. Vulnerability definition files, often in SCAP or OVAL formats, are downloaded in a low-side environment, validated, and physically transferred via removable media validation to the high-side network. This breaks the kill chain by ensuring the scanner's intelligence is never exposed to a live network.

The scanning engine operates entirely within the disconnected container runtime. It requires no cloud lookups or external API calls. The engine parses the imported definitions and probes local assets using credentialed or agent-based methods. Key capabilities include:

• Authenticated scans for deep configuration assessment
• Agentless network scans for unmanaged devices
• Container image scanning against a local, air-gapped registry

Before scanning, the tool must map the air-gapped attack surface. It performs passive and active discovery to fingerprint operating systems, open ports, and installed software. This Bill of Materials (BOM) verification process correlates discovered components against the imported vulnerability database to identify missing patches and zero-day exposures without transmitting a single packet outside the enclave.

Beyond CVE detection, offline scanners enforce Policy as Code (PaC) by checking configurations against CIS Benchmarks or DISA STIGs. The scanner generates a delta report showing deviations from the hardened kernel or immutable infrastructure baseline, providing auditors with cryptographic proof of the system's security posture without requiring network access to a central compliance dashboard.

The final output is a localized, human-readable report detailing risk scores and remediation steps. Because the system is air-gapped, automated patching is often replaced by a manual break-glass procedure or a scheduled maintenance window where signed patches are imported via data diode technologies. Reports are stored in a tamper-proof model registry equivalent to maintain an immutable audit trail.

The security process of scanning and sanitizing USB drives, optical discs, or other portable storage devices for malware before they cross the boundary into an air-gapped environment.

• Acts as the first line of defense for vulnerability definition imports
• Typically performed on a dedicated sheep-dip station outside the secure perimeter
• Validates file integrity hashes against known-good manifests
• Prevents Stuxnet-style attacks that weaponize definition update mechanisms

A physical unidirectional gateway that enforces one-way data flow from a low-security zone to a high-security enclave, making reverse communication physically impossible.

• Uses fiber optic transmit-only connections on the sending side
• Eliminates the need for manual sneaker-net transfers of vulnerability data
• Can stream CVE updates into an air-gapped network without creating a bidirectional attack surface
• Certified at EAL 7+ under Common Criteria for the highest assurance environments

The automated process of checking a cryptographically signed manifest listing every software dependency against known vulnerability databases to ensure no compromised libraries exist in the stack.

• SBOM (Software BOM) standards include SPDX and CycloneDX
• Enables precise matching of detected CVEs to actual deployed components
• Reduces false positives by verifying transitive dependencies at the file-hash level
• Critical for Executive Order 14028 compliance in federal air-gapped systems

A security appliance that provides the ability to manually or automatically access or transfer information between two or more differing security domains, enforcing strict data inspection and filtering.

• Implements deep content inspection beyond simple signature matching
• Can sanitize vulnerability scan reports before release to lower-classification networks
• Enforces mandatory access control (MAC) policies on all transferred artifacts
• Often combines data diode hardware with application-layer protocol breaks

A point-in-time copy of a system or data volume that cannot be altered or deleted, providing a tamper-proof baseline for forensic analysis and rapid recovery in disconnected environments.

• Used to create known-clean baselines for differential vulnerability scanning
• Enables comparison of current system state against a golden image
• Protects scan results from tampering by compromised administrators
• Leverages WORM (Write Once, Read Many) storage semantics

The practice of defining security and compliance rules in machine-readable definition files, allowing automated enforcement by an admission controller before any resource is provisioned.

• Open Policy Agent (OPA) and Kyverno are common PaC engines
• Can automatically block deployment of images with unremediated CVEs
• Integrates offline scan results into the CI/CD pipeline within the air gap
• Ensures vulnerability policies are version-controlled and auditable alongside infrastructure code