Our hyper-connected world is synonymous with progress. Digital transformation promises efficiently-run smart cities, improved economic performance, better healthcare outcomes and all the rest of it. 

Simultaneously, interconnections also create vulnerabilities; from ransomware crippling public services, to cyber attacks designed to damage critical national infrastructure, or silently extract sensitive data for years on end.

Against this backdrop, air-gapped communications remains the gold standard for security. In matters of national security, the safest network is always the one which is physically separated from the internet and the rest of the world.

Venting an innovation vacuum

It’s no surprise that air-gapped communications, designed to operate in isolation, have not felt much evolutionary force. The majority of air-gapped networks are running legacy platforms; relics of a bygone age. Unaffected by the smartphone era, many air-gapped networks still use Jabber, Sametime or Skype for Business.

In a world that’s grown used to WhatsApp and Signal, poor usability feels like a considerable constraint. It can drive users to bypass approved systems in favour of unofficial tools, creating security risks. 

That’s why we ensure Element has the very latest modern user interface with read receipts, threading, embedded voice and video calling and easy message editing. Such features improve the overall productivity of a secure environment; even emoji reactions can have practical benefits in conveying simple information quickly. And while many air-gapped environments only support desktop communications, Element can support handheld devices for use within an air-gap with a consumer-style messenger app.

We’ve also designed Element to support the use of X.509 client certificates for identification and encryption - including hardware-based tokens. Big screens can support GridView, so teams can monitor a dashboard of multiple rooms simultaneously, and chat rooms can include live data feeds from trusted systems within the air-gap.

In short, there’s no reason why an air-gapped communications platform should look or feel any different from a highly-polished online system. The difference is simply that it’s separate from the internet, rather than decades away from the real world. See what modern air-gapped communications looks like in practice.

Deploying into the airgap

Historically, air-gapped systems have been challenging to install and maintain. We’ve made installation as straightforward as possible. Ahead of deployment into a live environment, Element integrates with DevSecOps workflows and supports independent security validation. The distribution includes enterprise features and compliance readiness, for a complete solution.

In a similar manner, although unconnected to the internet, we’ve made sure our air-gapped solutions are easy to maintain with vendor-backed Long Term Support (LTS) to provide a regular cadence for maintenance, and security updates. It’s also backed by our service level agreement (SLA) and comes with Level 3 support. We sell our air-gapped solutions directly, but also through a number of partners who benefit from the stability and support we provide, leaving them free to focus on their customer.

From isolation to controlled integration

As one might expect, Element supports single and multi-site air-gapped environments. It also supports, if desired, secure connectivity to other Matrix-based networks using our cross domain gateway to securely bridge partitioned networks. The cross domain gateway acts like an airlock on a submarine or spaceship, creating a safe passage between two environments. The hardware sits in a highly-trusted environment, where it decrypts, inspects, applies data-loss-protection rules and re-encrypts data as it passes from one domain to the other.

A high-security environment that can message to a low-side network has multiple uses.

For national security and policing, cross domain connectivity can safely support communications between high-side and low-side environments with policy-enforced information flow. It can ensure that sensitive information is shared carefully between high and low side environments to speed information sharing, enforcing data classification labels, rather than relying on manual processes in time critical situations.

For military use, using Element for cross domain communications can support connectivity between separate systems. Vessels, vehicles and equipment for example can connect their respective communications platforms across different classes of network security. For remote cross domain connectivity, the air-gapped environment can be securely connected with less-trusted networks to secure field operations.

Proven air-gapped partnerships

Element’s air-gapped customers include primes, systems integrators and defence contractors as well as various MoDs that we serve directly. When it comes to our partners, they typically run multiple air-gapped environments for a range of their own customers. Many of their air-gapped deployments need to federate across multiple locations. Typically the air-gapped solutions support around 200-500 people, although they can be significantly larger.

Element Server Suite Pro (ESS Pro) is often used to replace legacy solutions, such as Skype for Business or Jabber, or as an alternative to a vendor-locked solution. Although an air-gapped system usually operates in isolation, there is still a strong desire to use a solution based on the Matrix open standard as it ensures a competitive vendor ecosystem for a potential future migration, rather than being tied into a specific vendor and forced to ‘rip and replace.’ 

Defence contractors have also switched to ESS Pro having initially built customer solutions using Element’s FOSS components, or ESS Community. They have done so based on ESS Pro’s improved scalability, management, LTS and technical support.

End users primarily use the desktop version of Element Pro, although there is some usage of the Element Pro app mobile devices approved for dedicated use within the air-gapped environment. End-users enjoy an intuitive modern interface similar to the likes of WhatsApp and Signal but with enterprise performance and functions.

Installing air-gapped

Each ESS Pro release also provides access to an air-gapped bundle containing all the resources that could be fetched from the internet when installing that release. Element’s simple instructions make it easy to import these resources into your own private registry and provide the configuration for ESS Pro such that your installation will use your private registry. And as the same bundle is used as part of ESS Pro’s automated test suite, you know it is all going to work just as smoothly as if you had internet connectivity.