Techniques for controlling and regulating network access on air-gapped endpoints

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for controlling access to networks by an air-gapped endpoint, the process comprising:

• identifying, by a hypervisor, a type of a network being connected, upon detection of a new network connection to the air-gapped endpoint:
• determining for each security zone of a plurality of isolated security zones at least one access rule to access the network, wherein the plurality of isolated security zones is operable in a virtual environment instantiated on the air-gapped endpoint, wherein the hypervisor prevents any interfacing of a user device with the primitive OS;
• initializing, on the air-gapped endpoint, the hypervisor for execution over a primitive operating system (OS) of the air-gapped endpoint in the virtual environment, wherein the primitive OS is configured to execute only device drivers and is restricted from executing any application received over the network;
• allowing a connection between a security zone and the network based on the at least one access rule;
• exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the network is through the physical NIC;
• managing the connection to the network by a networking virtual machine, wherein the networking virtual machine operates in a non-persistent mode, wherein the networking virtual machine returns to its initial clean state after each boot;
• and
• monitoring all traffic between the security zone and the network to at least maintain compliance with a security policy set for the respective security zone.

An air-gapped computing system, comprising:

• a network card interface;
• a processing circuitry;
• and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• identify, by a hypervisor, a type of an a network being connected, upon detection of a new network connection to the air-gapped endpoint;
• determine for each security zone of a plurality of isolated security zones at least one access rule to access the network, wherein the plurality of isolated security zones is operable in a virtual environment instantiated on the air-gapped endpoint, wherein the hypervisor prevents any interfacing of a user device with the primitive OS;
• initialize, on the air-gapped endpoint, the hypervisor for execution over a primitive operating system (OS) of the air-capped endpoint in the virtual environment, wherein the primitive OS is configured to execute only device drivers and is restricted from executing any application received over the network;
• allow a connection between a security zone and the network based on the at least one access rule;
• exposing a virtual network interface card (NIC) corresponding to a physical NIC, wherein the connection to the network is through the physical NIC;
• managing the connection to the network by a networking virtual machine, wherein the networking virtual machine operates in a non-persistent mode, wherein the networking virtual machine returns to its initial clean state after each boot;
• and
• monitor all traffic between the security zone and the external network to at least maintain compliance with a security policy set for the respective security zone.