Air-Gapped CTF Platform: Requirements for Classified Training Environments
Air-gapped networks exist for a reason. They protect classified information, sensitive operations, and critical infrastructure from external threats by physically isolating systems from the internet. Any tool introduced into an air-gapped environment must operate entirely within that boundary - no cloud dependencies, no external API calls, no update mechanisms that reach outside the network.
Cybersecurity training in these environments faces a unique paradox: the teams that most need practical security training operate in networks where most training platforms cannot function.
Who Needs Air-Gapped CTF Deployment
Three categories of organizations require air-gapped training capability. Defense and intelligence agencies conduct cyber exercises within classified environments where training data and scenarios may themselves be classified. Critical infrastructure operators including energy, water, and transportation systems maintain isolated operational technology networks where security training must occur without introducing connectivity risk. Government agencies handling sensitive data require training environments that comply with strict data sovereignty and classification requirements.
Technical Requirements
An air-gapped CTF platform must satisfy several architectural constraints. Zero external dependencies means the platform operates entirely within the local network with no calls to cloud services, CDNs, package repositories, or external APIs. Self-contained provisioning ensures all challenge environments, databases, and supporting services run on local infrastructure. Offline content means all challenge content, training materials, and platform assets are pre-loaded before deployment. Local authentication uses the organization's internal identity systems rather than external providers. No telemetry means the platform does not attempt to send usage data, crash reports, or analytics to external endpoints.
How Athena Supports Air-Gapped Deployment
Athena's Enterprise plan includes air-gapped deployment as a supported configuration. The platform deploys on government or organizational infrastructure - physical servers or private cloud - without internet connectivity. Challenge content and platform assets are packaged for offline installation. All features - scoring, leaderboards, participant management, audit logging - operate without external dependencies.
This means classified training exercises can use the same platform capabilities as cloud-hosted deployments: private environments per participant, multi-event management, dynamic scoring, and 30-day audit logs.
Deployment Architecture
A typical air-gapped Athena deployment includes the platform application server running on local infrastructure, a database server for event data and audit logs, challenge environment provisioning running within the local network, and an admin dashboard accessible from authorized workstations within the air-gapped boundary.
The deployment package is transferred into the air-gapped environment through approved media (removable drives, cross-domain transfer solutions) following the organization's security procedures. Once deployed, the platform operates independently.
Security Considerations
Introducing any software into an air-gapped environment requires security review. Key considerations include supply chain verification to ensure the deployment package has not been tampered with during transfer. Code audit verifies the platform does not contain backdoors, covert channels, or unintended connectivity mechanisms. Hardening applies appropriate system hardening to the platform infrastructure per organizational security standards. Access control implements role-based access limiting who can administer the platform and view exercise data.
AstraQ Cyber Defence supports security review processes for organizations requiring air-gapped deployment, including providing documentation and access to technical details needed for security assessment.
Frequently Asked Questions
Can Athena receive updates in an air-gapped environment? Updates are delivered through the same approved media transfer process used for initial deployment. The platform does not auto-update or reach external servers.
What hardware is required? Hardware requirements depend on event size and challenge complexity. AstraQ provides deployment specifications based on the organization's requirements.
How do we get challenge content into the air-gapped environment? Challenge content is packaged with the deployment or transferred separately through approved channels. Custom challenges created within the air-gapped environment remain within the boundary.
Is air-gapped deployment available on all plans? Air-gapped deployment is available on Athena's Enterprise plan. Contact AstraQ for pricing and deployment planning.
Train in classified environments.
Contact AstraQ for air-gapped deployment planning and government pricing.