Data diodes of some level are semi-common in my experience. An SSH bastion host is a sort of that thing.
I think it works better than you realize, though it is about as painful. Most of these just ban UDP leaving the subnet. TCP is stateful so you can set firewalls to allow inbound connections but not outbound, and you can terminate TCP connections based on bandwidth ratios (ie if you’re sending more than 10% of what you’re downloading then the connection gets killed).
Im largely with you on air gaps in the modern day, with the exception of storage. Backups should be airgapped, but that’s common practice basically anywhere that runs their own servers.
I think it works better than you realize, though it is about as painful. Most of these just ban UDP leaving the subnet. TCP is stateful so you can set firewalls to allow inbound connections but not outbound, and you can terminate TCP connections based on bandwidth ratios (ie if you’re sending more than 10% of what you’re downloading then the connection gets killed).
Im largely with you on air gaps in the modern day, with the exception of storage. Backups should be airgapped, but that’s common practice basically anywhere that runs their own servers.