But only because someone plugged a USB drive into the centrifuge computers.

If the networks were air gapped, it wouldn't be Matthew's fault. Someone who had access to the engineering network would need to screw up. Which is of course perfectly possible—engineers make mistakes too. (Furthermore, if they were hacked by a nation state... for all we know it really could have been done without any user action at all.)

> But only because someone plugged a USB drive into the centrifuge computers.

Either that or one of the Siemens engineers who showed up at the plant's laptop was infected in anticipation of them showing up there to fix stuff.

Viruses spread quite fine without the help of any networking in the days of MS-DOS.

Likely you want to transfer data from an airgapped computer and back. So you need some way of transferring it.

It’s not obvious to me why engineering and accounting should need to transfer any data and back forth beyond basic email communications.

Email seems simple to you, but in fact it's an incredibly complicated protocol, so software treating it is likely to have many (exploitable) bugs. Also, there are attachments. Those are the classical way to hack many places.

Even if you got all of the issues caused by e-mails figured out, somehow you have to transfer them from one network to another. You'll either have to poke holes into your firewall or use USB sticks.

My point is: even in airgapped networks you usually want to exchange some data. The moment you want to exchange data, you have a path where a virus can be smuggled in.

Single sign on etc: usually there's a resource that everyone in the company needs to use. Besides, email is a major infection vector.

I mean email is a vector too. And remember that 0 day no touch iOS exploit that was discovered by project zero? Surely that could have been vector too. After that use a compromised iOS device to do something similar by exploiting some bluetooth vulnerability.

If we only have a single example of their defeat in the last more than a decade, I'd say that's evidence they're a pretty good word.

What other security features claim that performance?

I'd argue that many/most instances of the "dropped USB stick in parking lot" infiltration technique are also failings of airgapping as a total security measure.