What is the basic idea of security-by-isolation, and why is complete isolation only a theory?

"My system cannot be reached, so it is secure": security by isolating the system from interaction. Complete isolation is theoretical because every cyber system has a task and needs a minimum of interaction.

It is the oldest security concept. The first computers had no cyber security of their own. They stood in suitably secured rooms, the threats assumed an attacker had to be physically present, and there was no networking and no remote access.

In reality you get extensive rather than complete isolation, because some interaction is always needed. Examples of minimal interaction:

• a person operating a console directly at the system,
• the control of an industrial plant connected to the cyber system.