Air-Gapped Backups in a Connected World

An air gap is a separation between a system and any network that could reach it. In its purest form, it means physical disconnection: a tape on a shelf, a drive in a safe. Air-gapped backups have experienced a renaissance as organizations confront ransomware attacks that seek out and destroy any backup they can reach. I have spoken with several organizations that recovered from serious attacks only because they had an isolated copy that attackers could not touch. In each case, that copy was the difference between a difficult week and a potential catastrophe.

Physical Air Gaps

The traditional air gap involves removable media, most commonly tape, stored offline. Once a tape is ejected and placed in storage, no network attack can reach it. Tape remains cost-effective for large volumes and long retention. The drawbacks are slower recovery and the operational effort of managing physical media.

Logical Air Gaps

Modern approaches create isolation without physical removal. A logically air-gapped system is reachable only through tightly controlled channels, often opening a connection briefly to receive data and then closing it. Credentials differ from the production environment, administrative access is restricted and management interfaces are not exposed to general networks. Cyber recovery vaults take this further, placing a protected copy in an isolated environment with its own security controls.

Combining Isolation With Immutability

Isolation reduces the chance that attackers can reach backup data. Immutability ensures that even if they do, they cannot alter or delete it. The strongest protection combines both.

Cloud-Based Isolation

Cloud object storage with retention locks, held in a separate account with distinct credentials, can provide a practical isolated copy. Organizations should ensure the account cannot be accessed using production credentials.

Recovery Planning

An isolated copy is only valuable if it can be restored when needed. Organizations should plan how they will access and restore from air-gapped copies, including the time required and the clean environment into which data will be recovered.

Balancing Protection and Practicality

Not every backup needs to be air-gapped. A common approach keeps frequent backups on fast, immutable storage for routine recovery, with periodic copies sent to an isolated location for worst-case scenarios.

Ownership matters as well. Isolated copies are sometimes created with enthusiasm and then neglected, with media left unverified or retention schedules ignored. Assigning clear responsibility for the isolated tier, with regular checks that copies are being created and can be read, ensures that this last line of defense remains dependable over time. Periodic audits by someone outside the backup team add a useful independent check that the isolated copies remain complete and recoverable.

The Bottom Line

Air-gapped backups provide protection that connected systems cannot match. Physical and logical approaches each have roles, and combining isolation with immutability offers the strongest defense. Recovery from isolated copies must be planned and tested. Organizations should ensure at least one copy of critical data sits beyond the reach of attackers. In my experience, that single precaution has saved more organizations than any other backup practice.