The ransomware note usually arrives after the damage is done — but for a growing number of victims, the worse discovery isn’t the encrypted production data. It’s opening the backup console and finding the recovery points are gone too. Modern ransomware operators don’t just encrypt live systems; they actively hunt for backup repositories, delete snapshots, and disable retention policies before detonating the payload. When the backup is reachable from the same network as everything else, it is not a separate line of defense — it’s just another target with a slightly longer fuse.
An air-gapped backup breaks that chain by ensuring at least one copy of your data has no live, persistent path an attacker’s malware can traverse. It sounds almost old-fashioned in an era of API-driven, always-on infrastructure, but that’s precisely the point: the strategy trades convenience for isolation, and isolation is what ransomware can’t cross. This piece walks through what a real air gap requires, how the “logical air gap” concept extends the idea to cloud storage, the operational tradeoffs involved, and how air-gapping fits into a broader layered strategy rather than replacing it.
What Actually Makes a Backup “Air-Gapped”
The term gets used loosely, so it’s worth being precise. A true air gap means there is no active network connection — physical or logical — between the backup copy and any system an attacker could compromise, at the moment that copy is not being written to. Two mechanisms deliver this in practice:
- Physical air gaps. Tape cartridges ejected from the drive and stored in a vault, or rotated to an offsite facility, are physically disconnected. External drives that are unmounted and unplugged after a backup job completes fall into the same category. No malware, however privileged, can reach media that isn’t electrically connected to anything.
- Logical air gaps. A system that has no standing credentials, no persistent session, and no routable network path to the backup target — even though the data technically lives on connected storage (most commonly object storage in the cloud). Access is granted only for the narrow window a backup or restore job runs, using short-lived credentials, and is otherwise closed.
Both approaches share the same defining property: an attacker who has fully compromised the production environment — including domain admin credentials, hypervisor access, and backup console logins — still cannot reach the isolated copy, because there is no session, credential, or network route available to abuse at rest.
Why Ransomware Specifically Targets Backups
It’s worth understanding the mechanics of the threat this defends against, because it explains why partial measures fail. Contemporary ransomware families don’t treat backup infrastructure as an afterthought — reconnaissance is often the first phase of an intrusion, well before encryption begins. Attackers with a foothold will enumerate backup server hostnames, query storage APIs for connected repositories, and specifically search for volume shadow copies, NAS-hosted backup shares, and backup application databases.
Once found, three outcomes are common: shadow copies are deleted via built-in OS commands, backup repositories reachable over SMB or NFS are encrypted alongside production data, and backup software accounts — frequently over-privileged because they need broad access to back everything up — are used to log into the backup console itself and purge retention policies or delete jobs outright. This is why “we have backups” is not the same statement as “we have backups that will survive an attack.” If the backup target is a mapped network drive, a domain-joined server, or a cloud bucket with standing write/delete credentials cached on production systems, it is reachable by the same access the attacker already has.
An air gap removes the reachability, not just the visibility. Encryption of the backup data in transit and at rest helps against exfiltration and tampering, but if the storage itself is still network-accessible with valid credentials, encryption alone doesn’t stop a delete command from succeeding.
Physical Tape: Still the Reference Case
Tape’s reputation as legacy technology obscures how well it satisfies the air-gap requirement by default. A cartridge that has been written, verified, and ejected from the drive is inert — it draws no power, accepts no commands, and cannot be addressed by anything until a human physically loads it back into a drive. That property, not tape’s cost-per-terabyte economics, is why regulated industries and large enterprises with mature disaster recovery programs still rotate tape into their strategy even after adopting extensive disk and cloud tiers.
The operational cost is real: someone has to manage the rotation schedule, physically transport media offsite, track retention and destruction, and periodically test restores from tape hardware that may not be exercised often. Restore speed from tape is also materially slower than from disk or object storage, which matters when the recovery time objective is measured in hours, not days — a topic covered in more detail in RPO vs RTO. None of that makes tape wrong; it makes tape one tier in a plan, not the whole plan.
Logical Air Gaps: Extending the Concept to Cloud Storage
Not every organization can staff a tape rotation, and cloud-native backup targets have become the default for a large share of workloads. The logical air gap adapts the same isolation principle to object storage without requiring physical media handling.
The mechanism generally combines two controls. First, immutability at the storage layer — often implemented through object-lock or WORM (write-once-read-many) settings — prevents a written object from being modified or deleted before a retention timer expires, even by an account with delete permissions. Second, credential isolation ensures the backup software doesn’t hold a permanently valid, broadly-scoped key sitting on a production host where it can be harvested. Instead, access is brokered through short-lived tokens, separate authentication domains, or a jobs-only interface that never exposes standing write/delete rights to the systems being protected.
The distinction matters: immutability alone, without credential isolation, can still be undermined if an attacker obtains sufficiently privileged cloud account access to alter retention policies or the bucket configuration itself. A logical air gap tries to remove that path entirely by ensuring no compromised system has a live credential capable of reaching the vault in the first place. For a deeper look at how object-lock immutability is implemented, see S3 immutable backup with Object Lock, and for the broader ransomware-recovery case for immutability generally, see immutable backups and ransomware recovery.
Operational Tradeoffs: Automation vs. Isolation
Every air-gap implementation trades some automation for isolation, and the honest way to plan for it is to name the tradeoff rather than pretend it doesn’t exist.
- Restore speed. Tape and disconnected drives require physical retrieval and mounting before a restore can even begin. Logical air gaps in cloud storage restore faster but still depend on network throughput and, if credentials must be manually elevated for the restore job, a human step that a fully automated backup pipeline doesn’t have.
- Manual rotation risk. Physical air-gapping depends on someone reliably ejecting, labeling, and storing media on schedule. A missed rotation silently degrades the strategy — the backup job may complete successfully while the resulting media sits connected far longer than intended, quietly closing the air gap without triggering any alert.
- Testing cadence. Media or credentials that are rarely exercised are more likely to fail silently — a tape drive that hasn’t been used in months, or a restore procedure for a logical air gap that’s never actually been rehearsed under pressure. Regular test restores are not optional; they’re what confirms the isolation is functioning rather than merely configured.
- Scope of coverage. Air-gapping every backup job for every system is rarely practical. Most organizations prioritize the systems and data sets that are non-negotiable for survival — often informed by the same criticality analysis that drives RPO vs RTO targets — and air-gap that subset while relying on immutable, network-connected storage for the rest.
None of these tradeoffs are arguments against air-gapping. They’re arguments for treating it as a deliberate operational commitment with its own maintenance burden, not a checkbox that gets set once and forgotten.
Where Air-Gapping Fits in a Layered 3-2-1-1-0 Strategy
Air-gapping is a component of a resilient backup architecture, not a replacement for one. The traditional 3-2-1 backup rule — three copies of data, on two different media types, with one copy offsite — has been extended by many practitioners to 3-2-1-1-0: the same three copies and two media types, with one copy offline or air-gapped, and zero errors confirmed through regular recovery verification.
In that framework, the air-gapped copy is the layer that exists specifically to survive a scenario where every network-connected system, including backup infrastructure, has been compromised. It complements rather than duplicates the immutable cloud tier: immutable object storage protects against deletion and tampering by an attacker who still has some network reach, while the air-gapped copy protects against an attacker who has effectively unlimited reach into everything that’s connected. Running both — plus routine testing to confirm restores actually work — is what turns a backup plan into an actual recovery capability. Foundational choices like incremental vs differential backup determine how quickly each tier can be refreshed and how much data is at risk between air-gap rotations, which is worth revisiting once the isolation layer is in place.
Authoritative guidance from CISA’s joint #StopRansomware Guide explicitly recommends maintaining offline, encrypted backups precisely because many ransomware variants attempt to find and delete or encrypt accessible backups. NIST’s Data Integrity practice guide (SP 1800-25) similarly frames backup isolation as one control among several — alongside integrity checking, access management, and logging — needed to protect assets against ransomware and other destructive events. Neither treats air-gapping as sufficient on its own; both treat it as a necessary layer within a broader program.
Frequently Asked Questions
Is tape still relevant for air-gapped backup?
Yes. Tape’s inherent disconnection when ejected makes it one of the simplest ways to guarantee a true air gap, which is why it remains common in regulated and large-enterprise environments. The tradeoff is slower restore times and a rotation process that depends on consistent manual handling and periodic restore testing.
What is a logical air gap?
A logical air gap uses immutable cloud storage — often via object-lock or WORM settings — combined with credential isolation, so no standing, persistently-valid network credential can reach or delete the backup data. It approximates physical isolation without requiring media handling, but depends on correctly scoped access controls to hold.
How often should air-gapped backups be rotated?
Rotation frequency should match your recovery point objective for the systems being protected — many organizations rotate daily or weekly for critical data. The specific interval matters less than consistency: a missed rotation leaves media connected longer than intended, and infrequent rotation widens the data-loss window if the online copies are compromised between air-gap refreshes.
Does an air gap replace the need for immutable storage?
No. They address overlapping but distinct risks. Immutability protects a network-connected copy against deletion or modification by a compromised account. An air gap protects against a scenario where an attacker has broader reach across connected systems. A layered strategy uses both rather than treating either as a full substitute for the other.