Air-Gapped Backups Explained
Defining an Air-Gapped Backup
An air-gapped backup is a copy of data kept isolated from the production network, so that a compromised computer on that network cannot reach it. The term comes from the idea of a gap of air between two systems, although modern air gaps are usually logical rather than literal.
A physical air gap means the backup media is disconnected from any network, for example an external drive or tape kept offline. A logical air gap means the backup system is connected only briefly, or only through a tightly restricted path, so that no ordinary network route exists between it and the production servers.
How an Air Gap Differs from Immutability
Air-gapped and immutable backups guard against similar threats in different ways. An air gap is about access: an attacker cannot reach the backup at all. Immutability is about permission: an attacker may be able to reach the storage but cannot change or delete locked data.
The two can be combined. An immutable copy on a system with restricted network access gives both protections. Each has a weak point on its own. An air gap that is bridged by a shared administrator password offers less protection than its design suggests. An immutable copy on a system that is always reachable is protected only until its lock period ends. The details of locking are covered in immutable backups.
Trade-offs of Isolated Backups
Isolation makes backups slower to create and slower to restore. Copies may have to be transferred on a schedule, and disconnected media must be stored, handled and tested. An isolated copy is also only as current as its last transfer, and an air gap used occasionally can drift out of date without anyone noticing.
Isolation does not protect against physical events by itself. A copy kept in the same room as the server can be lost in a fire or flood even when it is offline. Keeping isolated copies in a separate location fits the broader approach described in off-site backup storage.
An Isolated Copy Saves a Client Site
A small agency keeps weekly copies of client sites on an external drive. The drive is connected only during a scheduled transfer, then disconnected and stored in a different building. When a client's server is compromised and its live files are encrypted, the agency restores the site from the copy taken before the attack.
The copy was useful only because nothing on the compromised network could reach it, and because it was taken before the intrusion.
Frequently asked questions
Is an air-gapped backup the same as an offline backup?
They often overlap, but not always. An offline backup is one that is not connected to a network at the time. Most air-gapped backups are offline most of the time. The key question is whether someone with access to the production network can reach the copy. A system that is connected only briefly, through a restricted path, can still meet the definition of an air gap.
Can an air-gapped backup be too old to be useful?
Yes. An isolated copy is only as current as its last transfer. If transfers happen weekly, the newest restore point may be a week old, which determines how much recent data could be lost. Match the transfer schedule to how much change the site can tolerate, and combine isolated copies with more frequent backups where needed.