What is an air gap backup?

Air gapping is considered to be a crucial layer of protection defending against data loss, ransomware attacks and other cyberthreats or cyberattacks.

The “air gap” refers to the separation of the backup data from any publicly accessible networks, creating an “air wall” between the data and any access points that might be vulnerable to hackers. An air gap backup might be created in various ways:

• A physical air gap is created by disconnecting hard disk drives or other storage media and storing sensitive data on or offsite.
• A logical air gap can be enabled by software on an air-gapped partition.
• A backup solutions service provider can provide cloud backup that uses their own logical air gap.

The following are some of the main benefits of air gapping:

• Protecting against ransomware attacks
• Preventing data loss and ensuring business continuity
• Maintaining compliance and preventing potential liability

Air gapping as a practice may also extend to other types of air-gapped systems and computers that are isolated from any public or vulnerable digital access points as part of a broad data protection strategy. Implementing an air gap backup as part of an organization’s broader cybersecurity measures adds an additional layer of security. While all cybersecurity strategies have their vulnerabilities, incorporating an air gap backup can ensure business continuity by preventing costly outages.

According to the Verizon 2024 Data Breach Investigation Report¹, ransomware attacks remain a top threat across 92% of industries, with record-breaking ransom payments exceeding USD 1 billion in 2023².

IBM's Cost of a Data Breach Report shows that the average cost of a ransomware breach is USD 5.13 million, not including ransom payments.

Unfortunately, extremely damaging ransomware attacks are on the rise. During a ransomware attack, hackers infect target systems with malware that copies sensitive information for data exfiltration and encrypts it, blocking access for the rightful owners and preventing access to even authorized users.

While air gapping is not enough to prevent data breaches, it should be incorporated as a backup strategy as part of the broader security measures for any individual or organization dealing with sensitive data.

Lost data is a potentially crippling development for a business or organization. When sensitive information falls into the wrong hands, the consequences can grow exponentially. In addition to standard ransomware attacks in which hackers demand a ransom to return access to a company’s own data, so-called double- and triple-extortion ransomware attacks pose an even greater risk. In these types of attacks, hackers will demand a ransom to return data access to the victim organization and then demand more payments, threatening to leak the stolen sensitive information publicly or attack an organization’s clients or partners if their demands aren’t met.

As threatening as ransomware attacks might be, air gapping is an immensely effective method of data protection for any disaster recovery strategy invested in absolute data retention. Air-gapped systems play a vital part in safeguarding against cyberattacks, providing added defense beyond traditional firewalls against both human error and bad actors with unauthorized access.

If they remain secure, air-gapped copies of data can provide an offline backup for complete data recovery in the event of unwanted data deletion or malicious data breaches.

Creating an air gap can be accomplished in 3 ways:

• Physically
• Logically
• Through the cloud

Each type of air gap has its strengths and weaknesses. Physical air gaps offer the most defense in terms of isolation; however, they also require the most effort to access and restore. Logical and cloud-based air gaps, while more convenient, present more vulnerabilities compared to physically separated backups. What type of air gapping, if any, that an individual or organization needs will depend on their unique requirements and resources.

Physical air gaps are achieved by disconnecting the storage media from any device with a network connection. To physically air gap a backup, the storage volume must be removed from the system, and all wired and wireless connections must be severed.

Multiple air-gapped storage volumes might be connected to each other through either a wired or wireless connection. But if any of these devices can be accessed by an outside actor, none can be considered air-gapped.

Physical air gapping can include storage volumes (for example, external hard disks, diskettes, tapes) or specialized backup devices designed with added network isolation functionality. Devices like these typically offer more automation to facilitate easy backups.

Logically air-gapped storage volumes can be created using software partitions and network segmentation as a type of storage virtualization. While potentially less secure than physically air-gapped backups, logical air gaps are much more convenient and can provide similar benefits if the storage volume is separated from the network.

Cloud air gaps are air-gapped environments operated by backup service providers. Organizations can send backup data to the cloud, and the providers will move the data to immutable storage stored on logically air-gapped volumes.

Cloud air gaps add the extra benefit of offsite storage. However, users are obligated to the specific practices of the provider. While many reputable service providers offer a range of options and packages, their specific offerings might not be suitable to a given organization's requirements.

An air gap backup offers many key benefits, including network isolation, ransomware protection, data loss prevention, enhanced security controls and encryption and hashing.

In the context of disaster recovery, air gap backups serve a similar purpose as cloud storage or immutable backups. An air gap backup simply provides another redundancy by maintaining another immutable backup that cannot be altered or deleted.

What sets the air gap apart from other types of data backups is the physical or logical separation from network access. By keeping an air gap backup offline in a secure location, the threat of an attack or accidental corruption over the network is removed completely.

Immutable storage is a way to store data so that once saved, the data might not be changed or deleted—either indefinitely or for a set period of time. Based on the concept of write-once-read-many (WORM) data security, immutable storage is often used for creating data backups. These types of files might be viewed but never edited, altered or otherwise changed.

The difference between immutable storage and air gap backup is not a matter of the file storage itself, but the process of where and how that storage is kept. Indeed, the data stored in an air gap backup is likely to be immutable data. However, immutable storage by itself is not necessarily air-gapped and can be stored on a device that has network access. Also, air-gapped immutable backups must be either logically or physically separated from the network.