Simple definition
An air-gapped backup is isolated from the production network to help protect recovery copies against attacks or accidental deletion.
Technical definition
An air gap may be a physical disconnection or strong logical isolation. The objective is to prevent an attacker who compromises production systems from also reaching and deleting every backup copy. Logical isolation still requires strict access controls.
What is an air-gapped backup used for?
Improve resilience against ransomware, compromised administrator accounts and destructive deletion.
Practical example
An organization periodically creates an offline backup copy or stores a protected copy in a repository isolated from production credentials.
Common problems
- Copy never tested
- Isolation only theoretical
- Access to joint administrator with production
Related terms
Ransomware
To be noted: precise behaviors and commands may vary depending on the versions, products and architectures.