Air-gapped backups: when "immutable" is not enough

Most products that ship an 'air-gapped backup' SKU mean one of three things: an immutable retention policy at the storage layer, a separate tenant in a cloud backup service, or a tape rotation. All three are useful. None of them are an air gap in the physical sense.

The path between the production network and the backup target is up. The backup software walks down that path on a schedule. The credentials to write to the target are stored somewhere the production network can reach. An attacker who has the right tokens and enough time can corrupt the snapshot, change the retention policy, or replace the backup payload before the next restore test.

A backup target that sits behind a hardware switch behaves differently. The path to the target is closed by default. During the scheduled backup window, the line opens, the backup software writes, the line closes. Outside the window, the production network has no route to the target — not because a firewall rule says so, but because the cable is electrically not connected.

An attacker with full production-network compromise during the closed state cannot reach the backup target to alter it. The 23 hours a day the line is down, the backups are not 'protected by policy' — they are physically out of reach.

Backup jobs need to be scheduled rather than continuous. For most environments this is already the case — incremental snapshots run on a cron, not as a live mirror. The shift is that the line itself is on the same schedule as the job, and a missed schedule means the line stays down, not that the line stays up unused.

Monitoring also changes. The signal that matters is not 'did the backup write succeed' — it is also 'did the line open during the planned window, and did it close on schedule'. The relay log is the second half of the backup audit.

A backup that contains malware-laden content is still a backup of compromised data. The line being closed does not detect compromise — it only prevents tampering with the backup payload from the production side.

Combine physical isolation of the target with content-integrity checks on restore (signed snapshots, restore-time scanning, restore to a quarantined network for verification). The line keeps the attacker away from the vault; the integrity checks keep the operator from restoring the attacker's work.