An air gap is a security measure that isolates a system or backup from other networks, physically or logically, so that an attacker who has compromised the main environment cannot reach it. In ransomware defense, an air-gapped backup is one the attacker cannot encrypt or delete because they cannot connect to it.
The idea of an air gap
The term air gap comes from the image of a literal gap of air between two systems, with no cable or network connection bridging them. If a system has no connection to the outside, an attacker operating remotely simply has no path to reach it, no matter how thoroughly they have compromised everything else. Air-gapping is one of the oldest and most intuitive security ideas: the surest way to protect something from a networked attacker is to take it off the network.
In modern practice, air gaps come in two forms. A physical air gap means genuinely no network connection, such as backup tapes stored offline in a vault. A logical air gap uses network controls, isolation, and strict access rules to achieve the same effect without physical separation, keeping a system unreachable from the production environment except through tightly controlled, usually one-way or time-limited, channels. Both aim at the same goal: making the protected asset unreachable to an attacker who has taken over the main network.
Why air gaps matter for ransomware recovery
The air gap's most important modern role is protecting backups. As discussed in the context of immutable backups, attackers deliberately hunt for and destroy backups during an attack, because a victim who can restore has no reason to pay. If the backups sit on the same network as everything else, reachable with the same administrator credentials, they are within the blast radius of the very attack they exist to protect against.
An air gap removes them from that blast radius. A backup that the attacker cannot connect to is a backup they cannot encrypt, delete, or corrupt, no matter how completely they control the production environment. This is why the strongest backup strategies combine an air gap with immutability: the air gap keeps the attacker away from the backup, and immutability ensures that even if they somehow reach it, they cannot alter it. Together they provide the verified, clean, untouchable copy that real recovery depends on.
Air gaps beyond backups
While backups are the most common use, air-gapping is also applied to protect especially critical or sensitive systems in their own right. Industrial control systems, certain medical or research systems, and high-security networks are sometimes air-gapped from general-purpose networks to shield them from everyday threats. The logic is the same: reduce the paths by which an attacker can reach the thing that matters most.
It is worth being realistic, though, about the limits. A pure physical air gap can be inconvenient, since isolated systems are harder to update and use, and history shows that even air-gapped systems have occasionally been breached through indirect routes, such as infected removable media carried across the gap, or a temporary connection opened for maintenance. An air gap is a powerful barrier, not a magic one, and it works best as part of a layered approach rather than as a sole line of defense.
Air gaps in a resilient strategy
For most organizations, the practical application of air-gapping is in their recovery strategy, and it is a cornerstone of being able to recover without paying a ransom. Guidance from CISA and NIST on ransomware recovery consistently recommends maintaining backups that are offline or otherwise isolated from the network, precisely so they survive an attack that compromises everything else. An organization that keeps at least one copy of its critical data air-gapped and immutable has preserved its single most important recovery option.
In a resilient posture, the air-gapped, immutable backup is the foundation on which self-healing recovery is built. Detection and containment limit how far an attack spreads, but it is the untouchable clean copy that guarantees the organization can come back on its own terms. That is what turns the ransom demand from a crisis into a choice the organization never has to make, because it always has a clean copy waiting safely out of the attacker's reach.
The 3-2-1 rule and where the air gap fits
A helpful way to understand where air-gapping belongs is the widely cited 3-2-1 backup rule, a long-standing piece of guidance for protecting data. It says to keep at least three copies of your data, on two different types of media, with at least one copy kept offsite. The rule predates ransomware, but it maps onto ransomware defense neatly, because its whole purpose is to ensure that no single failure, or single attacker, can destroy every copy at once.
In the ransomware era, many practitioners extend it to 3-2-1-1-0: the extra one being an offline or air-gapped copy, and the zero meaning the backups are verified to have zero errors through regular testing. That evolution is telling. It reflects the hard-won recognition that a backup reachable over the network can be destroyed along with everything else, so at least one copy must be genuinely out of reach, which is precisely what an air gap provides. For an organization building its backup strategy, the air gap is not an exotic extra; it is the component that satisfies the single most important requirement of modern backup, that at least one clean copy survives an attacker who has taken over everything connected.
See also
Sources
- CISA: #StopRansomware Guide (offline backups)
- NIST: Data Integrity — recovering from ransomware (SP 1800-11)
Definitions are drawn from the cited sources and were current as of publication. Content was rephrased for compliance with source licensing.