Cloud 101
Air-gapped Backup vs. Immutable Backup: What's the Difference?
Ransomware attackers are increasingly targeting backups because encrypted production data alone fails when organizations can restore data from backups.
A number of ransomware-resilient backup countermeasures help protect backups. These include “air-gapped" backups and immutable backups. While the two concepts overlap more than most explanations suggest, the cloud is where that overlap becomes practical.
This article examines air-gapped vs immutable and explains how they differ, particularly with regard to cost and administrative complexity.
What is an air-gapped backup?
An air gap cloud backup is a copy of data that is isolated from the network so attackers cannot breach it. Traditionally, an air-gapped backup was physically separated from the network, i.e., with actual air between them. This approach is still in use, with organizations creating backup tapes and storing them in a separate location.
Physical air gaps are becoming less common, however. They tend to be costly and hard to scale. Data recovery is slow, and inevitably, the recovery point objective (RPO) for data in a backup tape is going to be measured in days. It might take all day, or longer, to send a truck to retrieve tapes from wherever they’re being stored (such as in old salt mines). A successful ransomware attack will inevitably result in some data loss.
The alternative is to create a logical or virtual air gap backup, which uses network isolation, typically on a cloud platform, to separate backed-up data from systems that might suffer a breach. Approaches to logical air gaps vary, but they often involve segmenting networks into isolated zones using Virtual Local Area Networks (VLANs). With this architecture, traffic, including attack vectors, cannot move between them. To work, a logical air gap requires tight access controls, authentication processes, and separate control planes.
What is an immutable backup?
An immutable backup is a copy of data that cannot be changed, overwritten, or deleted for a set period of time. Immutable backups reside on immutable storage, which is a class of data storage with unchangeable characteristics. Immutable storage does not rely on encryption or physical isolation to protect data. Rather, its immutability comes from a write-once policy that is enforced by the storage layer itself, not by an admin's permissions.
Wasabi offers immutable backup through Wasabi Object Lock, which is a feature of Wasabi Hot Cloud Storage. Object lock lets users designate certain objects to be immutable.
Air-gapped backup vs. immutable backup: key differences
What are the differences between air gap vs immutable backup? The table below offers a backup security comparison and summarizes the key differences:
Characteristic | Air-gapped backup | Immutable backup |
|---|---|---|
| Isolation method | Either physical separation, such as with tapes, or logical separation through network segmentation and related controls. | Isolation at the storage layer through a write-once policy. |
| Protection against deletion | No inherent protection—if the air-gapped network segment or device can be breached, the attacker can delete the backed-up data. | Data is protected against deletion based on the write-once policy, which makes it impossible for an attacker to delete, overwrite, or modify data. |
| Protection against network-based attacks | Physical air gaps protect data from network-based attacks. However, administrators are sometimes surprised to discover that physically separated networks are actually connected via previously undetected wireless Internet connections. Logical air gaps are protected from network-based attacks through network segmentation and related controls, such as user authentication. However, an air-gapped backup is not protected from a malicious insider. | Immutable backups are not protected from network-based attacks. However, a ransomware attacker will be unable to encrypt the immutable object because it cannot be modified or overwritten. Immutable backups are protected against malicious insiders because even a user with access cannot override the write-once policy during the retention period. Still, attackers may be able to exfiltrate immutable data over the network. |
| Recovery speed | Recovery speeds for physical air-gapped backups can be slow, for example up to several days if the process requires retrieving tapes from a storage facility. Recovery for logical air-gaps is faster, though there can still be delays due to administrative procedures required for data restoration. | Data from immutable backups is available for recovery instantly. Recovery time can be measured in minutes. |
| Operational overhead | Physical air gaps are expensive to operate. Expenses include paying for an offsite facility, maintenance of equipment, such as tape backup devices, transportation, and administration. Logical air gaps come with administrative overhead related to defining, updating, and enforcing policies for access control. There may also be specialized software required for maintaining multiple network segments for the purpose of air-gapped backup. | Immutable backups can have low operational overhead. With Wasabi, for example, immutability is built into the cloud storage solution, reducing the need for dedicated administration or specialized software. |
Do you need both an air gap and immutability?
Yes, the strongest setups feature an air gap and immutability for strong ransomware resilience. Use both an air gap and immutability as part of a layered backup strategy that follows the 3-2-1-1 backup rule. The 3-2-1-1 rule extends the traditional 3-2-1 backup model—three copies of data on two different media types, with one copy off site—by adding a copy that is offline or immutable.
The cloud enables backup managers to realize air gap and immutable storage on a single platform. There is no need for two separate projects. Instead, a single Wasabi Hot Cloud Storage instance can contain Wasabi Covert Copy, which enables a virtual air-gapped backup, and Wasabi Object Lock, which creates an immutable backup.
Wasabi Covert Copy creates a hidden copy of data that unauthorized users cannot access, helping keep it protected and unchanged. The copy stays synchronized with the source data at 30-, 60-, and 90-day intervals. Access is controlled by Wasabi’s Multi-User Authorization feature, which requires approval from multiple trusted security administrators before anyone can access it.
Wasabi Object Lock offers a practical, lower-overhead approach to air-gap protection. Data held in Object Lock is immutable. Immutable objects are protected by encryption and hashing, as well as policy-based controls that prevent anyone, including system administrators, from altering them in any way. They can be locked individually or as part of a broader bucket policy.
How to set up immutable, air-gapped backup in the cloud
It's simple to set up immutable backup and air-gapped backup in the cloud:
Step 1: Establish a retention period on the backup bucket using Object Lock.
Step 2: Configure Object Lock.
Step 3: Restrict deletion permissions.
Step 4: Separate backup credentials from production accounts.
Step 5: For Covert Copy setup, use a Covert Copy bucket to keep the recovery copy unlisted until a Multi-User Authorization request approves temporary access.
Covert Copy automatically sets up its own isolation. Once configured, the Covert Copy and its bucket drop out of standard list-bucket responses. Any recovery access request requires Multi-User Authorization, plus a 24-hour approval window before the data becomes visible again.
For more information, visit the Wasabi Covert Copy page.
covert copy
Your last line of defense against cyber threats
Make your data invisible, impenetrable, and impervious to external and internal bad actors with Wasabi's Covert Copy™ technology, an innovative new take on the virtual air-gap.