Air-Gapped Backups Explained: Why Your Cloud Backup Might Not Save You

Your Cloud Backup Is Probably Not What You Think It Is

Here's a scenario that plays out in ransomware attacks every day: a business has cloud backup. They've checked that box. They feel protected. Then ransomware hits, and when they go to recover, they discover their cloud backup was encrypted right along with their production data.

How does this happen? Because most cloud backups are continuously synced. The backup software maintains a live connection to the cloud storage, and that connection runs through credentials stored on the server. When ransomware encrypts the server, it encrypts the credentials too — and the attacker uses those same credentials to access, encrypt, or delete the cloud backup.

The cloud backup was online. It was reachable. And that's exactly what made it vulnerable.

This guide explains what an air-gapped backup is, why it's different from a synced cloud backup, and how to implement one. If you've ever assumed that having cloud backup means you're protected from ransomware, this will change how you think about your backup strategy.

What "Air-Gapped" Actually Means

An air gap is a physical separation between two systems. In backup terms, an air-gapped backup is a copy of your data that has no network connection to your production environment. There's no cable, no wireless link, no credentials, no path of any kind from your live systems to the backup.

If a system is disconnected from the network, malware cannot reach it. This is the fundamental principle. Ransomware can only encrypt what it can access. An air-gapped backup, by definition, is inaccessible to anything on your network.

The term "air gap" comes from the literal gap of air between the disconnected storage and any network-connected device. It's not a software setting or a configuration option — it's a physical state of disconnection.

Synced Cloud Backup vs. Air-Gapped Backup

The distinction matters because these two approaches look similar from the outside. Both involve copying data to a separate location. Both can be automated. But they differ fundamentally in how protected the backup is from the very attack you're backing up against.

Synced cloud backup: Your backup software maintains a constant connection to cloud storage. Files are synced in real time or on a schedule. The connection uses credentials stored on your server. If the server is compromised, the credentials are compromised, and the cloud backup is reachable by the attacker.

Air-gapped backup: Your backup data exists on storage that is physically disconnected from your network. To write a new backup, you connect the storage, copy the data, then disconnect it. Between backups, there is no path from your network to the backup. An attacker who compromises your entire network still cannot reach it.

The 3-2-1 Rule: The Foundation of Real Backup Strategy

Security professionals have recommended the 3-2-1 rule for years, and it remains the most practical framework for backup design:

• 3 copies of your data: One primary copy (your production data) plus two backups.
• 2 different media types: Don't put all backups on the same type of storage. For example, one on a network-attached storage device and one on external USB drives or tape.
• 1 copy offsite: At least one backup should be stored in a different physical location — not just a different room, but a different site entirely.

The 3-2-1 rule doesn't explicitly mention air-gapping, but the spirit is the same: redundancy and separation. If one backup is destroyed, compromised, or corrupted, another survives. Adding an air-gapped copy to your 3-2-1 strategy means that even in a total network compromise, you have a clean, unreachable copy to restore from.

Your 3-2-1 Backup Checklist

Use this to evaluate your current backup setup:

1. 13 copies: Do you have your production data plus at least two backup copies?
2. 22 media types: Are your backups on at least two different types of storage (not just two folders on the same server)?
3. 31 offsite: Is at least one backup stored at a different physical location?
4. 41 air-gapped: Is at least one backup physically disconnected from your network between backup operations?
5. 5Immutable: Is at least one backup set to read-only (WORM — write once, read many) so that even if it's reached, it can't be modified or deleted?
6. 6Tested: Have you successfully restored from each backup type within the last 90 days?
7. 7Documented: Do you have a written recovery procedure that someone other than your primary IT person could follow?

If you answered no to item 4 or 5, your backup strategy has a gap that ransomware can exploit.

How to Implement an Air-Gapped Backup

There are several practical approaches, depending on your business size and technical resources:

USB drive rotation: The simplest method. Connect an external USB hard drive, run a backup, disconnect the drive, and store it securely. Rotate between two or three drives so you always have a recent offline copy. Refresh weekly at minimum.

Dedicated backup appliance: Devices like Datto Siris create local backup snapshots that are stored in a way that ransomware cannot easily reach, then replicate those snapshots to an offsite cloud. The local copy is protected by the appliance's own architecture, and the cloud copy is protected by separate authentication.

Cloud with separate credentials: If you use cloud backup, use a dedicated set of credentials for the backup service that are not stored anywhere on your production network. Better yet, use a cloud backup service that offers immutability — locking backups into a read-only state for a defined retention period so they cannot be deleted even by an authenticated user.

The Quarterly Restore Test

Having an air-gapped backup that you've never tested is like having a fire extinguisher you've never checked. It's probably fine. But you won't know until the moment you need it — and that's the wrong time to find out it doesn't work.

Run this routine quarterly:

1. 1Select a representative set of files from your air-gapped backup — not the entire backup, but enough to prove the restore works.
2. 2Restore to a test location — not your production environment. A separate machine or folder where you can verify the restored data without risk.
3. 3Verify the restored data — open files, check databases, confirm the data is complete and uncorrupted.
4. 4Document the results — how long the restore took, what was tested, whether it succeeded.
5. 5Review with your IT provider — if anything failed, fix it before the next test cycle.

If the restore test takes too long, consider whether your backup architecture needs adjustment. In a real ransomware recovery scenario, the time to restore is the time your business is down. A restore that takes three days means three days of downtime — and you should understand the true cost of that downtime before you need to experience it.

Who Needs an Air-Gapped Backup?

If your business has data it cannot recreate — client files, financial records, patient data, project files, intellectual property — you need an air-gapped backup. The question isn't whether your business is large enough to justify it. The question is whether you can afford to lose all your data and start over. If the answer is no, an air-gapped backup is not optional.

Ransomware attackers have made it standard practice to target backups before deploying encryption. They know that if your backups survive, you won't pay. Your backup strategy needs to account for an adversary who is actively trying to destroy it. Dytech Group implements air-gapped and immutable backup architectures for Central Florida businesses. Our data protection services include the offline backup strategies that make ransomware recovery possible — and we test them regularly, so you know they'll work when you need them. If you're not sure whether your current backup would survive a ransomware attack, read our walkthrough of the first 48 hours of a ransomware attack to understand exactly when and how your backup gets tested.