There was a time when protecting a backup was physical work. You swapped a tape, walked it to a safe, and every so often someone drove a copy to a bank box across town. The security came from geography. A copy sitting in a drawer, plugged into nothing, could not be reached by anything happening on your network. That is what people meant by an air gap. Literal air, between the copy and everything else.
That model quietly stopped working, and most businesses never noticed the moment it happened. Today almost nothing is disconnected. Files sync continuously, backups run to cloud storage, and the same admin account that manages your production data usually manages the backups too. The word air gap is still in every vendor brochure. What it actually describes has changed, and it is worth understanding the difference before you assume you have one.
Why Continuous Sync Broke the Old Model
Modern systems are built to eliminate gaps. That is the feature. Your laptop syncs to cloud storage, storage replicates across regions, your backup tool copies on a schedule and reports in. Everything is reachable from everything, all the time, because that is what makes it convenient.
Convenience and reachability are the same property viewed from two directions. If your backup is reachable by your systems, it is reachable by whoever controls your systems. And that is exactly what an attacker goes looking for first. The CISA, MS-ISAC, NSA and FBI joint #StopRansomware Guide published in 2023 says so directly, noting that it is important for backups to be maintained offline “as many ransomware variants attempt to find and subsequently delete or encrypt accessible backups.”
Read that sentence again. Not encrypt your files and hope you have no backup. Find the backup and destroy it, then encrypt your files. Deleting the safety net is a deliberate step, and it is usually done with credentials that were valid.
The Modern Equivalents
You cannot unplug the cloud. What you can do is make a copy that refuses to be deleted, even by someone with your credentials in hand. Four mechanisms get you there, and they work best stacked.
- Immutable storage with a retention lock. The storage itself enforces a rule: this data cannot be changed or deleted until a set date. Microsoft’s Azure Blob Storage documentation describes this as write once, read many, explaining that when a time based retention policy is set, clients can create and read data but cannot modify or delete it, and that after the retention interval expires the data can be deleted but not overwritten.
- A lock that even you cannot undo. This is the part that matters and the part people skip. Microsoft’s documentation states that a locked time based retention policy cannot be deleted, and that the retention period can be extended but not decreased. Amazon’s S3 Object Lock documentation goes further with its compliance mode, stating that a protected object version “can’t be overwritten or deleted by any user, including the root user in your AWS account.”
- A separate account with separate credentials. The backup lives under an identity that has no relationship to your day to day administration. Different login, different multifactor, ideally a different provider. Nobody signs into it on a Tuesday to fix a printer problem.
- A legal hold for the open ended case. Both Microsoft and Amazon document a hold that keeps data readable but undeletable until someone explicitly clears it, with no expiration date. Useful when you do not yet know how long something needs to survive.
Worth noting one honest caveat from the same 2023 #StopRansomware Guide: it advises using immutable storage with caution, because immutability alone does not satisfy every regulatory requirement. If you are in a regulated industry, immutability is a starting point, not a compliance checkbox.
The Goal Is Not Disconnection
Here is the contrarian bit, and it is the point of this whole article. Chasing a literal air gap in a cloud environment is a waste of your time. It is not achievable in any practical sense, and pursuing it leads people to build fragile manual processes that quietly stop happening in month four.
The real goal was never disconnection. Disconnection was just the best tool available at the time for achieving something else: a copy an attacker cannot destroy. That is the actual objective. Physical separation was one way to get there. A retention lock is another way, and in a cloud environment it is the better one, because it does not depend on anybody remembering to do something on a Friday.
Think of it like a safe deposit box with a time lock. The bank is not disconnected from the world. Anyone can walk in the front door. But the box does not open until the clock says so, and the branch manager cannot override it because they were asked nicely. The protection is in the rule, not in the distance.
This reframe matters practically. Once you stop asking “is it offline” and start asking “who could delete this today,” you get a much more useful answer. Usually the answer is that your one domain administrator account could delete every copy of everything you own in about four minutes. That is the problem worth fixing, and unplugging things is not how you fix it.
What This Looks Like at a Small Business
None of this requires an enterprise budget. Here is a setup that fits a twenty to two hundred person company, in the order we would build it.
- Ask who can delete your backups. Write down every account that can. If that list includes the same account you use for daily administration, you do not have an air gap of any kind, modern or otherwise. This audit takes twenty minutes and it is the whole ballgame.
- Turn on immutability where your backups already live. Most reputable backup platforms and cloud storage services support a retention lock today. Many businesses are paying for it and have never enabled it. Check before you buy anything.
- Set the retention window to match your discovery time. Not how long you want to keep data, but how long it realistically takes you to notice a problem. If your accountant would catch a discrepancy at quarter close, a fourteen day lock is useless. Thirty to ninety days is a common sensible floor.
- Create a dedicated backup identity. Its own account, its own strong multifactor, used for nothing else. Store the credentials somewhere a compromise of your main environment would not expose. This is where a hardware security key earns its keep.
- Keep one copy at a different provider. If everything you own lives in one vendor’s ecosystem, an account level problem there is an extinction event. One copy somewhere else buys you options.
- Restore from the locked copy on purpose, twice a year. Not the convenient copy. The protected one. Immutability that nobody has ever restored from is a theory.
The Bottom Line
The old air gap is gone and it is not coming back. What replaced it is better, if you actually turn it on: storage that enforces a rule your own administrators cannot override, held under credentials that live outside your daily blast radius. The technology is mature, it is usually already included in what you are paying for, and configuring it is an afternoon of work rather than a project.
Stop asking whether your backups are offline. Start asking who could delete them before lunch. If you do not like the answer, or you are not sure what your current backup platform is capable of, we can look at it with you and tell you plainly what is protected and what is not. We do this with small and mid-sized businesses across Denton County, and it is one of the few security improvements you can finish in a day. Contact us today
Sources:
Comments are closed