Glossary · Recovery Security
Isolation that protects the path back
An air-gapped backup is a protected copy of data isolated from the production environment in a way that prevents direct access or modification. An air gap separates backup data from the systems it protects, so a compromise in production does not automatically become a compromise of recovery.
Distance between production and recovery.
01 The Definition
What does air-gapped mean?
Air-gapped means separated from the primary environment. That separation may be physical or logical. The purpose is to prevent:
- Production systems from directly writing to backup storage
- Malware from spreading into recovery repositories
- Compromised credentials from deleting recovery points
- Ransomware from encrypting protected backups
- Attackers from easily reaching the recovery environment
An air gap creates distance between production and recovery. That distance protects the path back.
02 The Reason
Why air gaps matter
Modern ransomware does not stop after encrypting production. Attackers target backups because clean recovery points reduce their leverage. They may attempt to:
- Delete backup repositories
- Encrypt connected storage
- Compromise backup administrators
- Destroy shadow copies
- Disable recovery software
- Shorten retention policies
If backup storage is directly reachable from production, attackers can destroy both the systems and the recovery path.
03 Two Forms
Physical and logical air gaps
Both create separation. They make very different trade-offs to get there.
01 Physical air gap
Backup media is completely disconnected from the production network: offline tape, removable storage, disconnected devices, media stored in a separate location. Once disconnected, it cannot be reached through the network. It can also introduce:
- Manual handling
- Slower recovery
- Complex testing
- Longer restore times
- Operational overhead
Physical isolation prioritizes separation. Speed may suffer.
02 Logical air gap
Backup infrastructure stays online but is isolated through architecture and access controls:
- Storage not mounted to production systems
- No persistent write access from production
- No writable network shares
- Segmented administrative interfaces
- Controlled replication channels
- Immutable recovery points
Isolation is enforced through architecture. Not physical disconnection.
04 Side By Side
Physical vs logical air gap
| Physical Air Gap | Logical Air Gap |
|---|---|
| Storage is physically disconnected | Storage remains online but isolated |
| Often requires manual reconnection | Accessible through controlled recovery channels |
| Very strong physical separation | Strong architectural separation |
| Can slow recovery | Supports faster activation |
| May complicate routine testing | Easier to validate regularly |
| Often uses removable media | Often uses isolated recovery storage |
Physical air gaps maximize physical separation. Logical air gaps balance protection with operational recovery speed.
05 The Mechanics
How a logical air gap works
A properly designed logical air gap limits the relationship between production and recovery. Production systems should not be able to treat backup storage like ordinary writable storage.
- No persistent production mounts
- No exposed writable network shares
- Segmented administrative access
- Restricted management interfaces
- Controlled replication
- Separate authentication controls
- Immutable snapshots
Production can be compromised without exposing the backup repository to the same attack.
06 Two Controls
Air gap vs immutability
Related, but not the same. They answer different questions about the same attacker.
Air gap
Reduces access to the recovery environment.
Can the attacker reach the backup?
Air gap prevents access.
Immutability
Prevents protected recovery points from being changed after they are written.
Can the attacker alter the backup?
Immutability prevents alteration.
The strongest recovery architectures use both.
07 The Combination
Why both matter
An air gap alone does not guarantee a recovery point cannot be modified. Immutability alone does not necessarily isolate the backup from production. Together they help protect against:
- Ransomware
- Credential compromise
- Administrative misuse
- Accidental deletion
- Malicious deletion
- Backup targeting
One control protects access. The other protects integrity.
08 Under Attack
Air gaps and ransomware
Once attackers gain sufficient privileges, they actively search for backup repositories. An air gap changes what they find.
How ransomware spreads
- Compromised credentials
- Domain-level access
- Lateral movement
- Automated network discovery
- Accessible file shares
- Connected storage
What an air gap prevents
- Direct write access from infected systems
- Automated encryption of backup storage
- Easy deletion through compromised credentials
- Backup repositories becoming secondary victims
The objective is not to make an attack impossible. It is to make recovery survive the attack.
09 Scope
What an air gap does not do
Isolation is a specific control with a specific job. Two things it is not.
It does not prevent infection
An air gap does not prevent phishing, stop ransomware reaching production, block endpoint compromise, replace firewalls, replace EDR, replace MFA, or guarantee every snapshot is clean.
Prevention protects the front door. Air gap protects the path back.
It does not guarantee fast recovery
A backup can be air-gapped and still take hours or days to restore, especially with physical media. Speed depends on where the backup sits, how quickly it can be accessed, whether a full restore is required, available infrastructure, dependencies, and network configuration.
Isolation protects the backup. Recovery architecture determines how quickly the business can use it.
10 The Pairing
Air gap and Instant Recovery
This is where logical air gap architecture earns its keep. Instead of physically disconnecting media and sacrificing recovery speed, a logical air gap preserves isolation while keeping protected systems activation-ready.
The recovery environment stays separated from production access. It remains ready when recovery begins.
Boot first. Restore whenever.
11 Isolated Is Not Clean
Air gap and Clean Room Recovery
After ransomware, the safest recovery point may not be obvious. Even if a snapshot is isolated, malware may have existed before the backup was created.
An air gap protects the backup from the attack. Clean Room validation determines whether the backup is safe to use.
12 Everywhere It Lives
Isolation across the recovery architecture
The secondary copy should not simply exist. It should remain protected. Cloud changes the location. It does not change the need for isolation.
High Availability
A logical air gap isolates local recovery storage from the production systems it protects, preserving fast local activation, protected recovery points, and reduced production exposure. Local does not have to mean directly exposed.
Disaster Recovery
The remote copy maintains the same isolation principles as the local one: encrypted replication, restricted recovery access, immutable remote snapshots, separated administrative controls, no persistent production write access.
Quorum Cloud
Isolation is logical rather than physical: separate virtual networks, dedicated firewall instances, tenant isolation, encrypted replication, separate storage environments, role-based access, zero-trust authentication.
13 Access Control
Air gap and zero trust
Air-gapped recovery works best when access is also tightly controlled. No user or credential should be trusted simply because it exists inside the environment.
- Multi-factor authentication
- Role-based access control
- Segmented administrative roles
- Encrypted management sessions
- Restricted permissions
- Auditable actions
Access should be verified. Privileges should be limited. Recovery should remain protected from both external and internal compromise.
14 The Platform
How Quorum uses logical air gap
Quorum isolates protected recovery points from normal production access, without forcing the organization to wait for offline media to be located, connected, and restored.
- Snapshots not persistently mounted to production
- No ordinary writable recovery shares
- Controlled access to protected data
- Immutable snapshots
- Encrypted replication
- Segmented recovery infrastructure
Protection remains strong. Recovery remains fast.
Why logical air gap fits modern recovery
Traditional physical air gaps can be effective. But modern businesses often need:
- Frequent protection
- Rapid recovery
- Automated testing
- Remote activation
- Cloud recovery
- Ransomware resilience
Logical air gaps keep recovery infrastructure available without giving production systems unrestricted access to it. That balance matters.
15 Assumptions Worth Testing
Common air gap misconceptions
“Air-gapped means completely offline.”
A physical air gap is offline. A logical air gap can remain online while still preventing direct production access. The key is isolation, not necessarily disconnection.
“Air gap and immutability are the same.”
Air gap reduces access. Immutability prevents alteration. They solve different problems and are strongest when combined.
“An air gap guarantees the backup is clean.”
The backup may still contain malware that existed before the snapshot was created. Clean Room validation may still be required.
“Air-gapped backup automatically means fast recovery.”
Physical air gaps may actually slow recovery. Speed depends on whether systems can activate directly or must wait for a full restore.
16 Knowing The Fit
When air-gapped backup is essential
The more valuable the recovery data, the more important separation becomes.
- Ransomware risk is significant
- Backup storage is network-connected
- Administrative compromise is possible
- Cyber insurance requires stronger controls
- Regulations demand resilient recovery
- Production systems are mission critical
- Downtime has significant financial impact
- Recovery points must survive production compromise
17 Put It Into Practice
Air-gapped backup checklist
An air gap is only one part of recovery readiness. The architecture around it matters.
- Can production systems write directly to backup storage?
- Are recovery repositories continuously mounted?
- Is backup storage exposed as a writable network share?
- Are administrative roles separated?
- Is MFA enforced?
- Are recovery points immutable?
- Is replication encrypted?
- Can systems be activated without a full restore?
- Can recovery be tested without impacting production?
- Is isolated Clean Room validation available?
- Are remote and cloud recovery copies isolated too?
- Has the recovery process actually been tested?
Separation Protects Recovery.
When production is compromised, recovery must remain protected.
Physical air gaps provide strong offline isolation. Logical air gaps preserve isolation while supporting faster activation, automated testing, remote recovery, and cloud resilience. Quorum combines logical air gap architecture with immutable snapshots, encryption, zero-trust access, Clean Room validation, and Instant Recovery.
Right onQ. Off Was Never an Option.
Eliminate Downtime from Recovery
Eliminate Downtime from Recovery
Boot systems directly from snapshots and keep operations running without restore delays.