Air-gapped backup is becoming increasingly popular in the backup and disaster recovery (DR) industry. Most backup and DR vendors are already offering it as an integrated feature or in the process of including it in their solution(s). The biggest driver for air-gapping is the increasing number of cyber threats such as ransomware. 

Ransomware attacks have become so sophisticated these days that conventional backup methods are not secure enough anymore. Hackers program ransomware to target not just your production environment(s) but also your backup server(s) – making it necessary to have data protection measures that can counteract it. And that’s where air-gapped backups come in. 

What Is Air-Gapping?

Air-gapping is a data protection practice used to isolate and detach target storage volumes from the production environment and network in order to keep them safe from ransomware. 

Depending on the vendor air-gapped volumes can be provisioned in a number of ways, such as:

• Purpose-built on-premises air-gapped nodes with automated network and power management (e.g., StoneFly DR365VIVA) 
• Virtual air-gapped volumes provisioned, using idle resources, on industry standard hypervisors such as VMware and Microsoft Hyper-V
• Integrated cloud air-gapped volumes in public and/or private cloud

Is Tape Storage Air-Gapped?

Tape arrays deserve a mention when it comes to on-premise air-gapped storage. The degree to which tape storage is air-gapped depends on how it’s used and how often it is connected to your production network. Either way, tape is often not recommended as an air-gapped repository because it involves manual administration, which is prone to human error. 

An example of how tape can be used for air-gapped backups is round robin, a backup tape rotation scheme that involves periodically switching tape drives/arrays depending on predefined retention periods. However, as mentioned earlier, this process is manual and is therefore error-prone.  

Why Do You Need Air-Gapped Backups?

Not long ago, air-gapped backup was treated as an additional data security component to an existing data protection strategy. Today, it has become a necessary ingredient of a reliable backup and DR plan. The primary reason for that is sleeper ransomware.

Sleeper ransomware is a type of malware that after infiltrating your network and system(s) lays dormant. In its dormant state, the malware attempts to infect not only your production environment but also your backup server(s). After some time has passed, typically a week, the ransomware attacks, encrypting not just the production environment but also the backup server(s). 

The best way to counteract the sleeper ransomware is via air-gapped backups. As air-gapped repositories are detached most of the time, they ensure that even if your production and backup are maliciously encrypted, you still have a way to recover your data and restore operations with minimized downtime.

In a digitally transformed business landscape where remote work has become the new working model and data is an integral part of day-to-day operations, most companies and organizations cannot risk downtime or disruption. With ransomware now targeting your entire network and connected environment(s), it’s necessary to have an isolated and detached repository with the latest backup copies of your critical volumes so that you can restore operations quickly in the event of a cyber attack.  

Benefits of Air-Gapped Backups

• Ransomware protection: Protect your critical backup data, snapshots, and replicas in the event of a cyber attack. Air-gapped backups enable you to recovery data and restore system(s) even if your production environment and backup server(s) are maliciously encrypted. 
• Compliance: For organizations that collect, process, and retain sensitive information such as personally identifiable information (PII), medical records, legal and financial information, etc., air-gapping simplifies the compliance journey and helps compliance with industry regulations such as HIPAA/HITRUST, FedRAMP, CJIS, and more. 
• Cyber insurance requirement: Cyber insurance provides coverage for damages and liability resulting from a cyber incident such as hacking, data breach, ransomware, etc. In order to meet cyber insurance requirements, companies are often required to configure reliable backup and DR measures. With air-gapped backups, your company can satisfy cyber insurance requirements easily and potentially lower annual premiums as well. 

Best Practices for Implementing Air-Gapped Backups

Air-gapping is a reliable data protection tool. As with any tool, its effectiveness is determined by how you use it. Here are some best practices that can ensure that you get the most value from air-gapped backups: 

• Use immutable storage: Store your backups in Write-Once Read-Many (WORM) volumes that only allow read-access. Backup data stored in these volumes cannot be edited, overwritten, or deleted, which in turn protects them from ransomware attempting to maliciously encrypt them as well. Features that can help configure WORM volumes include S3 object lockdown and file lockdown. 
• Set up delta-based snapshots: Schedule regular snapshots of your critical physical/virtual or cloud server(s), which allow you to go back to a previous system state in the event of ransomware attack, human error, hardware failure, etc. Delta-based snapshots are faster, as they only create snapshots for the changes you’ve made to a file, volume, and/or server – depending on how you’ve configured it. 
• Use anti-ransomware: With anti-ransomware you can detect and delete dormant ransomware. 
• Encryption at transit and rest: If you’re using cloud air-gapping or a secondary appliance via LAN and/or WAN, be sure to use a gateway that provides encryption during rest in addition to encryption at rest. Encryption will help protect your confidential information from data breaches. 
• Hybrid air-gapping: Instead of setting up an on-prem or cloud-only air-gapped backup, leverage both hot-tier on-prem storage and capacity tiers in the cloud for added efficiency and reliability. With hybrid air-gapping, you can effectively control your Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). 
• Automate air-gapping: By automating network and power management for your air-gapped repositories, whether they are on-premises or in the cloud, you can make sure there’s less chance of human error, management is simpler, and data protection is more reliable. 
• Set up a backup strategy: Backup strategies such as 3-2-1, 3-2-1-1-0, and 4-3-2 enable you to truly leverage air-gapping and protect your critical digital assets from cyber-threats. 

What to Bear in Mind When Setting up Air-Gapping

Air-gapped backups, although reliable, are not a cure-all. When setting up air-gapping, here are a few things to consider: 

• If you’re using cloud air-gapping, your RTOs will be determined by the volume of data you need to recover, network speed, and available bandwidth. It’s good practice to set up on-prem air-gapping and store backup data of your hot-tier workloads on-premises to reduce RTOs. 
• Make sure your storage administration credentials are properly protected.  
• If you’re using tape storage for air-gapping, your ability to protect your critical assets are as reliable as the IT staff managing them. Regardless of the experience, there’s always a possibility for human error.  
• Air-gapped backups are more of a data recovery measure than a preventive measure. They do not prevent a ransomware from attacking your network. Instead, they protect your critical backups from getting encrypted and provide a way to recover from the ransomware once your production has been cleaned of the malware. 

Conclusion

The increasing complexity of cyber attacks has made air-gapping a necessary component for a reliable backup and DR strategy. With air-gapped backups, you can restore your critical operations even if your entire production environment and backup server(s) have been maliciously encrypted.