An air-gapped backup is a backup copy kept where an attacker who is already inside the company's network cannot reach it. The air gap is the break between the copy and the network. If there is no connection, an attacker with stolen passwords still has no way to reach the copy, and ransomware cannot encrypt it.
There are three common ways to build an air gap.
The oldest way is physical. Backups are written to tape cartridges. The cartridges are then taken out of the tape library and kept on a shelf or in a vault. A cartridge on a shelf is connected to nothing.
The second way is a vault that connects only for a short time. A vault here is a separate storage system on its own locked network. Once a day, the vault's own software opens a connection, pulls in the newest copies and closes the connection again. The vault always starts the connection itself. So nothing on the main network can log in to the vault, even with an administrator's password.
The third way is a cloud vault. The copy is sent to a cloud account that the backup provider runs, with separate logins that the company's own administrators do not hold. The second and third ways are sometimes called a logical air gap, because a network cable still exists, but it is closed or controlled from the other side.
Imagine a state electricity distribution company in Lucknow. Its billing system holds the accounts of 50 lakh customers. Every night, its backup software copies the billing database to disk inside its data centre. At 4 a.m., a separate vault in a locked room opens a connection for 45 minutes. It pulls in the night's copy, checks that the copy is complete, and disconnects. For the other 23 hours of the day, the vault has no route to the main network.
Say ransomware one day locks the billing servers and also the backups on disk. The attacker has administrator passwords and can reach everything on the network, except the vault. The company restores the billing database from the vault's copy of the night before. Bills go out a day late, but no customer's account is lost.
What does an air gap cost? Time. A copy kept off the network takes longer to bring back. Tapes must be fetched and loaded, and a vault usually restores more slowly than the disks next to the servers. So companies keep a fast local copy for everyday restores, and keep the air-gapped copy for the worst day.
An air gap keeps the copy out of reach. An immutable backup locks the copy so that it cannot be changed. The two protections are often used together, inside backup and recovery software. The air-gapped copy is often the one that makes ransomware recovery possible when everything else is locked.