Air-gapped snapshots and storage resilience

The basics of air gapping

If data storage and backup resources are physically offline and separated from any network connectivity, they are said to be air-gapped. The technique provides strong protection for systems and data from unauthorized access, cyberattacks and ransomware. The concept has several variants.

Figure 1 depicts a typical system and storage configuration, where storage resources are connected to other resources and networks such as the Internet. 

Such an arrangement can be exploited by experienced hackers, malware, cyberattacks and ransomware, owing to the network connectivity. By contrast, Figure 2 depicts an air-gapped storage infrastructure, where no network connection exists.

The absence of any connection from information systems to storage devices eliminates the possibility of security breaches that could damage or destroy business data and information systems. 

The importance of air gaps in storage

If backed-up data is reachable, it becomes vulnerable to attacks. Establishing air gaps eliminates potential attack surfaces. Hackers and security breach software are increasingly sophisticated, with technologies -- increasingly using AI -- that are highly effective at breaching enterprise defenses. Having up-to-date air-gapped copies of critical data and databases increases the likelihood of a successful recovery from a cyberattack. 

Air-gapping blocks network-based access to data backups and offers the following additional benefits:

• Prevents unauthorized access using stolen administrative credentials.
• Assuming air-gapped backups are free of any suspicious code during the backup process, the air-gapped version provides confidence that the backed-up data is free of any infections.
• Compliance with data protection regulations, such as GDPR and HIPAA, is assured using air-gapped storage.
• Business continuity effectiveness is enhanced with access to risk-free data backups.
• Backup infrastructure security is enhanced when critical backups are shielded from cyberattacks using air gapping.
• Adding features like encryption, automated scheduling of backups and hashing for protecting data integrity further enhances air-gapping benefits.
• Air gapping supports the establishment of a Minimum Visible Company (MVC) capability, which exposes only the most critical IT infrastructure elements, while rendering all other resources invisible or inaccessible.

Types of air gapping

Two types of air-gapping can be identified. Physical air-gapping eliminates any connectivity between information systems and storage backups. This is applicable to virtually any storage medium, e.g., removable hard disk drives (HDD) and solid state drives (SSD), tape cartridges or other storage media. A key concern is the time it would take to physically move the air-gapped data into a production environment. 

By contrast, in logical air-gapping the storage assets are still network-connected but access to data is restricted by software-based strict access controls, firewalls, network segmentation and isolated cloud-based storage vaults. While this approach is important in that recovery times are faster due to the network connection, data is still vulnerable to cyberattacks, configuration errors and stolen access credentials.

While each option has its pros and cons, ideally storage security and data protection are best achieved using both approaches.

Air gapping versus immutability

An alternative to air-gapping is immutability, in which technology prevents deletion or modification of data using WORM (write once, read many) or object-lock technology. Logical air-gapping can also use immutability and despite its benefits, the stored data is still reachable. Physical air-gapping does not need immutability as the process eliminates the possibility of accessing the data. 

Immutable backups versus immutable snapshots

Immutable storage can be further separated into backups and snapshots. Immutable backups, as noted earlier, use WORM-based devices and backup software to reduce the likelihood of any changes to the backed-up data for a specific storage time frame. 

By contrast, immutable snapshots are point-in-time copies of a specific storage volume. They are typically read-only, reside within storage arrays for short time frames, and can be used for rapid recovery of production operations.

Mistakes to avoid when using air gapping

Despite its many benefits, as noted in this article, a few caveats on air gapping need to be presented. 

• Logical air gaps can still be breached.
• Data to be backed up on air-gapped storage must be clean and free of any malicious code.
• Minimize connection windows when using logical air gapping to prevent hacker exploitation.
• Ensure that access controls are configured correctly, again to prevent exploitation.
• Check cloud-based storage vaults to determine if they can be accessed by such actions as compromised credentials or API misuse.
• Periodically test and validate air-gapped backups to ensure they are complete and ready to use.

How air gapping impacts long-term storage resilience

Use of air gapping impacts storage resilience in the following ways:

• Protects data with certainty -- Even if production systems are compromised, air-gapped backups can still ensure business survival.
• Key element in cyber-resilient architectures -- The approach is essential for ensuring cybersecurity, business continuity and zero-trust storage environments.
• Long-term storage security -- Air-gapped long-term storage using tape cartridges reduces the risk of compromise over long retention periods.
• Confidence when recovery is needed -- Recovery teams can be confident that the air-gapped systems and data they use are clean and uninfected, which reduces downtime from a disruptive event.
• Compliance with key regulations is assured -- Air-gapped data can demonstrate compliance with key data protection regulations.

Air-gapped storage, by its very nature, provides a secure, inviolate storage environment for backups.

Paul Kirvan, FBCI, CISA, is an independent consultant and technical writer with more than 35 years of experience in business continuity, disaster recovery, resilience, cybersecurity, GRC, telecom and technical writing.