Air Gap

An air gap is the physical or logical isolation of a system from untrusted networks — most strictly, a machine with no network connection at all, reachable only by someone physically present. The term survives in modern security mainly through air-gapped backups: copies of critical data kept offline, disconnected, or on immutable storage, so that an attacker who owns the entire production network still cannot encrypt or delete them.

How it works

The protection is topological: malware cannot traverse a connection that does not exist. Classic air-gapped environments — industrial control systems, certificate authorities, classified networks — accept severe inconvenience in exchange for that guarantee. For backups, the practical implementations are rotated offline media, storage that is only connected during backup windows, or cloud object storage with immutability locks and separate credentials that production-domain admins cannot touch. The distinction matters because ransomware operators hunt backups deliberately: before detonating, they spend days inside the network deleting shadow copies, wiping backup servers, and revoking recovery tools, precisely so the victim's only path back is payment. A backup reachable with the same credentials the attacker already holds is not a recovery plan; it is a target.

An air gap is not absolute. Anything that crosses it — USB media, laptops, vendor updates — is a bridge, which is why USB drop attacks and infected removable media remain the standard way isolated systems get compromised, and why the human handling the crossing is part of the control.

How to defend with it

Keep at least one backup copy offline, immutable, or otherwise unreachable from the production domain, with separate credentials and MFA; test restores on a schedule, because an unverified backup is a hope. Treat everything that crosses an air gap as untrusted and scan it on arrival. And remember what isolation cannot do: double extortion means stolen data is a separate threat that no backup addresses, so the entry points — overwhelmingly human, as the data in our analysis of how ransomware starts shows — still need to hold.