What Is a Logical Air Gap?

A logical air gap is a backup copy kept logically unreachable from the production and identity environment that created it — isolated by network, credentials and control plane rather than by physically disconnected media. The copy stays online and quickly recoverable, yet a compromise of production systems cannot extend to it.

The distinction that matters most is this: an air gap is about reachability, not mutability. It answers a different question from immutability, and the two are separate controls solving different problems. What follows explains where the line sits, and why serious backup designs use both.

Logical vs. physical air gap

Both approaches share one goal — a backup copy that a compromised production environment cannot touch — but they achieve it very differently.

• Physical air gap. The copy lives on media physically disconnected from any network: traditional offline tape, or removable disk taken out of the drive. Nothing can reach it because there is no connection to traverse.
• Logical air gap. The copy stays online, but network reachability, identity and the control plane are separated, so reaching it means crossing boundaries an attacker in production does not control. Isolation is enforced by architecture rather than by an unplugged cable.

The trade-off is recovery speed against absolute disconnection. Tape offers the strongest possible isolation but slow, manual restores; a logical air gap keeps restores fast and automatable while accepting that isolation is enforced by controls rather than physics. For most organizations facing ransomware rather than nation-state actors, a well-built logical air gap is the practical balance.

What makes a gap "logical"

"Online but isolated" only counts as an air gap if the isolation holds across every dimension an attacker would use. A copy on the same network segment, behind the same credentials, is not air-gapped — it is just another target. The separations that actually matter are:

• Network reachability. The backup storage sits on a segmented network with restricted routing and tightly scoped access, not on the flat production LAN.
• Credentials and identity. No shared directory or single sign-on between production and the backup system. A compromised domain admin should not also be a storage admin.
• Control plane and management. The interfaces that manage the storage are not reachable from production, so retention and deletion settings cannot be changed from a breached host.
• Fault domain. A failure — or an attack — in production does not cascade into the backup environment.
• Operational ownership. Separate administrative roles and processes, so a single compromised account cannot unwind the whole design.

Individually these reduce risk. Combined, they create a practical gap: an attacker who owns production still cannot reach, alter or delete the protected copy.

Air gap vs. immutability — why you need both

This is the distinction that trips people up, because both are sold as "ransomware protection" and sound interchangeable. They are not.

• Immutability answers can this data be changed? It prevents a stored object from being modified or deleted for a defined period.
• An air gap answers can this data be reached at all? It prevents a compromised system from getting to the storage in the first place.

Why both? An attacker who reaches your backup platform with valid administrative credentials can attack it even when individual objects are locked — by altering retention policy before a lock takes effect, deleting buckets, or targeting the platform itself. Immutability reduces mutability; isolation reduces reachability. Each closes a gap the other leaves open.

In practice they are layered. Object-level immutability such as S3 Object Lock — the mechanism that enforces WORM retention — ensures that data which is reached still cannot be changed, while a logical air gap ensures a compromised admin domain cannot trivially reach it to bypass those controls. A repository that is immutable but not isolated, or isolated but not immutable, has a weaker link than it appears.

Where a logical air gap fits: the 3-2-1-1-0 rule

The familiar 3-2-1 backup rule — three copies, on two types of media, with one offsite — predates modern ransomware. The updated 3-2-1-1-0 formulation adds the two controls ransomware made non-negotiable:

• 3 — keep at least three copies of the data (the original plus two backups).
• 2 — store them on two different media or storage types.
• 1 — keep at least one copy offsite.
• 1 — keep at least one copy offline, air-gapped, or immutable.
• 0 — verify recoveries so there are zero errors: test that the copies actually restore.

The extra "1" is where a logical air gap lives, and the strongest designs make that copy both air-gapped and immutable rather than treating them as alternatives. The "0" is the reminder that an isolated, immutable copy you have never test-restored is an assumption, not a backup.

Logical air gap and ARTESCA

Scality ARTESCA is object storage you deploy on your own standard servers, and its CORE5 cyber-resilience design assembles a logical air gap from several of the separations above rather than from a single feature.

• Credential and identity separation. Backup and storage systems use isolated credentials, so a compromise of the backup application's domain does not hand an attacker the storage layer.
• Zero-trust admin controls. No user, application or system is trusted by default; administrative access requires MFA and follows least-privilege boundaries.
• Hardened platform. The integrated OS is hardened with no root access, reducing the surface a compromised host could use to reach the control plane.
• Immutability at the object level. S3 Object Lock in both governance and compliance modes, plus legal hold, keeps reached data unchangeable — the immutability half of the pairing above.
• Geographic separation. Multi-site and offsite copies extend isolation across locations, so a single site event does not take the protected copy with it.

The result is a copy that stays online and quickly recoverable while remaining unreachable from a compromised production and identity environment — a logical air gap combined with immutability, which is the combination the 3-2-1-1-0 rule is really asking for.

Logical air gap FAQs

Is a logical air gap as safe as tape?

For most threat models, yes — with a trade-off. A physical air gap on offline tape offers the strongest possible isolation because there is no connection to attack, but restores are slow and manual. A well-built logical air gap keeps restores fast while enforcing isolation through network, identity and control-plane separation. Tape can still make sense for a deepest-vault copy; for operational recovery, logical isolation is usually the better balance.

Does immutability alone give me an air gap?

No. Immutability stops data that is reached from being changed; an air gap stops the data from being reached. An immutable repository that shares credentials and network with production can still be attacked at the platform level. The two are complementary controls, not substitutes.

Does a second cloud region count as a logical air gap?

Only if it is genuinely separated. A second region under the same account, identity provider and management plane shares a blast radius with the first — a compromised control plane can reach both. It becomes an air gap when identity, control and access are isolated, not merely when the data sits somewhere geographically different.

What breaks a logical air gap?

The common failures are a shared directory or SSO between production and backup, backup servers joined to production Active Directory, management interfaces reachable from the production network, and overly broad access policies. Each reintroduces a path from a compromised production environment to the protected copy.

Do I still need immutability if I have a logical air gap?

Yes. Isolation lowers the chance the copy is reached, but if it ever is — through a misconfiguration or an insider — immutability keeps the data itself intact. The 3-2-1-1-0 rule points at both for that reason.