Table of contents
What is a logical air gap?
A logical air gap is the isolation of backup storage from production through separate networks, identities and management interfaces, rather than physical disconnection. The data stays online for fast recovery, but no production login, network path or console can reach it, and it holds only while nothing is shared between the two sides.
How does it differ from a physical air gap?
A physical air gap disconnects the media from every network, as with tape cartridges ejected and stored off site. Nothing can reach them over a network, but recovery takes hours or days of retrieval and sequential reading. A logical air gap leaves the storage connected and controls which systems, accounts and requests can reach it.
| Property | Physical air gap (offline tape) | Logical air gap |
|---|---|---|
| Reachable by network attack | No, once ejected | Only through a shared credential or path |
| Recovery speed | Hours to days | Network speed, comparable to online storage |
| Weakest point | Physical handling and custody | Shared identity or management |
| Testing | Costly, so often rare | Cheap, so can be frequent |
Which layers form the gap?
- Network segmentation: production subnets have no route to the backup zone apart from the defined data path from the backup server.
- Non-routable management interfaces: storage consoles and administration endpoints sit on a separate management network that production cannot route to, so access gained in production cannot reach the controls that change retention or delete data.
- API isolation: the credentials backup software uses can write data but cannot delete buckets, change locks or create users. Those administrative requests need separate credentials and are accepted only from the management network.
- Separate identities: backup administration uses its own identity provider and multi-factor sign-in, so production directory accounts do not work there.
- Separate ownership: no single team, vendor access path or fault reaches both sides.
Where does the gap usually break?
The common failure is a shared credential. If the backup console signs users in against the production directory, a domain administrator account stolen in production also signs in to the backup side, whatever the network segmentation. Post-incident reviews often find segmented infrastructure with shared administration. Credential theft targets exactly these accounts, and the administrative blast radius of such an account measures how much of the gap it removes.
Isolation and immutability as separate controls
The gap stops attackers reaching the data. A lock stops them changing it if they do reach it. An isolated copy that can be altered is protected only while the gap holds, and a locked copy that can be reached can still be read. An immutable backup on isolated infrastructure combines both, which is the isolated copy in the 3-2-1-1-0 backup rule. Safe copy isolation sets out the same layers around a trusted copy, and zero trust security applies the principle that network position grants no trust.
Frequently asked questions
Is a logical air gap really air-gapped?
Not literally. There is no physical break, so protection depends on the independence of network, identity and administration, which can be checked and tested.
Can ransomware cross a logical air gap?
Only through something shared, such as a credential, a management tool or a trusted network path. Removing the shared pieces removes the route.
Does a logical air gap replace offline copies?
Some designs keep both. The logical gap serves fast recovery, and an offline copy covers a failure that compromises everything online.
Related terms
- Safe copy isolation: the layers that protect a trusted copy.
- Immutable backup: the lock that covers changes, not reach.
- Credential theft: how one login collapses a gap.
- Zero trust security: no trust based on network position.
- 3-2-1-1-0 backup rule: where the isolated copy sits.