Home  ›  Glossary  ›  Safe Copy Isolation

What is safe copy isolation?

Safe copy isolation is the practice of separating at least one backup copy from production networks, identities and administration, using network segmentation, separate credentials and air gaps, so that a compromise of production cannot reach it. It controls who can reach the copy, while immutable storage controls whether the copy can be changed.

Which separations make a copy isolated?

Isolation is built in four layers, and each closes a different route to the copy:

  • Network segregation. Firewall rules and access control lists allow only the backup traffic the copy needs, from a short list of source addresses, with no route from user or production networks.
  • Identity separation. The copy has its own accounts and credentials, with no shared single sign-on and no trust relationship with the production directory.
  • Control plane separation. The consoles that set retention and delete data sit on a separate administrative path.
  • Fault domain separation. Power, hardware and software updates are independent, so one failure cannot take out production and the copy together.

Why is identity separation often missing?

Network separation is visible on a diagram and easy to review, so it is often done first and treated as complete. A copy on a separate network that still accepts production single sign-on is reachable with any stolen production login, because the firewall permits the traffic and the copy accepts the credential. This is the administrative blast radius problem: how much one account can reach. The test is direct. If the credentials that run production can sign in to the backup console or the storage, the copy is not isolated. It is also why credential theft is the usual route to backups.

How do air gaps isolate a copy?

An air gap removes any working path between production and the copy. A physical air gap does this by disconnection, as with tape taken out of the library, and recovery waits on retrieving and loading the media. A logical air gap keeps the copy online but unreachable from production systems and identities, so restores can start quickly. In the 3-2-1-1-0 backup rule, the isolated or immutable copy is the extra 1 added to three copies, two media and one off-site.

How does isolation relate to immutable storage?

Isolation controls who can reach the copy. An immutable target controls whether a copy that can be reached can be changed or deleted before its retention date. An isolated but mutable copy is safe only while the isolation holds, so one wrong firewall rule or account removes the protection. An immutable but reachable copy cannot be deleted, but it can still be read and copied out, which matters for data theft and double extortion. A design that combines both requires an attacker to defeat two separate controls.

Isolation also drifts as accounts and rules change. Regular restore testing shows the copy is usable, and a review of which accounts reach each layer shows whether the separation still exists.

Frequently asked questions

Does an isolated copy need to be offline?

No. A copy can stay online for fast restores while unreachable from production, if its network, identity and administration are separate.

Does multi-factor authentication make a shared login safe?

It raises the cost of theft but does not isolate the copy. A shared directory still means one compromised identity system affects both sides.

Can the safe copy be in the same data center?

It can if the fault domains are separate: independent power, network and administration. Many designs also place it at a different site.