Immutable vs. Air-Gapped Backup: What's the Difference?

Ransomware operators learned years ago that encrypting production isn't enough if the victim can simply restore. So they go after the backups first. Two techniques keep a copy out of their reach, and they're often mentioned in the same breath. They aren't the same thing.

Immutable: the copy can't be changed

An immutable backup can't be altered or deleted until its retention period ends, even by an administrator. Ransomware may be able to reach it, but can't encrypt or erase it.

In the cloud, a common way to do this is S3 Object Lock, which stores objects in write-once-read-many (WORM) form for a set retention period. The retention period matters: it's how long the copy is locked, so it has to be long enough to cover the time an attacker might sit unnoticed in your environment.

Air-gapped: the copy can't be reached

An air-gapped backup is isolated from your production network. The gap can be:

• Logical: separate accounts, credentials and access paths, so nothing in production can reach the copy.
• Physical: media that is simply disconnected, like tape that has been ejected and stored on a shelf.

An attacker who owns your environment, administrator accounts included, still can't touch it.

Why you want both

They fail in different ways. An immutable copy reachable from a compromised network can still be read, and the system holding it can still be attacked. An air-gapped copy that isn't immutable is only as safe as the isolation around it. Together, the copy can't be reached easily and can't be changed if it is.

That's why the 3-2-1-1-0 rule asks for one copy that is "immutable or air-gapped," and why many organizations aim for both.

Who holds the keys?

One more question is worth asking of any backup provider: who controls the encryption keys? DAR Assured Recovery is built on the principle that you should, not your vendor. KELYN deploys hardened media agents directly in your own AWS environment, with S3 Object Lock immutability and keys only you hold. Your data never leaves your infrastructure.

For a fully offline copy, Spectra Logic tape adds a physical air gap.

New to the terms? The glossary defines immutable backup, air gap, retention period and the rest in plain language.