--- title: "Air-Gapped Backups: What are they and how are they implemented?" description: Why are air-gapped backups required? Cyber insurance providers have begun requiring air-gapped backups due to a significant rise in ransomware attacks. image: https://vigilnetworks.com/hubfs/BPbanner-Air-Gapped-Backups.png --- [![VN_Logo-Lighthouse-132x58](https://vigilnetworks.com/hubfs/VN_Logo-Lighthouse-132x58.png)](https://vigilnetworks.com) - [SERVICES](https://vigilnetworks.com/solutions) - [VxFILTER](https://vigilnetworks.com/solutions/vxfilter) - [VxSIEM](https://vigilnetworks.com/solutions/vxsiem) - [VxWIFI](https://vigilnetworks.com/solutions/vxwifi) - [BLOG](https://vigilnetworks.com/blog) - [ABOUT US](https://vigilnetworks.com/about-us) - [CONTACT US](https://vigilnetworks.com/contact-us) [(919) 244-4375](tel:9192444375) Data Backup & Disaster Recovery # Air-Gapped Backups: What are they and how are they implemented? Why are air-gapped backups required? Cyber insurance providers have begun requiring air-gapped backups due to a significant rise in ransomware attacks. [Randy Schultz](https://vigilnetworks.com/blog/author/randy-schultz) Mar 6, 2025 --- According to SonicWALL researchers, ransomware attacks more than doubled from 2021 to 2022. As a result of this increase, many organizations found that their cyber insurance providers now required they implement air-gapped backups to protect their critical data. In this post we will look at air-gapped backups by answering the question…*What are they and how are they implemented?* What are they? Air-gapped backups are backups that are kept perpetually isolated from the network that produced them. How are they implemented? When looking at how to implement air-gapped backups, the expression that *“there’s more than one way to skin a cat”* applies. Rather than enumerate all the ways to do so - some of which are complex, others costly - we will outline one that is both simple and cost effective while arguably being equal-to or better than the alternatives. We will start with a sample backup architecture that is not air-gapped… ![Fig1-NonAirGappedBackup](https://vigilnetworks.com/hs-fs/hubfs/Fig1-NonAirGappedBackup.png?width=1272&height=630&name=Fig1-NonAirGappedBackup.png) *Figure 1. Non Air-Gapped Backup Architecture* As can be seen in the diagram above, this backup architecture consists of an onsite and offsite location. Each location is protected by a firewall which also provides VPN connectivity between them. In such an architecture, the onsite backup can be copied to the offsite location thereby achieving best practice of keeping “1” copy offsite (i.e. a 3-2-1 backup strategy). By using straightforward network design and intelligent power distribution units, the backup architecture outlined above can be converted to one that is air-gapped… ![Fig2-AirGappedBackup](https://vigilnetworks.com/hs-fs/hubfs/Fig2-AirGappedBackup.png?width=1272&height=660&name=Fig2-AirGappedBackup.png) *Figure 2. Air-Gapped Backup Architecture* *Make & models are noted above for reference purposes only and can be changed or substituted as needed* The changes made to do so follow: - A network segment (X6<>X2) was added to the onsite firewall to isolate connectivity between the backup devices from the primary onsite LAN (X5<>X1) - Unmanaged (e.g. 5-port) switches were inserted on each link between the firewall and their respective backup devices - Intelligent power distribution units were added to provide power to the unmanaged switches With these changes in place the following state machine can be implemented to keep the backup devices perpetually isolated from the primary onsite LAN: 1. Default state. In this state normal backup activity takes place on the primary LAN. 2. Backup state. This is a scheduled state in which the backup devices are isolated from the primary onsite LAN and data can be copied from the onsite to the offsite backup device. 3. Return to Default state. That’s it! A design that relies on scheduled power distribution to enforce network isolation. Simple while being equal-to or better than any alternative. Next Steps If you have questions or would like like to discuss a requirement you’re facing today, feel free to contact us by calling [919-244-4375](tel:9192444375) or sending an email to [sales@vigilnetworks.com](mailto:sales@vigilnetworks.com).   [Data Backup & Disaster Recovery](https://vigilnetworks.com/blog/tag/data-backup-disaster-recovery) [Compliance](https://vigilnetworks.com/blog/tag/compliance) ## Similar posts Data Backup & Disaster Recovery ### [Introducing THE LIGHTKEEPER](https://vigilnetworks.com/blog/introducing-the-lightkeeper) The Lightkeeper blog warns local governments of the dangers to their network & data and leads them to safety by presenting solutions that will... Randy Schultz Sep 12, 2022 Email Security ### [Email Security: See why it's COOL again!](https://vigilnetworks.com/blog/email-security-see-why-its-cool-again) Why is Email Security COOL again? With over 90% of data breaches starting with a phishing attack, it's critical to know how to catch a phish! Randy Schultz Jul 19, 2023 Management & Monitoring ### [Security Assessment: What is it and why do I need it?](https://vigilnetworks.com/blog/security-assessment-what-is-it-and-why-do-i-need-it) Why do we need Security Assessments? We need them to gain a picture of our defense, to identify gaps in that defense and opportunities to improve it. Randy Schultz Sep 19, 2022 ### Stay up to date on cybersecurity Subscribe to The Lightkeeper to stay up to date on cyber threats facing local government and the solutions to defend against them. ## **CONTACT** **Vigil Networks, Inc.** 6400 Blalock Forest Dr Willow Spring, NC 27592 **Phone:** [(919) 244-4375](tel:9192444375) **Email:** [info@vigilnetworks.com](mailto:info@vigilnetworks.com) © 2023 Vigil Networks, Inc. All rights reserved Privacy Policy [Powered by Atlas - a B2B SaaS HubSpot theme](https://www.kalungi.com/atlas-hubspot-theme-for-b2b-saas-software) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Randy Schultz", "url" : "https://vigilnetworks.com/blog/author/randy-schultz" }, "dateModified" : "2025-03-06T22:33:47.983Z", "datePublished" : "2025-03-06T22:33:10.000Z", "headline" : "Air-Gapped Backups: What are they and how are they implemented?", "image" : [ "https://vigilnetworks.com/hubfs/BPbanner-Air-Gapped-Backups.png" ], "mainEntityOfPage" : { "@id" : "https://vigilnetworks.com/blog/security-assessment-what-is-it-and-why-do-i-need-it-0", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://api.hubapi.com/avatars/v1/signed-uris/1ClgKFQgEEhF2aWdpbG5ldHdvcmtzLmNvbRjriJfuBSCh2QYqJ2JyYW5kaW5nOmFwaTp3ZWI6dXNlci10cmFmZmljOnVzLWVhc3QtMTIMNzEuNzAuMjE2LjU1EhkAew3HZIc0wR_C5LbvgQ0u5P2isKcEnO_3" }, "name" : "Vigil Networks, Inc." } } ```