What is an Air Gap?
Air gaps and offline backups, told as a story about keeping the most precious chest in an island shed with no bridge.
Even the spare chest sits in a room with a road to it.The spare chest was made properly. But it sits beside the road that joins the castle to the town — and thieves and bugs come down that road.
A spare chest on the same road gets locked too.The thief's lock follows the road and snaps onto every chest it can reach. A spare that gets locked too is no spare.
An air gap is an island shed with no bridge. Things get there by boat only, carried by a person.The most precious chest never sits in any room with a road to the town. No road, so no thief and no bug can get there.
The price is inconvenience. A day to fetch it back, and an inspection on every trip.Even a small box carried by boat can hide a bug. So before it lands on the island, it is opened in the windowless empty room.
Even with the castle locked, the island chest is fine.Of the three spare chests, one always lives on the island. Even if the thief locks the whole castle, that is where you start again.
An air gap = keeping the most precious chest on an island with no road at all. Moved by boat only, by a person, and inspected on every trip. Slow, but no thief and no bug can reach it.
A system or backup with no network connection at all. Because ransomware locks connected backups too, an offline or immutable backup is the last line of defense. Removable media like USB drives become the new risk, so everything is scanned on the way across.
When grown-ups say it
- Air gap
- The island with no bridge. A room no road reaches. Physically disconnected.
- Offline backup
- The spare chest on the island. No road to it most of the time. → the spare chest far away
- Immutable backup
- A chest no one can rewrite. Even with a road, nobody can change it until its date. Sometimes used instead of an island.
- Removable media risk
- The small box on the boat. A small box like a USB drive becomes the new road. Inspect it in the empty room every trip.
- 3-2-1 rule
- Three · two · one. Three copies, two places, one far away — best of all if that one is the island.
- Ransomware
- Locks that follow the road. Locks every chest it can reach. → the thief's lock on every chest
- Backup
- The spare chest. A copy kept somewhere else. → the spare chest far away
- Network segregation (OT)
- The cut road to the machine room. Rooms that must never stop, like factory machines, get their road cut or narrowed. → the machines that cannot speak