Immutable vs air-gapped backups, and how long to keep them
Key takeaways
- An immutable backup is stored write once, read many (WORM): it cannot be modified or deleted until its retention period expires
- An air gap means no physical connection and no automated logical connection: data only crosses under human control
- The NCSC has seen ransomware encrypt connected USB drives, network storage and cloud storage holding backups, and says to keep at least one backup offline
- Cloud backups can be made offline in effect: no valid credentials on backup clients between runs, and storage that refuses connections while not in use
- There is no single right retention period: the NCSC says to set time-based retention policies in advance, for example daily backups for a month and monthly backups for a year
Immutable and air-gapped backups solve the same problem in different ways. Ransomware attacks can target backups, and the NCSC says attackers have sometimes destroyed copies before attacking. An immutable backup survives because it cannot be changed or deleted. An air-gapped backup survives because the attacker cannot reach it at all. The NCSC's guidance stresses keeping at least one backup offline and setting retention policies in advance.
Why backups need protecting from ransomware
The NCSC says it has seen numerous incidents where ransomware encrypted not only the original data but also the connected USB and network storage drives holding backups, and others where connected cloud storage containing backups was compromised. It also says there have been cases where attackers destroyed copied files or disrupted recovery processes before conducting ransomware attacks.
That is why the NCSC says it is essential to always have a recent offline backup of your most important files and data, and calls up-to-date backups the most effective way of recovering from a ransomware attack.
What is an immutable backup?
Immutable storage keeps data in a write once, read many (WORM) state. Microsoft's documentation for Azure Blob Storage says that while data is in a WORM state it cannot be modified or deleted for a user-specified interval. AWS describes S3 Object Lock the same way: it can help prevent objects from being deleted or overwritten for a fixed or variable amount of time, or indefinitely.
S3 Object Lock offers retention periods and legal holds; Azure offers time-based retention policies and legal holds:
- A retention period. The data is locked until a set date. After that it can be deleted.
- A legal hold. The data is locked with no end date until someone with permission removes the hold.
How strict the lock is depends on the mode. In S3 Object Lock compliance mode, AWS says a protected object version cannot be overwritten or deleted by any user, including the root user, and its retention period cannot be shortened. In governance mode, users with a special permission can still alter the settings or delete the object. On Azure, a locked time-based retention policy cannot be deleted and its period can be extended but not decreased.
In our view, governance-style modes are useful for testing, but an attacker who steals an account with the override permission can undo them, so they should not be your only protection.
What is an air-gapped backup?
NIST's glossary, citing CNSSI 4009-2022, which draws on IETF RFC 4949, defines an air gap as an interface between two systems where they are not connected physically and any logical connection is not automated, meaning data is transferred only manually, under human control.
The NCSC uses the terms offline or cold backup: a backup whose purpose is to remain unaffected if an incident hits your live environment. With at least one backup offline at any given time, it says, an incident cannot affect all of your backups at once. A disconnected drive or tape kept away from the network fits this description.
Immutable vs air-gapped: the differences
| Immutable backup | Air-gapped backup | |
|---|---|---|
| Connected to your network? | Yes, it can be reached | No physical or automated connection |
| How it survives ransomware | Refuses changes and deletions until its retention date | The attacker cannot reach it |
| Main weakness | An attacker with admin rights may change settings, delete accounts or delete encryption keys, unless those are protected too | Data only moves across the gap under human control, so it depends on people following the routine |
| Typical form | Cloud or on-premises storage with WORM locks | Disconnected drives or tape, or cloud storage that refuses connections between backups |
The NCSC's cloud principles set out other ways an attacker can defeat backups even if data cannot be deleted. An attacker who cannot delete data may instead disable or delete every account that can reach it, flood the store with corrupted backups, or delete the encryption key so the data cannot be decrypted.
Can a cloud backup count as offline?
Yes, with the right controls, which the NCSC says can apply the same level of protection. The NCSC says cloud storage guarantees physical separation from your live environment, but when not in use it also needs to be digitally disconnected, and unlike conventional backup storage you cannot take it offline by simply unplugging it. Its advice is:
- Protect the accounts. Everyone who can reach cloud backups should be protected in line with NCSC password and multi-factor authentication guidance.
- Keep credentials off backup clients between runs. Cloud backup clients should not hold valid credentials while the storage is not in use, keep their number to a minimum, and stop standard user devices from modifying backups directly.
- Refuse connections while cold. Where the service allows, only let authorised clients create or append backups, and deny connection requests while the storage is not in use. The NCSC says that if ransomware strikes while the storage is refusing connections, this gives the same confidence as unplugging an on-premises drive. If it strikes while the storage is connected, ransomware able only to create new data cannot overwrite existing backups, which the NCSC compares to write-once storage.
- Have a backup plan for your backups. Choose a service that can restore older versions and recover deleted data for a limited time.
The NCSC also says to protect backup accounts with multi-factor authentication, with the MFA method not installed on the same device used to administer backups, and ideally to use privileged access workstations and firewalls enforcing IP allow listing.
Which should you use?
The NCSC's blog notes that the 3-2-1 rule, three copies on two devices with one offsite, does not require any backup to be offline, which is why it adds the offline rule on top. In our view, most organisations should keep at least one immutable copy and at least one offline copy as the last line of defence. Our 3-2-1 backup rule guide covers how to lay out the copies.
How long should you keep backups?
There is no single right number. The NCSC says backup data cannot be stored forever, so system owners should set policies in advance that specify how long a backup is kept. Those policies should align with the backup schedule and may differ for different types of data.
Its other retention advice is specific:
- Retain by time, not by count. Retention based on time rather than a fixed number of backups stops an attacker overwriting the store with a series of corrupted backups in quick succession.
- Keep more than one tier. The NCSC's example is keeping daily backups for a month and monthly backups for a year, set according to your risk appetite.
- Keep versions you can choose from, so you can restore from the version you pick.
- Use soft delete with a review period. Deleted backups should stay recoverable for a pre-agreed period that depends on how often you monitor, because an attacker who soft-deletes everything wins if nobody notices before that period ends.
Personal data adds a second limit. Article 5 of the UK GDPR says personal data must be kept in a form which permits identification for no longer than is necessary for the purposes it is processed for. Our guide to UK GDPR and backups covers retention schedules and what to do with erasure requests when backups are locked.
Protect the keys and watch for tampering
The NCSC says that if backups are encrypted, the encryption keys must be protected too, and suggests options such as committing a master key to paper as text or a QR code and keeping it somewhere secure, such as a safe.
It also says a backup service should raise alerts on significant changes, such as mass deletion requests, backups stopping, changes to global retention periods or encryption policies, or changes to administrator details, whether or not the attempt succeeds. Alerts should be delivered in a way that still works if your own systems are compromised, and only help if someone acts on them. Exceptional destructive requests should be authorised out of band, for example through a separate account or a pre-shared passphrase confirmed by phone.
Finally, test your backups. The NCSC says they should be regularly tested to check they work as expected. Our guide to how often to test disaster recovery plans covers testing, and if ransomware does get in, our guide to whether to pay a ransomware demand explains the UK position.
Frequently asked questions
What is the difference between immutable and air-gapped backups?
An immutable backup can be reached over the network but cannot be modified or deleted until its retention period ends. An air-gapped backup has no physical connection and no automated logical connection to your systems, so data only moves under human control.
Is an immutable backup the same as an offline backup?
No. Immutable storage stays connected but refuses changes and deletions. The NCSC describes an offline or cold backup as one that is disconnected when not in use, so an incident in your live environment cannot reach it.
Can ransomware delete backups?
It can. The NCSC has seen ransomware encrypt connected USB and network storage drives holding backups, and compromise connected cloud storage. It says attackers have destroyed copies or disrupted recovery processes before launching ransomware.
How long should backups be kept?
There is no single right period. The NCSC says to set retention policies in advance that align with your backup schedule and risk appetite, may differ by type of data, and are based on time rather than a fixed number of backups. Its example is daily backups for a month and monthly backups for a year.
Can an immutable backup be deleted early?
It depends on the mode. With AWS S3 Object Lock in compliance mode, no user can delete a locked object version before its retention date, including the root user; governance mode lets specially permitted users override it. A locked Azure time-based retention policy can be extended but not shortened.
