Air-Gapped Backup, Properly Explained: Why Physical Tape Is Still the Ransomware Backstop

Steel server racks and cabling in a modern data centre
Photo: Pexels

"Air-gapped" has become one of the most overused terms in data protection marketing. Plenty of products now describe themselves as air-gapped when what they actually offer is logical isolation — a backup copy that is still, ultimately, reachable over a network by something with the right credentials. That distinction matters, because modern ransomware groups no longer just encrypt production data. They actively hunt for backup infrastructure first, and delete or corrupt it before the encryption even starts. If your "isolated" copy is still addressable from the network, it isn't truly out of reach.

This is where tape has a genuine, structural advantage that no amount of software cleverness on a disk array can fully replicate.

What "Air-Gapped" Actually Means

A physical padlock securing a door, symbolising a genuine offline barrier
Photo: Pexels

There are two things people mean when they say air-gapped, and they are not the same:

  • Logical (or "virtual") air gap — the backup sits on immutable or write-once storage, often on a separate network segment or with restricted API access. It's a real security improvement over a plain backup share, but the data is still connected to something. If credentials, firmware, or the management plane are compromised, a sufficiently determined attacker can, in principle, reach it.
  • Physical air gap — the medium is removed from any drive or network entirely. There is no cable, no wireless interface, no IP address, no way in. A tape cartridge sitting in a vault, or in transit to one, cannot be encrypted, deleted, or exfiltrated by anything running on your network, because it isn't on it.

Both have a place in a modern backup strategy. But only one of them is immune to an attacker who has already got administrator-level access to your environment — which, in most serious ransomware incidents, is exactly the situation.

Why Tape Still Does This Best

A tape cartridge only exists on the network for as long as it's loaded in a drive and being written to. Once the write completes and it's ejected — whether by an operator or an automated library policy — it becomes inert plastic and oxide. There is no firmware to exploit, no controller to compromise, and no path back onto your network unless someone physically loads it again. That's a fundamentally different security posture from a disk snapshot or object-lock bucket, which remains a live, addressable system for as long as it's powered on.

This isn't a reason to abandon disk-based backup — fast recovery from disk is still what gets most systems back online quickest for routine failures. It's a reason to make sure at least one copy of your critical data sits somewhere a network intrusion simply cannot reach it.

Two Recent UK Cases Worth Studying

Neither of the following organisations has published a full account of their backup architecture, and it would be unfair to claim with certainty what would or wouldn't have changed the outcome. But both incidents are well documented, and both illustrate exactly the failure mode a genuine air gap is designed to prevent.

The British Library, October 2023

The British Library's own published cyber incident review is unusually candid, and worth reading if you manage backup for any organisation. The attackers — the Rhysida ransomware group — didn't just encrypt data. They deliberately destroyed servers to inhibit recovery and cover their tracks. The Library's own report identifies this destruction of infrastructure, rather than the encryption itself, as the most damaging part of the attack, and notes that recovery was hampered by a lack of separate infrastructure to restore onto. Core services took months to return, and the full rebuild is still ongoing years later, with costs running into the millions.

The lesson the wider industry has drawn from this case isn't subtle: when an attacker can reach and destroy the systems your backups depend on, having a copy of the data isn't enough — you also need somewhere physically separate to recover it from.

Jaguar Land Rover, September 2025

JLR's manufacturing systems were taken offline as a precaution after a cyber incident in late August/early September 2025, halting production at its Solihull, Halewood, and Wolverhampton plants for weeks. The disruption rippled through hundreds of suppliers and is estimated to have cost the UK economy close to £2 billion — among the most damaging cyber incidents in British corporate history.

What's notable for backup planning is the commentary that followed from resilience specialists: organisations with immutable, air-gapped backups and well-rehearsed disaster recovery plans are consistently the ones that get back on their feet fastest after an incident of this scale. Recovery speed, not just data retention, is what separates a bad week from a bad year.

The 3-2-1-1 Rule, and Where Tape Fits

The backup industry's answer to modern ransomware is an update to the old 3-2-1 rule:

  • 3 copies of your data
  • on 2 different types of media
  • with 1 copy offsite
  • and 1 copy offline (air-gapped)

That last "1" is where tape earns its keep. It's the cheapest medium per terabyte for a copy you hope you'll never need, it scales to enterprise data volumes far more cheaply than offline disk, and once a cartridge is out of the drive it genuinely cannot be touched by anything happening on your network, however that incident started.

Practical Takeaways

  • Don't assume "immutable" and "air-gapped" mean the same thing — check whether your backup copy is ever reachable from your production network.
  • Make sure at least one backup rotation is genuinely offline, on media that's physically removed and stored separately.
  • Test the restore, not just the backup. An untested tape is a hope, not a plan.
  • Keep your tape drives serviced and your media in good condition — a backup you can't read back is no backup at all.

If it's been a while since your tape drives or library were tested end-to-end, or you're planning an offline backup tier as part of a wider resilience review, get in touch or call us on 0118 957 3131. We service and repair LTO, DLT, AIT and enterprise tape hardware across the UK, with same-day dispatch on replacement drives.