Air Gapped Storage
You set up air gapped storage by cutting all external network paths to your backup servers. This setup keeps critical files safe from outside attacks and ransomware. Teams often build an isolated zone and copy snapshots across a controlled link. Still, admins still need a way to check backups and run restores. Broad admin roles in that zone can put the isolated data at risk. How air gapped storage works in practice A true physical gap removes all network cables from the storage array. Operato
Gapped Storage: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up air gapped storage by cutting all external network paths to your backup servers. This setup keeps critical files safe from outside attacks and ransomware. Teams often build an isolated zone and copy snapshots across a controlled link. Still, admins still need a way to check backups and run restores. Broad admin roles in that zone can put the isolated data at risk.
How air gapped storage works in practice
A true physical gap removes all network cables from the storage array. Operators move data by carrying tapes or hard drives into a locked room. Many teams now use a logical gap inside their data center or cloud account. In this design, firewall rules block all incoming traffic from standard networks. The storage system sits in a separate account with its own identity provider.
Instead of pushing files into the vault, the vault pulls data on a schedule. It opens a short outgoing link, grabs the backup, and closes the path. Audit storage rules lock the saved files for a set number of days. During this lock window, no user can delete or change the backup blocks.
To check the health of these backups, engineers log in through a dedicated console. The storage platform checks their identity and assigns a built-in role. That role tells the system which buckets or volumes the user can read. Once the role check passes, the user gets an active session on the system.
Where native network isolation falls short
Network isolation stops automated worms from spreading across your main servers. Immutable retention locks also stop attackers from wiping out old backup snapshots. These two controls protect your recovery point when your primary network falls.
Yet the storage system still needs maintenance, restore tests, and hardware updates. During a recovery drill, an engineer logs in with high permissions to mount volumes. Native storage roles decide who can log in and which buckets they can touch. They do not inspect what individual commands or queries do inside that active session.
Gapped Storage: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Once a session starts, an engineer can read live customer records from the mounted backup. If a backup contains databases, a single broad query can pull thousands of rows. Native logs might record that a volume was mounted or a file was read. They do not show the exact records returned during the restore check.
Managing human sessions during backup checks
Testing a backup means reading real production data inside a staging zone. That data often holds sensitive fields like emails, phone numbers, and card numbers. If teams share one admin account for emergency restores, audit logs lose individual tracking. You cannot tell which team member ran a specific delete or export command.
Teams also struggle with long-lived keys stored on management hosts inside the vault. If an attacker compromises an admin laptop during a maintenance window, those keys are exposed. Strong operations require tying every single command to a verified human identity. You also need controls that rewrite sensitive fields like national IDs in query results. This approach lets engineers verify backup structure while keeping private records safe.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the difference between physical and logical air gaps?
A physical gap uses offline media like tapes with no network hardware attached. A logical gap uses strict network rules and separate accounts to block outside traffic.
Can ransomware still hit isolated backup systems?
Ransomware cannot cross an offline gap on its own. Still, an attacker who steals admin credentials can target logical vaults during maintenance windows.
How do teams test restores without exposing private data?
Teams mount the backup in a closed test zone and run automated checks. Using field masking during manual checks rewrites card numbers and emails in query results.