Glossary · Recovery Security
Isolation without slowing recovery
A logical air gap separates backup and recovery storage from production systems through architectural and software-enforced controls. Unlike a physical air gap, the storage does not need to be disconnected from the network. It remains online. It remains available. Production systems cannot directly modify it.
Isolation enforced through architecture. Not through unplugging hardware.
01 The Definition
What does logical air gap mean?
A logical air gap isolates backup or recovery storage from production systems without physically disconnecting the infrastructure. The backup stays online. Production cannot freely reach or change it. That separation may be enforced through:
- No persistent production mounts
- No writable network shares
- Segmented management interfaces
- Restricted administrative access
- Controlled replication channels
- Immutable recovery points
- Independent recovery storage
02 The Origin
Why logical air gaps exist
Traditional air gaps relied on physical separation. Those approaches provide strong isolation, but modern organizations need strong isolation and fast recovery at the same time.
01 Physical separation looks like
- Offline tape
- Removable media
- Disconnected storage devices
- Backups stored outside the network
02 And introduces
- Manual handling
- Slower recovery
- Long restore processes
- More difficult testing
- Greater operational overhead
A logical air gap is designed to support both.
03 Side By Side
Physical vs logical air gap
| Physical Air Gap | Logical Air Gap |
|---|---|
| Storage is disconnected from the network | Storage remains online but isolated |
| Often requires manual reconnection | Access occurs through controlled channels |
| Strong physical separation | Strong architectural separation |
| Can slow recovery | Supports faster activation |
| Harder to automate testing | Easier to validate regularly |
| Often relies on removable media | Often uses protected recovery storage |
Physical air gaps prioritize disconnection. Logical air gaps prioritize controlled isolation without removing recovery infrastructure from service.
04 The Mechanics
How a logical air gap works
Separation is achieved by limiting how the two environments interact. Production systems should not be able to treat backup storage like an ordinary writable drive or network share.
- Repositories not mounted to production
- No persistent write access from workloads
- Segmented management access
- Separate recovery storage
- Controlled communication channels
- Restricted permissions
- Immutable snapshots
The storage remains available for recovery. It is not continuously exposed to production.
05 The Core Principle
One question decides whether you have one
If production is compromised, can the attacker automatically reach and alter the recovery environment?
The goal is to make the answer no.
A production compromise should not automatically become a recovery compromise. That separation matters because modern attacks increasingly target both.
06 The Motive
Why ransomware targets recovery
Ransomware operators know that backups reduce their leverage. If an organization has clean, protected recovery points, it may restore operations without paying. So attackers attempt to:
- Delete backup repositories
- Encrypt backup storage
- Compromise backup credentials
- Corrupt recovery catalogs
- Disable backup software
- Destroy shadow copies
- Reduce retention periods
The objective is not only to encrypt production. It is to eliminate the path back.
07 Under Attack
Logical air gap and ransomware
If backup repositories are continuously mounted or exposed as writable storage, they become secondary victims.
How ransomware spreads
- Compromised credentials
- Domain-level access
- Lateral movement
- Network discovery
- Accessible storage
- Shared administrative accounts
What isolation reduces
- Direct production write access
- Backup storage sitting beside normal workloads
- Open administrative paths
- Routine network exposure
- Compromised production credentials reaching recovery data
The attack may reach production. The recovery environment should remain protected.
08 Two Controls
Logical air gap vs immutability
Related, but not interchangeable. A logical air gap alone does not guarantee a recovery point cannot be changed. Immutability alone does not isolate the backup from production.
Logical air gap
Controls access.
Can production or an attacker reach the recovery storage?
One control protects the path.
Immutability
Controls alteration.
Can the recovery point be changed after it is written?
The other protects the recovery point.
Together they help protect against ransomware, compromised credentials, malicious deletion, administrative misuse, accidental deletion, and backup tampering. The strongest recovery architectures combine both.
09 A Common Shortcut
A logical air gap is not just a firewall
A firewall may be part of the architecture. But a logical air gap is broader than a single network control. It may involve:
- Network segmentation
- Storage isolation
- Authentication separation
- Restricted mounts
- Limited write access
- Role-based permissions
- Immutable snapshots
- Controlled replication
The goal is not merely to block traffic. It is to architect recovery so production does not have unrestricted control over it.
10 The Chain That Breaks
Persistent exposure is the real risk
The biggest risk in traditional backup environments is not sophistication. It is a chain of ordinary decisions.
Recovery storage remains available. It is not treated as an extension of production.
11 Access Control
Logical air gap and zero trust
Logical isolation works best when paired with zero-trust access principles. No user, device, or credential should be trusted automatically.
- Multi-factor authentication
- Role-based access control
- Segmented administrative permissions
- Encrypted management sessions
- Restricted privileges
- Auditable actions
Access should be verified. Privileges should be limited. Recovery should remain protected from both external attackers and compromised internal accounts.
12 The Pairing
Isolation without restore delay
Isolation should not force organizations to choose between security and speed. A physical air gap may require finding the media, transporting it, reconnecting storage, mounting data, beginning a full restore, and waiting for systems to rebuild. A logical air gap keeps recovery infrastructure available and controlled.
That preserves isolation while supporting fast activation, automated testing, remote recovery, cloud recovery, and policy-based recovery workflows.
Protection remains strong. Recovery remains operational.
Boot first. Restore whenever.
13 Isolated Is Not Clean
Logical air gap and Clean Room Recovery
A logically isolated backup can still contain malware that existed before the snapshot was created. Isolation alone does not prove a recovery point is clean.
The logical air gap protects the recovery data. The Clean Room validates whether it is safe to use.
14 Everywhere It Lives
Isolation across the recovery architecture
The second copy should not simply exist. It should remain isolated and protected. The infrastructure stays connected. The recovery path stays isolated.
High Availability
Local recovery points stay separated from the production systems they protect, supporting fast local activation, reduced production exposure, protected recovery storage, ransomware resilience, and regular testing. Local recovery does not have to mean exposed recovery storage.
Disaster Recovery
The remote environment maintains the same isolation principles: encrypted replication, controlled communication channels, immutable remote snapshots, restricted administrative access, separate recovery storage, no persistent production write access.
Quorum Cloud
Isolated virtual networks, dedicated firewall instances, tenant separation, separate storage environments, encrypted replication tunnels, role-based access restrictions, zero-trust authentication. Individual firewall isolation per customer separates recovery environments.
15 The Second Copy
Logical air gap and replication
Replication extends protection geographically, but it must be designed carefully. If corruption or encrypted data is copied immediately to another location without protected recovery points, the second copy inherits the problem.
- Protected snapshots
- Controlled replication channels
- Encryption
- Authentication validation
- Retention of historical recovery points
- Recovery testing
Replication extends resilience. Isolation protects the destination.
16 Scope
What a logical air gap does not do
Its role is specific. It helps prevent production compromise from automatically becoming recovery compromise. It does not:
- Prevent ransomware infection
- Stop phishing
- Replace endpoint protection
- Replace MFA
- Guarantee a clean recovery point
- Eliminate downtime
- Replace recovery testing
- Replace Disaster Recovery
Compliance and when isolation is essential
Logical air gaps support organizations facing cyber insurance requirements, regulatory recovery obligations, healthcare data protection requirements, PCI-related environments, business continuity mandates, and ransomware resilience expectations. Prioritize isolation when:
- Backup storage remains online
- Ransomware risk is significant
- Fast recovery is required
- Physical disconnection is impractical
- Administrative credential compromise is possible
- Recovery points must remain protected from production
- Cyber insurance requires stronger controls
- Critical systems cannot tolerate extended restore time
The more important recovery speed becomes, the more valuable logical isolation becomes.
17 The Platform
How Quorum uses logical air gap
Quorum separates protected snapshots from normal production access, then surrounds that isolation with the rest of the recovery-security architecture. No single control protects recovery by itself.
- Snapshots not persistently mounted to production
- No ordinary writable recovery shares
- Controlled access to protected data
- Segmented recovery infrastructure
- Immutable recovery points
- Encryption in transit and at rest
- Role-based access control
- Zero-trust authentication
- Secure replication
- Instant activation
- Automated recovery testing
- Clean Room validation
The logical air gap reduces exposure. The rest of the architecture preserves integrity, access control, validation, and recovery speed.
18 Assumptions Worth Testing
Common misconceptions
“Logical air gap means the storage is offline.”
A logical air gap keeps storage online but controls how production can access it. The key is isolation, not physical disconnection.
“A firewall alone creates a logical air gap.”
A true logical air gap may involve network controls, storage architecture, authentication, permissions, immutability, and controlled access. It is an architectural strategy, not one product setting.
“Logical air gap and immutability are the same.”
Logical air gap limits access. Immutability prevents alteration. Both are stronger together.
“A logically air-gapped backup is automatically clean.”
Malware may already have existed when the snapshot was created. Clean Room validation may still be required.
“Logical air gap eliminates the need for Disaster Recovery.”
Logical air gap protects recovery storage. Disaster Recovery provides a second location and an operational recovery path if the primary site becomes unavailable. They solve different problems.
19 Put It Into Practice
Logical air gap checklist
A logical air gap is only effective when the architecture around it is designed for real recovery.
- Can production systems directly write to backup storage?
- Are recovery repositories persistently mounted?
- Is backup storage exposed as a writable network share?
- Are administrative roles segmented?
- Is MFA enforced?
- Are recovery points immutable?
- Is replication encrypted and controlled?
- Can systems activate without a full restore?
- Can recovery be tested safely?
- Is Clean Room validation available?
- Are remote recovery copies isolated too?
- Are cloud recovery environments separated by customer?
- Has ransomware recovery actually been tested?
The Path Back Stays Separate.
Isolation without disconnection. Protection without waiting.
Organizations need recovery points protected from ransomware, compromised credentials, and production failure. They also need to recover quickly. Quorum combines logical air gap architecture with immutable snapshots, encryption, zero-trust access, Instant Recovery, Clean Room validation, and secure replication.
Right onQ. Off Was Never an Option.
Eliminate Downtime from Recovery
Eliminate Downtime from Recovery
Boot systems directly from snapshots and keep operations running without restore delays.