← All Tutorials

3-2-1 Backup, Air-Gap and immutable backups against ransomware

October 13, 2026

---

For Those in a Hurry

Protecting data against ransomware and unexpected incidents requires more than simply creating backups. An effective strategy combines copies stored across different destinations, isolated storage media, and protection against unauthorized modifications or deletions.

• 3-2-1 backup strategy: Keep at least 3 copies of your data, on 2 different types of storage media, with 1 off-site copy. Iperius Backup supports this approach through backups to local disks, NAS devices, cloud storage, and tape.
• Air-gapped backups: A backup copy physically disconnected from the network reduces the risk of ransomware reaching it. Iperius allows you to use removable storage devices such as USB drives and LTO tapes, which can be disconnected or stored offline after the backup.
• Backups in isolated environments: Iperius Backup can operate in environments without a continuous Internet connection, depending on the configuration and features used. This is particularly useful for infrastructures with restricted network access.
• Immutable backups with Object Lock: Iperius supports immutability on compatible cloud storage services such as Amazon S3. WORM (Write Once Read Many) policies prevent protected objects from being modified or deleted during a defined retention period, according to the configured protection mode.
• Immutability and WORM retention: Protecting backup copies from modification and deletion strengthens ransomware defenses and helps organizations meet data integrity and retention requirements.

3-2-1 Backup Strategy

One of the foundations of data protection is the 3-2-1 backup strategy. This approach involves keeping at least 3 copies of your data, on 2 different types of storage media, with at least 1 off-site copy, stored separately from the original data.

In practice, in addition to your original data, you should maintain at least two backup copies: for example, one on a local disk or NAS and another in the cloud or on storage media kept at a different location.

This way, a hardware failure, human error, or incident affecting your primary infrastructure does not necessarily compromise all available copies.

Iperius Backup makes implementing the 3-2-1 strategy easier thanks to its support for hybrid and multi-destination backups. With a single software solution, you can configure backups to different storage types:

• Local backups: Save data to external USB drives, NAS devices, local folders, and shared network drives.
• LTO tape backups: Archive data on magnetic tape, which remains widely used for long-term storage. Iperius supports compatible tape drives, allowing organizations to incorporate tape storage into their backup strategy.
• Cloud backups: Transfer data to services such as Amazon S3, Microsoft Azure, Wasabi, Google Drive, OneDrive, Backblaze, and Dropbox, as well as S3-compatible storage and FTP/SFTP servers.

Thanks to this flexibility, you can organize backups across multiple destinations, such as a local NAS and remote cloud storage, while managing the operations through Iperius Backup.

This configuration helps organizations follow the 3-2-1 rule without necessarily having to use multiple backup applications. Iperius also provides compression and encryption capabilities, helping optimize storage requirements and protect data against unauthorized access.

Implementing a 3-2-1 strategy introduces multiple layers of resilience. A local copy can support faster recovery, while an off-site copy helps protect against incidents affecting the entire business location.

However, it is important to remember that having multiple copies does not automatically guarantee ransomware protection. If every backup destination remains accessible through compromised credentials, the backups themselves may also be exposed. This is why the 3-2-1 strategy should be complemented by additional safeguards such as isolation and immutability.

Air-Gapped Backups: An Important Defense Against Ransomware

As ransomware attacks have become more widespread, it has become increasingly important to adopt strategies that prevent malware from reaching backup copies.

An air-gapped backup is a copy of data kept offline or physically isolated from production systems. The term air gap refers to the separation between the operational infrastructure and the storage medium holding the backup.

When the storage medium is physically disconnected, ransomware spreading through the network cannot directly access it to encrypt or delete stored files.

The main benefits of an air-gapped backup strategy include:

• Network isolation: A physically disconnected storage medium cannot be directly accessed by malware or attackers operating through the corporate network.
• Protection against malicious deletion: If an attacker compromises credentials or production systems, they cannot delete backup copies stored on physically disconnected media through the network.
• Greater infrastructure resilience: Keeping offline copies, preferably at a separate location, helps reduce the impact of infrastructure failures, local incidents, and security breaches.

Traditionally, air-gapped backups were created using magnetic tapes. Once the backup was completed, the tape was removed from the drive and stored in a secure location.

Today, the same principle can also be applied to removable USB drives and other storage devices that are disconnected after data has been saved.

The essential requirement is that at least one backup copy is not continuously accessible to production systems.

Cloud architectures can provide logical isolation and protection through separate credentials, access controls, and immutable storage. However, a service that remains accessible over a network is not equivalent to physically disconnected storage media.

Iperius Backup and Air-Gapped Backups on Removable Devices: USB and LTO

Iperius Backup supports air-gapped backup strategies through its compatibility with removable storage devices, including USB drives and magnetic tapes.

The principle is straightforward: data is backed up to the device during a scheduled backup window. Once the operation is complete, the storage medium is disconnected or removed and kept in a secure location.

Iperius provides several options for organizing these procedures.

Backups to Removable USB Drives

You can configure automatic backups to external USB drives and schedule execution on specific days and at specific times.

For example, an organization might rotate multiple drives:

• Monday: Back up data to drive A, then disconnect it and store it securely.
• Tuesday: Back up data to drive B, while keeping drive A offline.
• Wednesday: Use a third drive or continue the rotation according to the defined retention policy.

This approach allows at least one backup copy to remain disconnected from production systems.

Iperius also supports custom scripts and commands that can run after backup completion. These can help automate certain drive-management operations when supported by the system configuration.

It is important to verify that the script has successfully disconnected the device before considering the backup effectively isolated.

LTO Tape Backups with Ejection

Iperius Backup supports compatible LTO tape drives and allows tape cartridges to be used as offline storage media.

With drives that support this functionality, you can configure tape ejection after backup completion.

The cartridge can then be removed and stored in a protected location, physically separating it from the IT infrastructure.

This approach is particularly useful for businesses using tape-based storage systems that want to incorporate physical isolation into their data protection procedures.

Custom Scripts and Notifications

Another useful feature is the ability to configure commands and scripts before or after backup execution.

Administrators can use these tools to manage specific operations, such as mounting and unmounting drives or performing other tasks required by internal procedures.

Email notifications can also confirm backup completion, helping IT staff remember when removable media needs to be manually disconnected or removed.

Using Iperius Backup in Isolated Network Environments

In addition to creating backups on removable devices, Iperius Backup can be used in infrastructures with limited or no Internet access, depending on the features and activation methods involved.

This is particularly relevant for organizations operating segmented networks, industrial environments, or systems with specific isolation requirements.

However, two concepts must be distinguished: software that can operate without a continuous Internet connection is not automatically air-gapped software. Effective isolation depends on network architecture, system configuration, and the management of backup storage media.

The ability to use Iperius in isolated environments, combined with support for removable devices, therefore provides useful tools for implementing backup strategies based on separating protected copies from production systems.

Immutable Backups with Object Lock on Amazon S3

Alongside physical isolation, another essential component of modern data protection strategies is backup immutability.

An immutable backup is a backup copy that, once stored, is protected against modification and deletion for a predetermined period, according to the capabilities and rules of the storage system being used.

This protection is particularly useful against attacks that attempt to delete backups before encrypting production data.

Iperius Backup supports Object Lock functionality on compatible cloud storage services, including Amazon S3.

When the destination service supports Object Lock and is properly configured, backup objects can be protected through a WORM (Write Once Read Many) policy.

This means that objects are written and subsequently retained under rules that restrict their modification or deletion until the configured retention period expires.

How Does Immutability Work in a Real-World Scenario?

Imagine a company that periodically backs up its business-critical data to Amazon S3 and configures an immutable retention period of 30 days.

During this period, objects protected by Object Lock remain subject to the restrictions associated with the selected retention mode.

If ransomware compromises company systems and attempts to delete cloud backup copies, Object Lock protection can prevent the deletion of objects that are still subject to retention.

However, understanding the level of protection requires distinguishing between the two main Amazon S3 Object Lock modes.

Governance Mode vs. Compliance Mode

Amazon S3 provides two retention modes:

• Governance Mode: Protects objects against modification and deletion, but allows users with specific permissions to bypass the protection.
• Compliance Mode: Enforces stricter restrictions. During the retention period, protected objects cannot be overwritten or deleted, even by administrators of the AWS account.

The choice of retention mode depends on security requirements, operational procedures, and any applicable data retention obligations.

Organizations seeking to protect backups against targeted attacks or accidental deletion should also carefully evaluate permissions, credential management, and retention settings.

Immutability therefore provides an additional level of protection compared with standard cloud backups by limiting the possibility of compromising copies that have already been stored.

However, it does not eliminate the need to verify backup quality and test recovery procedures. An immutable object preserves stored data, but it does not guarantee that the data was correct or free from compromise when the backup was created.

Immutability and WORM Retention: Why They Matter

Immutability and WORM retention policies are important tools for data protection, both from a cybersecurity perspective and for maintaining the integrity and long-term retention of information.

Advanced ransomware attacks often go beyond encrypting production data. Attackers may also attempt to locate, modify, or delete backup copies, making it more difficult for organizations to restore their services.

Immutable storage helps reduce this risk by preventing modifications and deletions of protected objects throughout the defined retention period.

The concept of WORM (Write Once Read Many) originated in data archiving and has historically been used with optical storage and magnetic tapes.

The principle is straightforward: once written, data must remain unchanged for a specified period.

This feature is particularly important in sectors such as finance, healthcare, and public administration, where information retention may be subject to specific requirements concerning integrity, traceability, and retention periods.

Today, the same principle is applied to cloud backups through technologies such as Amazon S3 Object Lock.

For organizations required to meet specific regulatory obligations, WORM functionality can be a useful component of a compliant data retention strategy.

However, compliance with frameworks such as GDPR, PCI DSS, or industry-specific regulations depends on the overall technical and organizational configuration, not simply on the availability of immutability features.

Key Benefits of Immutable Backups

Integrating immutable retention policies into your backup strategy offers several advantages:

• Protection against tampering: Protected objects cannot be modified or deleted during the retention period, subject to the restrictions of the configured WORM mode.
• Greater backup integrity: Preventing changes after data has been written helps preserve the original content of a backup throughout its retention period.
• Support for compliance requirements: Retention policies can help meet integrity and traceability requirements when combined with appropriate organizational procedures.
• Improved ransomware resilience: Keeping backup copies protected against deletion reduces the risk of attackers eliminating every possible recovery option.

It is still essential to establish appropriate retention periods and regularly verify that backups can be successfully restored.

Immutable backups are not a substitute for proper planning. Backup copies must be created at suitable intervals, monitored, and tested to ensure they can be used when needed.

How to Combine 3-2-1 Backups, Air Gaps, and Immutability

Effective data protection often comes from combining multiple strategies rather than relying on a single technology.

The 3-2-1 rule distributes backup copies across different storage destinations. Air-gapped backups reduce the exposure of at least one copy to connected systems, while immutability protects stored objects against unauthorized modification or deletion during a defined period.

For example, an organization could implement the following configuration:

• First copy: Original data stored on company servers.
• Second copy: Automatic backup to a local NAS, useful for routine recovery operations.
• Third copy: Backup to remote cloud storage with immutability policies, providing additional protection against deletion and local incidents.
• Additional offline copy: Periodic backup to a removable USB drive or LTO tape, which is then disconnected and stored securely.

This architecture combines local and remote backups, physical isolation, and protection against unauthorized modifications.

Iperius Backup makes it possible to manage several elements of this strategy through its support for disk, NAS, cloud, and tape backups, adapting to the requirements of supported IT environments.

To achieve effective protection, organizations must also define suitable retention policies, restrict access privileges, monitor backup results, and regularly perform recovery tests.

Conclusion

Protecting business data today requires an approach that goes beyond simply creating backup copies.

The 3-2-1 backup strategy, air-gapped backups, and WORM immutability technologies address different but complementary needs: distributing backup copies, reducing their exposure to compromised systems, and preventing unauthorized modification or deletion.

Iperius Backup provides tools for implementing these strategies through support for local and cloud destinations, removable storage devices, LTO tape drives, and compatible cloud storage with immutability capabilities.

Its perpetual licensing model and range of professional editions also allow businesses to select the features that best suit their infrastructure.

In an environment where ransomware, human error, and hardware failures can compromise data availability, adopting multiple layers of protection helps strengthen organizational resilience.

Choosing suitable backup destinations, properly configuring security policies, and testing recovery procedures remain essential for turning backup copies into a truly effective data protection strategy.

---

For any questions or doubts regarding this article, Contact us