Backup Strategies series · Part 5 of 7

Hybrid Backup Strategies — D2D2T, Air Gap, Immutable

The strong architectures against hardware failure, human error and ransomware

D2D2T · D2D2C · Air gap · Immutable · Replication · Hardened repository

On this page

» Air gap in practice
» Immutable backups
» Hardened repository

» Replication vs backup
» SMB architecture blueprint
» FAQ & consulting

Why hybrid? No single medium does it all

From the previous parts: local NAS and tape backups are fast and cheap, but exposed to fire and ransomware. Cloud backup beats them on off-site protection but is slow and bandwidth-limited for large restores. A hybrid backup architecture combines both worlds into a chain that catches every realistic damage scenario — without compromising RTO or RPO.

The established blueprints have abbreviated names (D2D2T, D2D2C) and build on each other. Cross-cutting concepts like air gap and immutability run orthogonally — they make any of these blueprints ransomware-proof.

D2D2T — Disk-to-Disk-to-Tape

FAST + AIR-GAP CHEAP LONG-TERM STORAGE ESTABLISHED STANDARD

Disk-to-Disk-to-Tape means: first backup tier on fast disk storage (NAS, storage server), second tier copies to LTO tape. The disk tier handles daily and weekly backups with short RTO; the tape tier covers monthly/yearly and external relocation.

Advantages: restores from the last 4–8 weeks happen from disk — fast, no tape loading. Long-term backups sit on a tape library or are ejected into a vault — air-gapped and cheap per TB. Restore of a full server from tape takes longer but is guaranteed.

D2D2C — Disk-to-Disk-to-Cloud

NO TAPE LOGISTICS CLOUD OBJECT LOCK EGRESS COSTS

The modern variant: first tier on disk like D2D2T, second tier into a cloud object store with Object Lock / immutability. Advantages: no physical tape logistics, no eject, no transport, no storage. Off-site protection comes automatically through the cloud data centre. Drawback: restore from the cloud at large data volumes is bandwidth-limited — and AWS/Azure egress fees can hurt. Wasabi, IONOS or Backblaze B2 are more economical here.

Air gap — concrete and effective

ONLY TRULY RANSOMWARE-PROOF

Air gap means physical or logical separation of a backup copy from the production network. An attacker who has fully taken over your domain has no path to the air-gapped backup — because it is simply unreachable. Three practical implementations:

Physical (classic)	Ejected LTO cartridge in a vault, disconnected USB hard disk. No power, no network, no attack vector.
Logical	Backup storage is only reachable during the backup job (time-controlled firewall rule or service account). Offline outside the backup window.
Cloud (Object Lock)	Cloud backup with S3 Object Lock in “Compliance Mode” — undeletable until the retention expires, even with compromised admin credentials.

Practical recommendation: at least one of these three air-gap layers must be present in any production backup concept. For maximum security, combine all three.

Immutable backups

UNCHANGEABLE NO ADMIN ACCESS

An immutable backup cannot be modified or deleted for a defined period — not even by administrators with full rights or compromised accounts. Implemented per platform: S3 Object Lock (AWS, Wasabi, MinIO), ZFS snapshots with locked retention (TrueNAS, Synology BTRFS), WORM mode on tape (LTO WORM cartridges), Veeam Hardened Repository (Linux with chattr-based immutability) or Azure Blob Legal Hold.

Hardened repository — the resilient backup target

OFTEN MOST ECONOMICAL

A concept popularised by Veeam, now an industry standard: a Linux server (e.g. Ubuntu LTS on a rack-mount server with sufficient disks) with a dedicated backup account, SSH-key-only login, no root access, immutability flags via chattr +i. The backup software writes via SSH/SFTP. Even if the backup console is compromised, it cannot delete backups on the repository. For SMBs a very economical alternative to a costly WORM storage appliance.

Replication — useful, but not a backup

SOLVES RTO, NOT RPO

In replication, a production system is mirrored onto a standby system — either synchronous (block by block, e.g. DRBD, NetApp SnapMirror) or asynchronous (snapshot-based, e.g. Hyper-V Replica, vSphere Replication). Result: in case of hardware failure the replica takes over within minutes. But: a deletion or encryption is mirrored immediately. Replication does not replace backup but complements it for RTO-critical workloads. Clean architecture: replication for high availability + backup for historical recovery.

Architecture blueprint for a typical SMB

A pragmatic, ransomware-proof architecture for a mid-sized company with ~5 TB of data:

Tier 1 — Snapshot	Storage snapshots on NAS or SAN every 4 h. RPO ~4 h, RTO seconds. For rollback after operator errors.
Tier 2 — Disk backup	Daily incremental backup to a backup-NAS configured as hardened repository. Retention 30 days.
Tier 3 — Tape	Monthly full backup on LTO tape copied from tier 2. Eject, off-site storage in vault. Retention 12 months, yearly copies 10 years.
Tier 4 — Cloud	Weekly backup copy to object storage (Wasabi/IONOS) with 90-day Object Lock. Off-site protection, disaster-recovery source.

Result: five independent recovery points (snapshot, NAS, tape on shelf, tape in vault, cloud), two of which are air-gapped/immutable. Even with total loss of the building plus a successful ransomware attack, the cloud copy remains untouched. The monthly tapes in an external vault are the last line of defence for the worst case.

Frequently asked questions

Is a hardened repository alone enough as ransomware protection?

Almost — but not quite. If the ransomware actor gains access to the backup server itself (e.g. via a Linux OS vulnerability), immutability could in theory be bypassed. An additional off-site/air-gap layer (tape or cloud Object Lock) is the worst-case insurance.

What does a real hybrid architecture cost?

For an SMB with 5 TB of data: NAS (€5,000–8,000) + LTO-9 drive (€3,000–5,000) + 10× cartridges (~€600) + cloud (~€100/month) + backup software (Veeam Essentials ~€1,500/year). One-off ~€10,000–15,000, ongoing ~€250/month. Very cheap compared to the cost of total loss.

Doesn't air gap make my backup strategy too slow?

For everyday restores of a single lost file, no — that goes through the fast disk tier. Air-gap backups are insurance for the emergency case, where it is about hours to days of recovery time (vs. otherwise weeks or total loss).

How often should the air-gap layer be refreshed?

At least monthly, ideally weekly. A 6-month-old air-gap backup is more valuable than none, but in an emergency means losing months of business data. For critical systems, the air-gap refresh should be a scheduled process (e.g. on the 1st of every month).

Consulting on hybrid backup architectures

Ransomware-proof concepts require experience with the interplay of NAS, tape library, backup software and cloud connectivity. We help with planning, selection and implementation — matched to your compliance position and budget.

Phone: +49 (0)7666 / 88499-0 · E-mail: sales@industry-electronics.com

Related shop categories

Backup hardwareStorage NAS
Band/Cartridge
Tape array
Tape storage systems

SoftwareBackup solutions
Data protection

Servers & storageServers · Rack-mount
Storage server
Hard disks

Other parts of this series

You are here: Part 5 — Hybrid Strategies

Last updated: April 2026 · Lieske Elektronik · industry-electronics.com