Every serious backup design keeps one copy that an attacker on the network cannot reach. For decades that meant exporting tapes from the library and sending them offsite. Modern libraries offer a second way: keep the tapes inside the box, but out of the network’s reach (and, with Ransom Block, the robot’s). Neither is simply better. They defend against different things, and the right design usually uses both.
View the data behind this chart
| Offsite rotation | Active Vault | Ransom Block | |
|---|---|---|---|
| Where the tape is | Another building | Vault partition | Part-ejected magazine |
| Remote attacker | Protected | Small residual risk | Protected |
| Admin-level insider | Separate custody | Admin can undo | Needs site access |
| Loss of the building | Survives | Lost | Lost |
| Media health checks | Rarely tested | EDLM: i6, i6000, i7 | Not with EDLM |
| Recovery | Courier + import | Robot moves back | Re-insert magazine |
Why the offline copy is the one that matters
Ransomware crews now go after backups before they encrypt production, because a victim with clean, reachable backups does not pay. Disk repositories, snapshots and cloud buckets that the backup server can write to are all, in principle, reachable by someone who controls the backup server. A tape that is not in a drive is not.
Quantum’s Active Vault brief puts it plainly: the key to recovering from ransomware is keeping a copy of data that is completely inaccessible from any network, and a tape cartridge on a shelf is completely immune to ransomware. The question is how you get the tape to that state, and what else you give up on the way. For the wider immutability picture, see immutable vs air-gapped backup.
The traditional rotation, and what it costs
The classic pattern is a grandfather-father-son rotation: export the week’s or month’s tapes through the library’s import/export slots, box them, and hand them to a courier or carry them to a safe. It works, and it puts the copy in another building, which nothing else on this page does.
Its weaknesses are human. Quantum’s brief lists them: exporting and shelving tapes takes staff time, people misfile or lose cartridges, and tapes do not handle drops well. Retrieval means ordering tapes back from the store and importing them, which takes as long as your contract says. And shelved media is almost never tested, so a degraded cartridge is often discovered only when it is needed.
What in-library vaulting does instead
Quantum’s Scalar libraries offer three automated alternatives, which its Ransom Block brief describes in order of increasing security. Active Vault moves exported tapes into a library-managed partition that has no drives and no host connection and is visible only to library administrators. On the Scalar i6000 and i7 RAPTOR an export-redirect policy does this automatically, so the backup software performs a normal export and believes the tape has left; Quantum’s datasheet lists export redirect as not supported on the i3 and i6, where tapes are moved into the vault from the library GUI. Logical Tape Blocking refuses any request to move a tape in a blocked magazine, and can only be switched off at the library’s own panel. Ransom Block, on the Scalar i3 and i6, partly ejects a magazine so the robot physically cannot pick its tapes until someone pushes it back in.
The barcodes in a Ransom Block magazine can still be scanned, so presence can be audited remotely at any time. Quantum says this protects tapes from remote attack as securely as exporting them to a vault. See Scalar Active Vault and Ransom Block for how the levels stack.
Threat by threat
The two approaches separate cleanly when you take the threats one at a time.
- •Remote attacker with network access: both defend. Active Vault alone leaves what Quantum calls a small risk if the library itself is compromised; Tape Blocking and Ransom Block need a person at the library to undo, which a remote attacker cannot supply.
- •Insider with library admin rights: Active Vault is only as strong as the admin account, so multi-factor authentication and directory-controlled accounts matter. Ransom Block still needs physical access. Offsite tapes held under separate custody are the strongest answer here.
- •Fire, flood or loss of the building: only the offsite copy survives. An in-library vault is in the same room as production.
- •Media decay: tapes in an Active Vault partition can be scanned on a schedule with Quantum’s EDLM on the Scalar i6, i6000 and i7 RAPTOR, using drives with their external ports disabled. EDLM does not scan tapes under Tape Blocking or Ransom Block, so decide per magazine which you want. Shelved tapes are rarely tested at all.
- •Speed of recovery: vaulted tapes are moved back by the robot, with no courier in the loop.
A pattern that uses both
For most organisations we design two offline copies with different jobs. The frequent copy, the one you would restore from after a cyber attack, goes into an in-library vault (by export-redirect policy on an i6000 or i7 RAPTOR, from the library GUI on an i3 or i6), with Tape Blocking or Ransom Block on the magazines you do not need EDLM to scan. A less frequent copy, often the monthly or yearly full, still leaves the building, either on tape to an offsite store or as a replicated backup at a second site.
That keeps the attack-recovery copy fast and automated, and keeps a site-loss copy that does not depend on the building surviving. It also shrinks the courier job to the copies that genuinely need to travel.
Setting up the in-library side
The work is in policy, not hardware. Create a vault partition for each application partition that writes offline copies. On an i6000 or i7 RAPTOR, set an export-redirect policy so exported tapes go to the vault instead of the import/export slots; on an i3 or i6, which do not support export redirect, build the move into the vault into the job runbook. Protect the library administrator accounts with MFA, LDAP or Active Directory, and IP restrictions before anything else. Decide which magazines get Tape Blocking or, on an i3 or i6, Ransom Block, and whether Automated Media Return should bring tapes back when their hold ends.
Two licensing details change the sums. Active Vault is itself an optional feature, and its partitions are built from unlicensed slots, so the vault does not use the slots you license for backup. EDLM is a separate optional licence that needs dedicated scanning drives. Both are covered in our tape library sizing guide.