How Backups Can Save You from a Cyber Attack

Back-ups:
Hoe ze je kunnen redden
van een cyberaanval
Combell webinar
Pieter Vereecken
Sr. Cloud Systems Engineer
pieter.vereecken@veeam.com

© 2020 Veeam Software. Confidential information. All rights reserved. All trademarks are the property of their respective owners.
You were automatically muted on entry
If you have a question, use the Q&A
or chat functions
We will post the recording and the presentation
This webinar
is being recorded
About this webinar

In this session…
Why you can never be protected 100% against hackers
and why you need (off-site) backups.
 Data protection strategy
 Security
 On-site & Off-site backups
 Demo
 Monitoring & Reporting
 Q & A

The most trusted
provider of Backup
solutions that deliver
Cloud Data Management

A Single Platform for Cloud, Virtual and Physical
Backup & Replication
Backup and replication
Monitoring and analytics
DataLabs
Orchestration
Universal Storage APIs
CloudSaaSPhysicalVirtual
Object Storage

Why Veeam?
“It Just Works”
Portable data format
Instant recovery
Strong support
Reliable
Built-in intelligence
Actionable insights
100% verified recovery
Scalable architecture
Simple
Software defined
Hardware agnostic
Copy data management
Cloud ready
Flexible

Ransomware protection
best practices

Starts with mitigating security risks

Security is inconvenient!
Let’s meet Dave >
Domain admin
Controls the whole domain for the
organization!
Backup administrator
Can perform all administrative
backup activities!
Storage administrator
Manages the production storage
and the backup storage!

Production Domain
Dave’s IT operation
DMZ
Offline Domain
Secondary storagePrimary storage
vCenter
server
VM’s
vApp
VM
snapshots
Storage
Clients
Users
Applications
Servers
Production
AD
Separation
By IAM and Firewall
Random Backup
infrastructure
Tape backup policy, weekly full backup to tape (keep 5
weeks) and also a monthly full to tape (keep for 12 months)
Backup policy, daily backup to disk of all
servers and workstations
1. No protection against cyber-attacks
2. Big risk! Everything is running in the
same security domain
3. Only week backups are stored offline
Human Error

Think about security aspects

Production Domain Resource domain
Identity and Access Separation
DMZ
Public Cloud IAM
One-Way Trust
Complete
Separation
Complete Separation
Object
Storage
BLOB API
S3 API
Service ProviderOffline Domain
Secret Key + Shared Key + Veeam Encryption
Secret Key + Shared Key + IAM Access Role + Veeam Encryption + Immutability
Backup server
S3 API
Object
Storage
AD Auth (sep.acc)
Windows
Repository
Service Provider
Access Keys
Local Linux Cred.
Linux
Repository
COS APISecret Key + Shared Key + Veeam Encryption
Secondary storagePrimary storage
Backup
Proxies
Restricted Zone
Vendor Spec. Prot
Dedup
Appliances
vCenter
server
VM’s
vApp
VM snapshots
Storage
Clients
Users
Applications
Files
Service
Provider
Recycle Bin
Feature
Production
AD Resource
AD
Human Error

Design for ‘cyber’-recovery
Infection ExploitDetection Recovery
• 3-2-1 Backup
• SureBackup
• Veeam ONE
• Data Integration API
• Staged Restore
• DataLabs Forensics
• Enhanced NAS Recovery
• Secure Restore
• Cloud Tier with
Immutability
• Cloud Connect
Detection features Recovery features
• Tape backup
• Restore to Azure
• Restore to AWS
• Physical to Virtual
recovery
Cyber Attack

Avoiding recovery failure
3-2-1-0 Rule
2Different media
3Different copies
of data
1of which is off
site or offline
0No errors

Offline or air-gapped storage
Likely the single most effective resiliency technique is to have some form of offline
storage: tape, removable disk, etc.
Completely offline when not being written to or read from
Replicated VMs Powered off and, in most situations, can be a different authentication
framework (ex: vSphere and Hyper-V hosts are on a different domain)
Primary storage
snapshots
Can be used as recovery techniques and usually have a different authentication framework
Veeam Cloud Connect
backups
Not connected directly to the backup infrastructure and uses a different authentication mechanism along
with different API and Serviceprovider based Recycle-Bin
Rotating hard drives
(rotating media)
Offline when not being written to or read from (similar to tape)

3-2-1-0 in place, recovery covered?
What are you achieving with 3-2-1-0?
Does it have anything to do with recovery?
Does it say anything about how long restore will take?
Does it say anything about where to restore to?
Does it say anything about the order in which to restore?

Business Continuity is Key
How much time it takes to recover your data and how recent
the backup to restore is are defined in RTO and RPO.
Last backup
Recovery point
Recovery data
Recovery TimeOutage
How far How long
Recovery Time Objective (RTO)
The amount within which a system must be recovered
after an outage
Recovery Point Objective (RPO)
Point in time to which system's data must
be recovered after an outage

Veeam
Backup & Replication

Veeam
Backup Server
Source hosts Loadbalancing
Backup
central management of
local and remote
components
Production
Tape Server
Backup
Proxies
Veeam High Level Architecture
Off-site Storage
Secondary copy
and long-term
retention
Scale-out
Repository

Veeam Backup & Replication
Storage Snapshots

Use of Storage Snapshots for better RTO and RPO
During backup, data transport and consistency processing reduce performance
of applications.
Leverage storage snapshots between the backup for even better Recovery Time
and Recovery Point Objectives.
3 PM
Snap
Backup
+ snap
Snap Snap Snap Snap Snap Snap Snap Snap Snap
Backup
+ snap
8 PM 9 PM 10 PM 11 PM 12 PM 1 AM 4 PM 5 PM
…
6 PM 7 PM 8 PM
…

Veeam Explorer for Storage Snapshots
Instant VM
Recovery
Linux Files
Windows Files
Active
Directory
Exchange
SharePoint
MS SQL
Oracle
Veeam backup and replication

Backups

Backup of Virtual Machines
Inline data reduction
Change block tracking aware
Agentless backup
256-bit encryption
Policy driven backup automation
Build-in application aware processing of:
• Microsoft Active Directory
• Microsoft Exchange
• Microsoft SQL
• Microsoft SharePoint
• Oracle Databases
Image-level backup with granular restore options

Policy driven Backup
SLA based policies
Based on tags
Automated through
VMware vCenter

Backup Copies

Backup Copy
Comply with the 3-2-1-0 rule
Production storage Primary backup storage
WAN acceleration
Secondary backup storage
Secondary backup storage
(offsite)
Backup
Backup copy
Backup copy
Combell

Build-in WAN Acceleration
Built-in WAN Acceleration with global caching, variable block length data fingerprinting and
traffic compression
Source Backup
Repository
Target Backup
Repository
Data Mover
Service
Target
WAN Accelerator
WAN
Backup Copy
and/or Replica job
Source
WAN Accelerator
Data Mover
Service
Reduce bandwidth needed to copy
your backups to a secondary location
Save on bandwidth costs by efficiently
sent only the missing blocks
Intelligently save time on backup copy
and replica jobs

Veeam Cloud Connect Backup
Client
 Customer has no cloud resources to manage
 Offsite backups can be protected against ransomware
Combell data center
Veeam
Service
Provider
WAN
Cloud
gateway
Backup
repository
Cloud repositories
Production Veeam Environment
Veeam Cloud
Connect SSL tunnel

Insider Protection
Deleted Backups Protection
 Per tenant setting
 For the tenant, backup files moved to
the "recycle bin" appear as actually
deleted.
 To restore from “recycle bin”, tenant
must contact service provider.

Recover Full VMs, Files and Folders
Restore functionalities
include:
 Full VM restore
 VM files restore
 VM guest OS files
restore
 Application items
restore
 Disk export
 Backup export

Demo

Data Protection
Monitoring & Reporting

Why do we need analytics?
In order to maintain Availability organizations require analytics into:
 Storage capacity and performance
 Failed VM backups
 Failed compliance
 Data management resources and associated costs
 Tracking configurations
 And more!

Identify EVERY Unprotected VM
Veeam ONE helps users easily determine which VMs are protected and which are
not by categorizing VMs based on restore points to:
 Provide users valuable time to ensure protection of each VM
 Dramatically reduce the risk of downtime
Are you completely protected?

Backup Reporting
Including:
 Backup Infrastructure assessment
 Performance and bandwidth savings from built-in WAN acceleration
 Audit operator restore activity
 Status of backup and replication jobs
 Unprotected VMs that are not covered by any backup jobs
 Change tracking for backup job configuration
 GFS Backup files
 VM and computer protection history

Track backup object changes
Report on who changed what settings and
when.
Governance & Compliance
Audit backup infrastructure changes and
report on user account and modifications.
Object Change Tracking

Recovery Verification Recovery Verification
Recovery Verification
Overview
Validates the completion status of
SureBackup jobs and displays the results of
recovery verification tests
Governance & Compliance
The report helps you reveal the list of
operational VMs that can be restored
from the produced backup or replicas

Key takeaways
Design with security in mind
Use multiple backup locations (3-2-1 rule)
Use multiple security domains
Offline and offsite backups can be lifesavers
Document everything (reporting)
Use multiple authentication accounts and roles

Questions?

THANK YOU!

How Backups Can Save You from a Cyber Attack

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to How Backups Can Save You from a Cyber Attack

Similar to How Backups Can Save You from a Cyber Attack (20)

More from Combell NV

More from Combell NV (20)

Recently uploaded

Recently uploaded (20)

How Backups Can Save You from a Cyber Attack