ESX Virtualization

VMware ESXi, vSphere, VMware Backup, Hyper-V... how-to, videos....

Nakivo Backup and Replication - #1 Backup solution for Virtual, physical, cloud, NAS and SaaS

Practical Tips to protect your Veeam Backup Repositories

By | Last Updated:

Shares

Veeam Backup repositories (but not only Veeam's) are one of the principal targets of ransomware. When your backups are wiped out or encrypted, you're left with nothing to restore. Designing your backup infrastructure against ransomware attacks is one of the keys in order to succeed (or rather not fail) when dealing with ransomware attacks.

When you detect that your company was hit by ransomware, you can be sure that the bad guys will go after your backup files, no matter what. How to protect those files? How to protect your backup infrastructure? How to architect it to be safe? In this post, we'll give you some practical tips to protect your Backup Repositories.

3-2-1-1-0 rule: Three different copies of data, two different media, one of which is off-site. That’s where the rule starts, have comprehensive ransomware protection with at least one copy being immutable and zero surprises with recovery verification. Use Copy Jobs and/or Replication as an additional layer of protection. It's easy to set up a secondary site with a single ESXi which will be used as a target for your most critical VM's replicas.

Storage Snapshots can save you –  Many SAN devices support storage snapshots. Use it! Take storage snapshots on backup storage if possible. If the storage device holding backups supports this capability it may be definitely worth using this feature to prevent ransomware attacks!

Stay away from Microsoft AD – Veeam Backup Server should stay away from your Microsoft Active Directory (AD) Domain. If you're getting attacked, most likely they'll go after your Domain admin or privileged credentials to make as much damage as possible on maximum systems within your organization.

Separate user accounts – By default, Veeam is configured to allow anyone in the local administrator's group full access to the Veeam console. Veeam has separate roles to assign to each user depending on what job they will be performing.

It is also important to follow proper password change policies for accounts that have access to do operations in Veeam. This is especially the case if someone leaves the company, as it is time to change the password.

Do Not use RDP on the Veeam Backup server – Why? It's because it's more secure to install a Veeam Backup console for day-to-day operations. Also, you can use ILO, Drac, iPMI to remote access your server. Or you can go directly to the server room and from the console do your patching, upgrading etc.

Use Multi-factor authentication – de facto a standard nowadays. Veeam's latest version 12 allows directly enabling MFA on an account and login to the Veeam console. Even if someone has access to your Veeam server, he/she will not be able to start your Veeam Backup console and do possible damage.

Veeam Multi-factor authentication

Let Veeam Backup Server be only a backup server – It's fairly often, especially with small businesses, that I see that the Veeam backup server has to hold other roles, such as file server, WSUS, app-server…. Not good.

Close Windows Firewall ports except the ones needed by Veeam – Keep the firewall on for all domains (public, private, and if applicable domain). Check the help page at Veeam here for those necessary ports.

Encrypt backups – you might think that encrypting your backups is not necessary. I'd say, it's an extra layer of protection as attacker if he/she get access to the backup files, those will be unreadable so it will be much harder to access your data. However, it will not prevent the attacker (if he's already in your system) from wiping those backups out, even encrypted.

Edit your job > Storage > Advanced > Storage TAB

Use storage of different kind – Tapes, Tapes, Tapes. Yes, but virtual! As you might already heard, you can use software to simulate tapes. One of those is StarWind VTL.

We have more articles about StarWind VTL:

Final Words

Every architecture is different. You have also different underlying hardware which offers different possibilities for ransomware protection and architecture. Immutability everywhere is a must. Coupled with strict access to your Veeam backup server you should eliminate a 90% of cases where your backups got into the hands of hackers. And if you have backups, you can restore…

Detailed articles about v12 new features:

More about Veeam on ESX Virtualization Blog:

 

More posts from ESX Virtualization:

Stay tuned through RSS, and social media channels (Twitter, FB, YouTube)

Shares
5/5 - (2 votes)

About Vladan SEGET

This website is maintained by Vladan SEGET. Vladan is as an Independent consultant, professional blogger, vExpert x16, Veeam Vanguard x9, VCAP-DCA/DCD, ESX Virtualization site has started as a simple bookmarking site, but quickly found a large following of readers and subscribers.

Connect on: Facebook. Feel free to network via Twitter @vladan.