Cybersecurity

You’ve equipped yourself with the introductory knowledge and skills to implement Security Functions & Features! Remember to continue exploring advanced features, test your setup regularly, and leverage the best practices shared in this course to maintain a reliable and efficient workflow.Close your browser window or exit this course. Continue to module 3

Disaster recovery (DR) is a comprehensive approach, leveraging IT technologies and best practices, that aims to mitigate the impact of catastrophic events on businesses by safeguarding data and ensuring operational continuity.A strong disaster recovery plan is crucial for ensuring business continuity, enhancing system security, improving customer retention, and ultimately reducing recovery costs.A disaster recovery plan is usually comprised of the following:Data Backup. Regular data backups are crucial for ensuring data recovery in case of data loss, and following the 3-2-1-1-0 rule can help guarantee that backups are effective and easily accessible. Failover Procedures. In the event of a disruption, we will switch to backup systems in order to maintain operations. Recovery Point Objectives (RPO). The maximum acceptable amount of data loss measured in time. Recovery Time Objectives (RTO). The target time set for the recovery of IT and business activities after a disaster  Disaster

You’ve equipped yourself with the introductory knowledge and skills to implement Disaster Recovery concepts! Remember to continue exploring advanced features, test your setup regularly, and leverage the best practices shared in this course to maintain a reliable and efficient workflow.Close your browser window or exit this course. Return to Course Outline

What is Continuous Data Protection?Continuous data protection (CDP) is a technology that provides data protection for mission-critical VMware virtual machines, ensuring that data loss is minimized even for short periods of time, making it an ideal solution when even seconds or minutes of downtime are unacceptable. By maintaining replicas in a ready-to-start state, CDP guarantees minimal recovery time objectives (RTO) in the event of a disaster.CDP is responsible for generating replicas of data and then ensures these replicas are continuously updated to reflect the latest changes in the original data.CDP (Continuous Data Protection) is designed to continuously replicate all input/output operations performed on virtual machines. CDP leverages vSphere APIs for I/O filtering (VAIO) to handle and analyze I/O operations moving between secure virtual machines and their corresponding data storage, enabling the bypass of snapshot creation. CDP, being perpetually active and avoiding snapshot cre

What is Replication?Replication is a technology that safeguards mission-critical VMware and Hyper-V virtual machines, provides a layer of security and redundancy. Veeam Backup & Replication's VM replication process involves creating an exact copy of the virtual machine in its native VMware vSphere or Microsoft Hyper-V format, which is then placed on the target host. Veeam Backup & Replication ensures that the copy of the source VM is consistently updated and synchronized. Because VM replicas are in a ready-to-start state, replication ensures the minimum possible recovery time objective (RTO) in the event of a disaster. How does Replication Work?VMwareVeeam Backup & Replication utilizes the snapshot capabilities of VMware vSphere to replicate virtual machines. As part of the replication process, Veeam Backup & Replication communicates with VMware vSphere to initiate the creation of a virtual machine snapshot. A VM snapshot, in essence, is a copy of a virtual machine capt

The malware detection methods in this module are complementary to one another, offering defense-in-depth through diverse techniques that identify and alert on malware both before and after a potential recovery scenario. Guest Indexing Data ScanGuest Indexing Data Scan is a feature in Veeam Backup & Replication that enhances malware detection by analyzing file system activity during backup jobs.Here's how it works: Step 1 Backup Job Completion When a backup job with guest file system indexing enabled is completed, the indexing data is saved in the VBRCatalog folder on the backup server. Step 2 Notification The Veeam Guest Catalog Service notifies the Veeam Data Analyzer Service about new data that needs to be scanned. Step 3 Data Analysis The Veeam Data Analyzer Service checks the last scan results and initiates a new guest indexing data scan if necessary. Step 4 Malware Detection The scan detects known suspicious files and extensions, renamed or deleted files, and other malwa

What are SIEM solutions and what does the Veeam integration allow you to do?Veeam has integration with various Security Information and Event Management (SIEM) solutions to enhance cybersecurity and threat intelligence capabilities. The SIEM integration provided by Veeam allows for real-time monitoring and analysis of Veeam Backup & Replication logs and events within the SIEM platform. It enables organizations to consolidate Veeam logs with other security logs, automate threat detection and response, and gain better visibility into their backup and recovery environment. Some SIEM solutions supported by Veeam include Splunk, Elasticsearch, IBM QRadar, and ArcSight. How does integrating with a SIEM tool enhance your cybersecurity and threat management?Integrating with a SIEM tool provides several capabilities that enhance cybersecurity and threat management: Centralized Log Management: SIEM integration allows for centralized collection and analysis of logs from various sources, inclu

Ensuring that, in the event of an incident, you can restore the configuration of your backup server is of paramount importance. Backing up your configuration of your backup server is important as it creates a safety net in case your system crashes or experiences problems. You can then easily restore these settings and get back to work quickly. Do not back up the backup server configuration using backup jobs in Veeam Backup & Replication. By default, Veeam Backup & Replication creates a configuration backup daily. You can change the schedule or create a configuration backup manually. You can choose the backup repository in which the configuration backup must be stored, specify the necessary retention settings. Veeam Backup & Replication allows you to create immutable configuration backups.   Continue to Lesson 7: SIEM IntegrationReturn to Course Outline

What is Secure Restore?Secure Restore is a feature in Veeam Backup & Replication designed to protect your environment from malware during the recovery process. It allows you to scan restore points for malware before restoring them to the production environment. This can be achieved using several options: your own antivirus software, Veeam's embedded antivirus Threat Hunter, and YARA rule-based scanning. By leveraging these tools, Secure Restore ensures that only clean data is restored, enhancing the security of your backups and minimizing the risk of reintroducing malware into your systems. This proactive approach strengthens your overall data protection strategy and helps maintain the integrity and safety of your IT environment. Why is Secure Restore Important? Enhanced Security: It scans restore points with antivirus software and YARA rules before restoration, ensuring that backups are free from malware and other threats. This reduces the risk of reinfecting your production envir

What is SureBackup?SureBackup is the Veeam technology that allows you to test machines backups and check if you can recover data from them. It tests the integrity of backups by performing randomized checks, including checksums, file, network and security integrity.SureBackup can help ensure that backups are valid and restorable, which is important for data protection and disaster recovery. It can also scan backups for malware and silent data corruption.SureBackup can:Detect corrupted backups/replicas. Test that virtual machines can boot. Test applications and their dependencies. Ensure regular consistent testing. Leverage your existing hardware: no need to buy additional servers. Randomize machine testing. Exclude designated machines.  Why is testing recoverability important?Testing recoverability is crucial for several reasons. It ensures data integrity by confirming that backups are not corrupted and can be restored successfully. This validation helps identify and address

What is multi-factor authentication?MFA (or sometimes known as Two-Factor Authentication, 2FA) is the principle that a user needs to provide more than one type of evidence to access an account. Evidence Required Examples Something you know Passwords and PINs, Security Questions Something you have OTP Tokens, U2F Tokens, Certificates, Smart Cards, Email, SMS, Phone Calls Something you are Biometrics (Fingerprints, Facial Recognition, Iris Scan) Somewhere you are Source IP, Geolocation, Geofencing Something you do Behavioral Profiling, Keystrokes/Mouse Dynamics  Why is multi-factor authentication important?Multi-factor authentication (MFA) is important because it’s a strong defence against password related attacks. Microsoft estimates accounts are 99.9% less likely to be able to be compromised if MFA is used. MFA with Veeam Backup & ReplicationVeeam Backup & Replication uses multi-factor auth

Veeam Backup & Replication provides a built-in tool to ensure that your backup server configuration follows security best practices for Veeam backup infrastructure components based on Microsoft Windows Server and Linux operating systems.To perform a security check, click Security & Compliance on the Home tab. Configuration parameters set up as recommended will have the Passed status. Security & Compliance Analyzer checks configuration parameters both for the operating system and Veeam products. You can implement these recommendations manually or use the automatic configuration script provided by Veeam.    Continue to Lesson 3: Multi-factor AuthenticationReturn to Course Outline

Veeam Threat Center OverviewThe Veeam Threat Center provides you with a complete and comprehensive view of your entire data protection landscape. The dashboard allows you to visualize what areas of your infrastructure are susceptible to a cyberattack, thus allowing you to remediate and fix any gaps in your environment in real time. By collecting these different data points about your product configuration you can take the necessary steps to implement best practices and guidelines.  Data Platform ScorecardThe Platform Security Compliance score gives a score that represents how compliant your environment is. The lower the score the more at risk you are of not being able to recover data in the event of a data recovery incident. You can obtain a report that shows the areas for improvement which will improve this score which can be shared and actioned in order to make necessary changes.The Data Recovery Score gives a score to indicate how healthy your backups are. This score is based on a m

You’ve equipped yourself with the introductory knowledge and skills to implement Cybersecurity & Disaster Recovery Security Concepts! Remember to continue exploring advanced features, test your setup regularly, and leverage the best practices shared in this course to maintain a reliable and efficient workflow.Close your browser window or exit this course. Continue to module 2

What is Four-eyes Authorization?Four-eyes authorization is a control mechanism that requires at least two people to approve a specific activity before it can be completed.What are the benefits of Four-Eyes Authorization? Security Transparency Compliance By requiring dual oversight for critical operations, the system mitigates risks associated with accidental or malicious changes, enhancing overall security. The detailed audit trail of all requests and approvals promotes accountability, providing clear records of who initiated and who authorized each critical action. This practice aligns with industry best practices and regulatory requirements, supporting the organization’s compliance efforts and enhancing its security posture.  Four-Eyes Authorization ScenarioTo bolster their data protection and operational security, a company decides to implement four-eyes authorization in their Veeam Backup & Replication environment. This method requires an additional layer of approval

What is encryption?One of the most powerful tools in your arsenal to protect your data is encryption. Data encryption uses cryptographic algorithms and a secret key to transform data into an unreadable and scrambled format. This ensures that even if encrypted data is intercepted and stolen, it cannot be deciphered or understood by unauthorized individuals. Only those who possess the secret key can decrypt and reverse the encryption, making the information readable again. Encryption provides a secure way to protect sensitive data and maintain confidentiality. Encryption vs PerformanceEncryption almost certainly will have an impact on performance, as it involves additional computational overhead to process and transform data into an encrypted format, similarly, there is a performance cost for decrypting the data in a restore scenario. The performance impact of encryption depends on several factors. Encryption Algorithm The choice of encryption algorithm can influence performance. So

What is immutability?For a backup to be “immutable” this means that it is unable to be changed or deleted. Typically, immutable backups can only be deleted once a set time period has expired. Immutable backup data is safe from potential changes or deletions during that time, meaning that its original integrity stays intact. Why is immutability important?Immutability is important because it adds an extra layer of security to your backups, ensuring that even in the event of a data loss incident, your data remains safe and unaltered after the fact.Immutability can help in situations like: Accidental deletion of production data  Corrupted or compromised production data  Insider malicious activity  A hacker attack modifies the retention policy   What are immutable backups? What are the Options for Immutability?There are a number of options for immutability with Veeam with links for additional information: Immutable on-premises storage: Veeam Hardened Repository: A disk-based storage s

 In protecting our data and ensuring recoverability we need a strategy, the 3-2-1 rule, originally attributed to photographer Peter Krogh, follows these requirements: 3 Copies of Data – Maintain three copies of data - the original, and at least two copies. 2 Different Media – Use two different media types for storage. 1 Copy Offsite – Keep one copy offsite to prevent the possibility of data loss due to a site-specific failure. In Veeam, we have made some amendments to the original rule: 2 Different Media – The original purpose of this rule was to combat the fact that if two drives are purchased at the same time, they were very likely to fail at the same time. In Veeam it would be more accurate to say "Media Platforms". Consider block, object, tape, appliance-types file systems based storage as different platforms for the purposes of this rule. Technically speaking they could be the same media - disk - but different protocol and storage platforms. The additional 1-0 reference specif

Zero Trust PrinciplesZero Trust refers to security principles based on the mottos “never trust, always verify” and “assume breach”. Always verifying approved access and operating under the assumption that breaches will happen.The cornerstone principles of Zero Trust include: Continual Monitoring and Verification Zero Trust operates on the premise that ongoing attacks can originate from both inside and outside the network. Continuous monitoring of users is essential, and no individual is automatically trusted. This necessitates the verification of user identity, device identity, and user privileges. To uphold the principle of continual verification, the system periodically logs users out and terminates device connections. Micro-segmentation Micro-segmentation is a strategy used to enhance network security by dividing the network into smaller, isolated segments. This approach limits the ability of attackers to move laterally within the network if a breach occurs. By creat

Regularly update Veeam componentsKeeping Veeam backup servers, management consoles, and other components up to date with the latest patches and updates to address any security vulnerabilities is an absolute must when it comes to security hygiene. Security PatchesBoth operating systems and software applications are susceptible to vulnerabilities exploited by malicious actors.  These bad actors can leverage weaknesses in the software's code, libraries, or other components to compromise the security of the operating system and/or software, granting them unauthorized access. CVE, which stands for Common Vulnerabilities and Exposures, serves as a standardized reference method for publicly disclosing and tracking known vulnerabilities and exposures in information security.After a CVE is publicized, it is expected that software vendors will make available solutions to address the vulnerability. These solutions may involve providing instructions on how to fix the issue or releasing a new versi

Introducing Veeam Cybersecurity & Disaster RecoveryIn the modern data protection landscape protecting data is as much about ensuring that we are complying with our protection strategies as it is about security. This course is designed to give you a view ‘over the fence’ into security  so you are prepared to play a critical role in protecting your organization's data, from both external threats such as external actors looking to compromise systems for ransomware purposes or internal incidents such as actions performed by disgruntled employees, playing your part in the shared responsibility of securing the environment using industry security standards and security best practices.Having a basic understanding of security is important for a backup administrator for several reasons: Protecting Backup Infrastructure Network security plays a critical role in safeguarding the backup infrastructure from unauthorized access, malicious activities, and potential vulnerabilities. A backup a