Events
Groups
Product Updates
Leaderboard

Create topic
Login

VeeamON 2025 San Diego, California

2 months ago

Community
Veeam User Groups
Cyber Security Space

Cyber Security Space

273 Topics
1,679 Comments

Events

Wed, Mar 19, 2025, 4:00 PM (GMT)

Veeam Hardening Best Practices

Online event

44 members attended44 Registrants44

marcofabbriOn the path to Greatness

Learning corner: Free IT certifications and courses

This thread’ll be update through the year with FREE courses that lead to FREE certifications. If we all grow, we all improve. Please help keep this thread updated throughout the year. ***** Updated 02 October 2023 ***** [Veeam] Veeam University: Veeam surely. https://www.veeam.com/free-on-demand-trainings.html [Kubernetes] Free Kubernetes Training by Veeam, with 3 badges after completation: Apprentice, Defender, Helmsman https://learning.kasten.io/ Kyverno is a policy engine designed for Kubernetes. With Kyverno, policies are managed as Kubernetes resources and no new language is required to write policies. This allows using familiar tools such as kubectl, git, and kustomize to manage policies. Kyverno policies can validate, mutate, and generate Kubernetes resources. The Kyverno CLI can be used to test policies and validate resources as part of a CI/CD pipeline. https://learn.nirmata.com/courses/kyverno-fundamentals-certification/ [Cybersecurity] CYBER THREAT INTELLIGENCE 101The arcX C

731778

5 days ago

lukas.kVeeam Vanguard

CSS Community Guidelines and new VUG leaders

Introducing Your New Leaders of the Veeam Cyber Security Space User Group! We’re thrilled to announce that Tobias (https://community.veeam.com/members/tobias-gregorius-533), Dipen (https://community.veeam.com/members/dips-505), and me, Lukas (https://community.veeam.com/members/lukas-k-19055), are stepping into the role of Leaders for the Veeam Cyber Security Space User Group! Our mission remains clear: to foster a collaborative space where Veeam enthusiasts and cybersecurity professionals can share knowledge, tackle challenges, and stay ahead of evolving threats. Meet the Team: Tobias: Based in Germany, Tobias Gregorius brings over 25 years of experience in IT, with a strong focus on IT security (10+ years), data center management, backup, and disaster recovery (10+ years). His expertise spans IT management, strategy, and architecture, helping organizations implement robust and efficient IT systems. Tobias shares practical insights on IT security, cloud technologies, and business cont

464

25 days ago

lukas.kVeeam Vanguard

Event Recap: Veeam Hardening Best Practices (March 19, 2025)

Dear community, Please find the recording of Wednesdays session “Veeam Hardening Best Practices” online: You also find the presentation as PDF attached, this includes the security VLAN blueprint I talked about during the presentation. Agenda: General measures Network Security Tiering Veeam Security Tools 2024 / 2025 Technical measures Veeam Hardened Repository Application Processing / Active Directory Windows Server hardening according to CIS guidelines Monitoring / Auditing Perspective Q&A session Since this was a request within our community I again like to thank @Madi.Cristil and @safiya for setting up the meeting, landing pages and sharing the recording. In case of questions, comments or request please feel free to reach out. Have a great weekend! Lukas

658

8 hours ago

Mohamed AliExperienced User

CVE-2025-23120 - A vulnerability allowing remote code execution (RCE) by authenticated domain users.

Hello Community, Latest security update (build number 12.3.1.1139) released from Veeam CVE-2025-23120 - CVSS 9.9 - KB4724 A vulnerability allowing remote code execution (RCE) by authenticated domain users. Severity: CriticalCVSS v3.1 Score: 9.9Source: Reported by Piotr Bazydlo of watchTowr. Note: This vulnerability only impacts domain-joined backup servers. Download URL: https://download2.veeam.com/VBR/v12/VeeamBackup&Replication_12.3.1.1139_20250315.iso MD5: 70E802E77F3FC109E85F8FA859F31950 SHA1: 308E6AE02474208A08418734598CFBA0E7AF82D0 There are additional features and resolved issues included in this latest update: https://www.veeam.com/kb4696

8587

4 days ago

lukas.kVeeam Vanguard

Update: Veeam Windows Hardening Script v1.1 - Win Server 2025 and Veeam ONE

Preface: As mentioned in the past, I have made it my mission to continuously develop my Veeam Windows Hardening script. To fulfill this commitment, I have now completed and released version 1.1 of the script. The changes compared to the previous version can be found in the change log below! Disclaimer: Important: I do not provide any guarantee that the script, which has been successfully tested by me, will run without errors in every environment. The script is intended solely to simplify and standardize hardening standards, which may not be suitable for every environment! Additionally, I do not guarantee the completeness of the tests! Requirements and procedure: The script is primarily designed for new installations! The server must not be a domain member Initial login and script execution must be performed with the built-in Administrator OS: Windows Server 2022 or 2025 Standard oder Datacenter Install Windows Server (as required). Install drivers (VMware Tools or vendor-specific drive

3165

4 days ago

lukas.kVeeam Vanguard

Securing VBR with Cisco Duo MFA (Windows)

First of all: Sorry for the resolution issues with some of the screenshots, this is because of different resolutions on my smartphone and my notebooks! Based on my Veeam Windows Hardening Script, there are various additional ways to further enhance the security of individual components—and, consequently, the overall security. As previously announced (e.g., at the Veeam User Group Meeting in Munich in November 2024), I would like to explore the possibility of implementing multi-factor authentication (MFA) at the Windows level. To this end, I have conducted several lab tests. The goal: In the first step, I want to test two different scenarios: • Securing RDP logins with MFA • Securing local logins with MFA From my professional experience, I have already worked with similar scenarios. At that time, customers opted for Cisco Duo due to its strong price-performance ratio. I want to emphasize that this is not a product endorsement, but I will focus my tests on the aforementioned solution bec

1084

7 days ago

sowardsjNew Here

Veeam B&R - Plugin choices during install/upgrades

Is there any plans to customize the Veeam installer to select what plugins you want to install? After doing installs/upgrades of Veeam B&R, I always need to go back and uninstall unnecessary plugins/services (i.e. AWS, Kasten, Google, Promox, etc.) that I do not use in my environment.

292

12 days ago

Mate0shNot a newbie anymore

CVE-2025-1094 PostgreSQL zero-day possible SQL Injection (CVSS: 8.1)

Hello everyone, I would like to inform you about a recent discovery made by security researchers from RAPID7. They have found a new zero-day vulnerability in PostgreSQL, which could be used against the product in this case not Veeam but BeyondTrust Remote Support products. The PostgreSQL team has already released a patch, you can download and install it.The patch also includes an update for other bugs that have been reported over the past few months. Veeam uses a PostgreSQL database so I thought it would be worth informing the community about finding and considering updating the database our backup tool uses, which is most often forgotten :) For technical purposes, Veeam 12.3 supports versions of PostgreSQL like below (SOURCE): PostgreSQL 14.x PostgreSQL 15.x (PostgreSQL 15.10.1 is included in the Veeam Backup & Replication 12.3 setup) DB UPDATE PROCEDURE: Upgrading the SQL Database Engine Software (Microsoft SQL Server or PostgreSQL) Used by Veeam Backup & Replication ARTICLE: Securit

19032

1 month ago

dipsVeeam Legend

Device Code Flow Authentication Vulnerability & How to Disable

Requirements: One of the following licences:- Azure Active Directory Premium P1 or P2- Microsoft 365 Business Premium- Microsoft 365 E3 or E5 What is Device Code Flow authentication? To put it simply, it is a way to authenticate a device that does not have the ability to present a full browser that can be used to enter credentials. For example, devices such as smart TVs that come with Apps. To sign into these Apps, it is possible to enter a code and then complete the authentication on another device. It is part of the OAuth 2.0 Device Authorisation Grant. RFC here: https://datatracker.ietf.org/doc/html/rfc8628 Abstract of the OAuth 2.0 Device Authorisation Grant Currently, Device Code Flow Authentication is increasingly being used in spear phishing campaigns to gain access to authorization tokens and pivot to initial access within a tenant. To mitigate this risk, it is recommended to disable Device Code Flow Authentication using Conditional Access Policies. How to using Conditional Acc

1000

1 month ago

lukas.kVeeam Vanguard

Recap: Securing VBR with Cisco Duo MFA (Windows)

Dear community, Since my latest content post went into spam multiple times and we weren’t able to figure out why (huge thank you to @Madi.Cristil for supporting me in this!) I would like to kind of re-post my newest lab test to harden Windows component servers with MFA. The post is now online but nobody got a mail notification about it so I would like to share the link with this. Here’s the Veeam content link on the Cyber Security Space: In case this is unappropriate please feel free to delete. FYI: I’m deeply sorry for the crappy screenshot resolutions. I’m not able to fully customize this in the forum. Please do not comment the content on this post, please use the initial post to comment to let Veeam delete this post after a certain amount of time. Best regards Lukas

282

1 month ago

lukas.kVeeam Vanguard

Veeam Windows Hardening Script - one-click hardening with CIS contents

The vision: For years, I have been deeply involved in security topics, hardening practices, and strategies to make these concepts more practical and accessible in real-world scenarios. The challenge often lies in the high barriers and effort required for implementation, which discourages many customers, IT administrators, and even managed service providers. In the realm of Disaster Recovery, I view security as one of the most critical building blocks. We live in an era where it’s no longer sufficient to simply have a backup; what truly matters is recoverability. To achieve this, it is essential to protect company backups as effectively as possible, ensuring resilience against potential threats. Veeam, in its recent versions, has introduced the Security & Compliance Analyzer, which provides an initial assessment of how an environment is set up. This tool goes beyond technical measures and examines the architecture itself, including adherence to the 3-2-1 rule, the presence of air gaps,

119825

1 month ago

Link StateVeeam Legend

[GUIDE] VBR 12. 1 How to pass all Security & Compliance Part 02

WDigest credentials caching should be disabled – Passed Web Proxy Auto-Discovery service (WinHttpAutoProxySvc) should be disabled - passed Set-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc -Name Start -Value 4 and CHECK Service (WinHttpAutoProxySvc) does not have the ability to be disabled. MS recommends not dusabling it could cause malfunctions, proceed as follows to disable WPAD without disabling the service. Microsoft Security Bulletin MS16-077 - Important | Microsoft Learn How to disable HTTP proxy features - Windows Server | Microsoft Learn The Web Proxy Auto-Discovery service (WinHttpAutoProxySvc) is a service in Windows that facilitates the discovery of proxy servers in an enterprise environment. In some security configurations, it might be recommended to disable this service, especially in scenarios where explicit proxy configuration is preferred over automatic discovery. Workarounds The following workarounds may be helpful in your situatio

2557923

1 month ago

Link StateVeeam Legend

Hardening Active Directory - GPO MSCT 1.0 CIS Benchmark - Poicy Analyser

Hello everyone,I wanted to share with you the securing of Active Directory from a Group Policy Object GPO point of view. =========================================================== As an overview I propose this link where we discuss AD Windows security in general. “Hardening MS Windows for NIST SP 800-171 Compliance” by the California NIST Manufacturing Extension Partnership (MEP) Version 28 Sep 2021 #13 in the Blue Cyber Education Series ========================================================== We will now proceed to analyse and implement hardening best practices for an Active Directory system via the "Microsoft Security Compliance Toolkit 1.0". ATTENTION: In order to implement the following Security GPOs, it is necessary to create a lab.Many security GPOs could compromise various features of the Domain\users\computers object and applications.It is strongly recommended to carefully analyse and test each GPO before bringing it into production. Link to the documentation & Download: htt

72395

1 month ago

Michael MelterVeeam Legend

The sum of all fears: Ransomware attacking S3 buckets

Most S3 offerings allow to leverage customer provided keys to encrypt data uploaded there (SSE-C). By calling the x-amz-server-side-encryption-customer-algorithm an encryption process inside your buckets can be initiated. Though also AES-256 will be used as the encryption standard, mind that this is not the same encrytion process that we should always have in place when targeting an S3 bucket from your backups. Encryption with VBR is already done on the job level. An attacker could thus encrypt your backup data another time - with a key he defines. Problem is: this “customer provided key” is only processed during encryption, but not stored inside the S3 stack. Only an HMAC is stored - which is not sufficient for a decryption. There already is a ransomware by the name of Codefinger which is leveraging that mechanism. An attacker with enough time can even circumvent immutability via object-lock by just waiting until everything in locked state is also already encrypted. So, what can be ta

25315

1 month ago

StabzOn the path to Greatness

CVE-2025-23114 Veeam Updater component (CVSS v3 : 9.0)

A critical vulnerability (CVE-2025-23114) was found in the Updater component, allowing potential Man-in-the-Middle attacks. This issue holds a CVSS v3.1 score of 9.0. Affected Products:- Veeam Backup for Salesforce—version 3.1 and older- Previous releases of Veeam Backup for Nutanix AHV, AWS, Microsoft Azure, Google Cloud, and others also noted, are impacted if not updated to the most recent unaffected versions. Solution and remediation:The vulnerability was resolved in Veeam Updater component version for each product. Checking for Updates using the built-in Veeam Updater to update the Veeam Updater component.Veeam strongly urge all customers to check their update history and ensure they are running Veeam Backup & Replication version 12.3 with updated appliances to remain secure. For detailed instructions on verifying your Veeam Updater component and taking necessary actions, please refer to https://www.veeam.com/kb4712

3291

1 month ago

dipsVeeam Legend

Stop 'New' Outlook Migration

Beginning January 2025, Microsoft will start forcing users from the Classic Outlook to the new app based Outlook. Those with the Microsoft 365 for Business Standard and Business Premium licenses are the only ones that are affected for now. To stop the forced migration for users to the ‘New’ Outlook, there are a variety of methods available. This can be achieved with the following; Group Policy Microsoft Intune Cloud Policy Registry Group Policy Location: User Configuration\Administrative Templates\Microsoft Outlook 2016\Outlook Options\Other\ Setting: Admin-Controlled Migration to New Outlook > Set to ‘Disabled’ This policy controls the ability of IT admins to initiate the migration of users from classic Outlook to new Outlook. If you enable this policy setting, IT admins will start the process to switch users from classic Outlook to new Outlook. If you disable this policy setting, the migration process to new Outlook will be stopped, keeping users on their current version of Outlook w

135413

2 months ago

CarySunVeeam Vanguard

Veeam Backup for Microsoft Azure Vulnerability (CVE-2025-23082)

Please update to Veeam Backup for Microsoft Azure 7.1.0.59 ASAP. https://www.veeam.com/kb4709

2563

2 months ago

dipsVeeam Legend

CVE-2024-55591 in FortiOS & FortiProxy (CVSS 9.6)

There has been some news doing the rounds about a Zero Day in Fortinet Products recently but information was scarce. It has now been confirmed that Fortinet FortiGate firewall devices with an Internet facing Management Interface are vulnerable to a zero-day vulnerability. The vulnerability allows a remote attacker to gain super-admin privileges. Once they gain those privileges, then they pretty much can do anything to the FortiGate. Affected versions: FortiOS 7.0 - 7.0.0 through 7.0.16 FortiProxy 7.0 - 7.0.0 through 7.0.19 FortiProxy 7.2 - 7.2.0 through 7.2.12 CVSSv3 score is 9.6 so pretty much up there. Needless to say, patch now and if possible restrict the management interface access over the Internet. Resources: https://arcticwolf.com/resources/blog/console-chaos-targets-fortinet-fortigate-firewalls/ https://thehackernews.com/2025/01/zero-day-vulnerability-suspected-in.html https://www.fortiguard.com/psirt/FG-IR-24-535

922

2 months ago

AndrePuliaVeeam Legend, Veeam Vanguard

Veeam Service Provider Console Vulnerabilities (CVE-2024-42448 | CVE-2024-42449) KB4679

Just letting you know the new VCE-2024-42448 and 42449 https://www.veeam.com/kb4679

21611

3 months ago

dipsVeeam Legend

NTDS.dit and Credential Dumping (Losing Domain control)

What Is 'ntds.dit'? The ‘ntds.dit’ file is the database used by Microsoft Active Directory Domain Services (AD DS). It stores: User Data: Includes account details, password hashes (e.g., NTLM), and security identifiers (SIDs). Schema Definitions: Information about object types and attributes used in the directory. Configuration Data: Domain structure, replication settings, and more. Replicated Data: Copies of objects synchronized across domain controllers. How Attackers gain access to the 'ntds.dit' file: 1. Exploiting Backups Domain controller backups often include the 'ntds.dit' file. Attackers may: Access Backups: If backups aren’t encrypted or are stored in unsecured locations. Compromise Backup Solutions: Vulnerabilities in backup systems or accounts can give attackers access. 2. Volume Shadow Copies The Volume Shadow Copy Service (VSS) creates snapshots of the system, including the 'ntds.dit' file. Common techniques include: Using VSSAdmin: Attackers can list and manipulate shado

2786

3 months ago

Iams3leVeeam Legend

How to change the default MachineAccountQuota to Zero

The MachineAccountQuota is an AD attribute that helps control the number of devices a non-administrative often referred to as a standard user can add to the domain. @dips also did a great job enlightening us about the security implication, and how we can monitor and mitigate it. Below is the link to his excellent blog post. The default value for MachineAccountQuota is 10, which any user within your organisation can add without requiring explicit permission from a Domain Administrator. If this is not your desired outcome, please read and acquaint yourself with the steps to fix this security concern. Many blog posts advocate for increasing this limit, discussing steps to do so. This reduces the need for IT involvement in adding PCs to the domain. However, this can lead to clutter in the directory if it is not managed properly. This is why Microsoft has set the default was implemented to prevent misuse. Determine the Default Machine Account Quota To determine the default value, kindly ru

5962

4 months ago

MarcoLuvisiInfluencer

Veeam Backup Enterprise Manager Vulnerability CVE-2024-40715

Release hotfix for: Veeam Backup Enterprise Manager Vulnerability(CVE-2024-40715) This vulnerability in Veeam Backup Enterprise Manager allows attackers to bypass the authentication while performing a Man-in-the-Middle (MITM) attack. Link to hotfix: https://www.veeam.com/kb4682

47010

4 months ago

dipsVeeam Legend

MachineAccountQuota (Rise of the Unwanted Machines)

MachineAccountQuota (Rise of the Unwanted Machines) To everyone attending the Veeam Summit, have a great one! 😊 I'm sad I'm missing it but hope to be there for the next one. Right, back to this vulnerability. By default, Active Directory has a setting enabled that allows a standard domain user to create up to 10 computer objects in the domain. This is due to the ‘ms-DS-MachineAccountQuota’ attribute in AD. Allowing standard users to join computer objects to the domain can be exploited by attackers to escalate privileges in a domain. When a new computer object is added, it is by default added to the Domain Computers Security group, which then inherits the privileges that have been assigned to that group. This can then be used to interact with the domain, user objects, and other systems and services in the domain. This can also be used as part of another compromise, KrbRelayUp, to perform privilege escalation. Mitigations - Prevent users from adding new devices to the domain by setting

1674

4 months ago

dipsVeeam Legend

Microsoft Digital Defense Report 2024

Microsoft has recently released the ‘Microsoft Digital Defense Report 2024’ that is worth a read. It is quite comprehensive but the key takeaway is that the threat landscape is ‘Complex, challenging, and increasingly dangerous’ Threat actors are becoming better prepared and resourced Nation states are starting to become more aggressive AI is going to be increasingly leveraged. Still a lot more to be done It can be found here: https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024

515

4 months ago

dipsVeeam Legend

Password Spraying (Don't get sprayed)

Almost the end of the weekend; no better time than to discuss Password Spraying attacks. So what is it? Well, as the name implies, it is a type of Cyberattack where an attacker tries commonly used passwords against many different accounts rather than target an individual account too many times. This helps to stay under the radar as well as avoiding the triggering of attack lockouts. The passwords can be come from publicly available 'wordlists', public credential dumps of compromised sites, or target the environment and use specific keywords. Additionally, to minimise attempts and detection, a list of usernames will be targeted and an attempt made to authenticate to each one using just a single password. If an organisation reuses passwords or has weak passwords in use, this can be a really effective method to break into an account and gain the privileges of the user. This access can then be used to move laterally across the environment or performing Kerberoasting attacks. Multi-factor a

10413

4 months ago

Forum|pagination.label 1 / 11

About this group

Looking for your launchpad for everything cyber security? Come join the Cyber Security Space to begin your mission to a more secure environment.

Join your crew-mates to share your learning journey, talk about the latest security events and issues, and share tips for making your environment more secure.

Leaders:

Dipen Kumar

Based in the UK with over 13+ years of experience in the IT industry. Currently working in the Financial Services as in Infrastructure Engineer but now focusing on Cybersecurity and all things related. A Veeam Legend since 2022 and Cyber Security Group Leader. Learning as I go along, and like best practices. “The Internet can be a scary place! Make sure there is a backup somewhere.

Tobias Gregorius

Based in Germany, Tobias Gregorius brings over 25 years of experience in IT, with a strong focus on IT security (10+ years), data center management, backup, and disaster recovery (10+ years). His expertise spans IT management, strategy, and architecture, helping organizations implement robust and efficient IT systems. Tobias shares practical insights on IT security, cloud technologies, and business continuity, offering valuable perspectives to support organizations in navigating today’s dynamic technological challenges.

Lukas Klostermann

Senior Consultant and Specialist for Backup & Recovery with over 8 years of experience in the IT Business. Currently working for Kramer & Crew GmbH in Germany with a strong focus on disaster recovery and hardening scenarios. A primary goal is to create standardized approaches to make IT security more practical and bring the idea of modern security to customers, partners and providers.

A VMCE, VMCA and Cyber Security Space Leader with experiance in vSphere, Hyper-V, storage design and Microsoft Azure.

"A "standalone" backup is no longer the primary goal from a modern perspective."