• EN

Replies posted by JustVeeamUser

15 Comments

Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

I would like to see more specifics on why someone chose not just physical tape over a VTL for security reasons, which can more obvious, but instances of choosing a Physical Tape Library over a Virtual Tape Library. In the Latter the gap in security near evaporates or is eliminated. You would still need to protect a PTL in the general same ways as a VTL, they get access to it, then “tape” media becomes pointless without additional steps (WORM, immutability, encryption, etc.)If you went PTL route, but are not physically taking out the most recently wrote tape every time, what product/setting/technology are you using that ensures someone can’t just gain access to the management easily gain access to that tape?

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

Thanks Scott. Seems like my thinking isn’t too far off and it seems we agree there is a difference in eject versus non-ejecting context, correct me if I am wrong. I just wanted to make sure others who might come by this didn’t not have a tldr; scenario and just thought the clear answer was physical tape.We are in the mist of implementing something new ourselves and I was thinking of kickstarting it off for free by repurposing hardware and using QuadStor since it is supported by Veeam. This would fill a gap in our Backup Program. Then next year decide to upgrade the hardware and keep VTL or switch to something else (e.g. PTL w/or w/out ejecting) based on the previous year’s worth of analysis. As part of the first thoughts of this process, I was looking at ways to prevent manual intervention, to increase ease of adoption, willingness of staff and reduce human error (e.g. oops, forgot to put a new tape in), but yet still increase security a considerable amount more than doing nothing. It

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

@JMeixner Assuming just the context of ransomware protection and not some other DR situation (fire/floor/etc.), do you have anything fancy that ejects it into a bucket automatically or anything and someone just pops it back in at a certain cycle? How do you handle the tape long term? Do you test restore it once every 1/3/5/10/etc years to ensure it will work, or do you do something else like just keep multiple copies and hope they don’t all fail? Not saying disk and VTL would be better in this regards, it would arguably be worse, just trying to get all data points. I only had to mess with tape for a couple years about 6-8 years ago and we had constant issues with reliability, as far as errors restoring/backing up goes.

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

No I was just thinking something like it auto ejects in a tub, that way the following day’s isn’t blocked, or if the tape drive was specifically made where the mechanism was strong enough for 1 tape to push another out of the way. Then for putting it back it, someone does put it back in manually, but it would be nice if they had a grace period of a couple of days. That way on the weekend for example, no one has to come into the datacenter. I haven’t ever used a tape library myself, just 1 tape drive, so I don’t know if your standard tape library, like a Dell ml3 would be able to give you a grace period for refill. If anyone could give me a brand and example of that, then that would be nice. This is probably the main reason I am steering away from a physical tape library, it’s got to be easy to use so the effectiveness of the plan is high. 

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

I don’t see how the “ActiveVault” is any different from the concept of VTL. Based on watching their video on how ActiveVault works, at the end they indicate an Administrator can go into the software and move it back out, that isn’t air-gapped. Their “air-gapped” claim is a marketing gimic. While it may be virtually air-gapped from the application (e.g. Veeam), a malicious actor can still get access to it via the tape library admin console and cause harm.As for the Ransom Block, this is also a gimic. It is literally just ejection, nothing special, however it seems it ejects multiple drives at once, the whole magazine, so now you have to push it back in every day to handle the next day’s backup. Unless you could leave it in the ejected state, and newly backed up tapes can still be offloaded to that “partially ejected” magazine. I assume since they don’t mention that you can keep adding to the “partially ejected" magazine that you can’t, which makes it a general pointless feature in my op

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

Thanks @Scott for the list.@dips I wasn’t exactly thinking a drop of 6 ft or anything. I was thinking more of a an inch drop (I thought tapes were less susceptible to damage because there is nothing mechanical in them?) or even rig a slide to a bucket (blanket lined !!! hah) to reduce or eliminate any possible damage (e.g. like a tray a cartridge at an incline and it slowly filles up). 

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

@Scott Not sure how long it has been since you have worked with IBM, but do you know if they have the Input Only and Output Only functions for cartridges? Is that a thing? Is that what you were essentially alluding to on the TS4500’s when mention dual I/O stations? I looked here and it doesn’t imply that, unless I am reading wrong:https://www.ibm.com/docs/en/ts4500-tape-library?topic=library-io-stations I am looking for something that is a physical separation feature, where once written to it is moved, not fully ejected, into a magazine to get taken out a later time. That could be after 1 backup, or after 3 or 4, does not really matter as long as you unloaded the “used/written to” magazine/cartridge before it fills up.

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

I’m still catching up on this thread so apologies if you have already motioned it. Have you looked into, say Amazon Storage Gateway with Virtual Tapes?  If you are talking to me and not OP, we have not. Admin will not let us go cloud no matter the benefit. So it is on-prem Tape Library for us as an option only. I am also trying to look at On-Prem S3 Object storage or Veeam SOBR, but running into lack on good info on the former and still researching the latter and how it can help us.New question relating to all this, since this thread is poppin’ as the ids would say and we see to have a few Veeam experts in here (not me), as VTL can sometimes enable immutability…..if you consider tape that is ejected 100% secure (yes I know), what % secure comparatively would you consider a WORM tape left in the tape library and what % secure would you consider the general idea of data being stored on an immutable store like AWS, S3 compatible, Linux Hardened Repo, SOBR Veeam Archive Tier setup with on

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

@JMeixner “And a VTL is mostly software, so you can delete either the tapes or the whole VTL.” To counter this, based on the OP and others, me included, looking at VTL, not ejecting tape physically is clearly something OP and other might have considered and are OK with. So with that in mind, I am not sure how VTL is worse than PTL, as a malicious actor could gain access to the tape library and destroy the environment via wiping tapes, configs, flashing the firmware of the library hardware maliciously, etc.@Stabz Are you all considering VTL and looking at accepting the fact that there won’t be a true air-gap? Or are you fresh in your research and you did not know this yet? Have you found any information here or elsewhere to help you all make a decision yet?

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

Checkout this doozy of a claim I just came across from Starwind Software, located (“https://www.starwindsoftware.com/features#vtl”):“Ransomware can't encrypt tape libraries”

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

@JMeixner Your 2nd paragraph sums it up pretty much what my understanding it:“My understanding of a VTL is a software construct on a normal server which behaves logically as a tape library and stores data in files which are written sequentially like a tape.”I am not talking about any sort of feature labeled “VTL” that a product uses on top of physical tape hardware. As far as Starwinds claim, couldn’t they just encrypt the data on a non-worm tape by forcing rotation and encrypt each tape 1 at a time? Unless you were stating it’s technically correct they can’t encrypt the “tape library” itself, but they can encrypt the tapes/data on tapes.

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

With a VTL supposedly once a “virtual tape” is written to it can be moved to a partition that the application (Veeam, etc.) cannot see/doesn’t have access to. So if you lock down the host-based firewall on the VTL host server and locked down the network-based firewall to where only the application (Veeam, etc.) can get to it on the required ports…..which means you have no remote access to the management of the VTL, wouldn’t the only way they could theoretically get to it is by a vulnerability in the OS that allows them to traverse from an allowed partition to a non-allowed? Sort of like putting the VTL server in the LAN and everything else in the DMZ?This is standard setup of websites, with webservers in the DMZ and DBs in the LAN/non-DMZ. Now imagine you go a step further and routinely the data in the DB is archived to another DB in the same SQL server Instance. If you set the user of the web application to only allow it access to that live DB and not the archive DB, wouldn’t the only

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

Do you all know of a cheap object storage option for non-profits that pretty much have no budget but have about a 5TB/day of backups (If Full daily backups to tape) and management doesn’t want to use cloud?

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

Minimizing the amount of tapes needed to restore is the reason for the daily full. I already don’t trust tape based on past experience and what I am reading online about how much you have to double-check it is corrupt-free (routine checks, etc.), so I don’t want to worry about multiple tapes. One last question about VTL to dissuade/persuade the use of it, and this is backed by CISSP background knowledge and the fact that I have zero trust about any technology innately, does anyone have a link/docs to prove you can lock down a physical tape library more than a virtual tape library? Otherwise just saying that tape is secure is like saying fax is secure. For example, you can install Endpoint Protection on CentOS that QuadStor sits on, but most physical tape libraries don’t have an OS you can do that with, they are a proprietary OEM solution. Since you do have to consider that a malicious actor can gain access to your physical tape library system and screw up, in various ways, your backups

51
JMeixner
1 year ago
Stabz
StabzVeeam Legend
posted in Discussion Boards

Are you using Veeam & VTL?

@JMeixner I saw that, and I am looking into minIO, but my question was separate and trying to tie back to the original OP question of VTL, just a more security specific, about controls, question this time.

51
JMeixner
1 year ago

Badge winners

Show all badges
Terms & Conditions