Security Blueprints

The environment described in this architecture is one main datacenter containing 1,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method. The Veeam hardened repository will be on HPE Alletra 4140 servers.

Updated 12.1The environment described in this architecture is one main datacenter containing 1,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a primary backup repository and copied to a secondary offsite location. Proxies are installed on a physical server and use the network transport (NBD) method. The backup target will be ObjectFirst Ootbi set for Immutability and accessed via Gateway servers.

The environment described in this architecture is one Regional Datacenter with 1000 VMs and 100 physical servers and a ROBO site containing 100 VMs and 10 physical servers. Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location secured with Veeam Cloud Connect for the Enterprise (VCCE).

The environment described in this architecture is one Regional Datacenter with 5000 VMs and 100 physical servers and a ROBO site containing 100 VMs and 10 physical servers. Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location secured with Veeam Cloud Connect for the Enterprise (VCCE).

Updated - V12.1The environment described in this architecture builds of the 1000 VMs “Single production datacenter to offsite datacenter” scenario. The local repositories are defined as the Performance Tier of a Scale-out Backup Repository (SOBR). The Capacity Tier is a “public-cloud” Object Store. This reference architecture covers capacity tier copy + move operations. It accounts for the potential concurrency of primary backup and offload operations by detailing additional required resources. Each VM and physical server has an average of 200 GB of used storage space (1000 VMs and 100 servers).

Updated - V12.1The environment described in this architecture is one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on physical servers and use the secure network transport (NBDSSL) method.  The backup repository is an

The environment described in this architecture is one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on a physical server and use the network transport (NBDSSL) method. The backup target will be servers attached to a Pure FlashArray//C.

The processes described in this architecture utilize the Veeam Data Platform Premium, adding value to existing security countermeasures.An Incident Response Plan (IRP) has been developed to facilitate a quick and systematic response to a cyber-attack or a data security incident. The IRP is part of a broader Disaster Recovery Plan (DRP) and covers the following response steps: preparation, detection and analysis, containment eradication and recovery, and post-incident activity.What is described here is purposefully focused on Veeam and assumes other counter-measures and processes have been implemented, for example, clear lines of communication and assigned responsibilities in the event of a breach.

The environment described is that of a Veeam Cloud Service Provider (VCSP) infrastructure providing data protection services for a tenant/customer workload. The VCSP utilizes the Veeam Service Provider Console (VSPC) solution to provide licensing, consumption monitoring, and reporting for the Veeam platform. The tenant is described as running 1 Veeam Backup & Replication server protecting up to 1,000 VMware/Hyper-V VMs and up to 9 Veeam Backup for Public Cloud Appliances protecting up to 270 VMs, for a total up to 1,270 VMs. The tenant also protects up to 10,000 M365 Users and less than 250 Veeam Backup Agents managed by VSPC.

Updated - V12.1The environment described in this architecture is three ROBO sites containing 100 VMs and ten physical servers. Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method.

The environment described in this architecture consists of one main data center containing 10,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of storage space. The proxy service is installed on physical servers and uses the Network Block Device (NBDSSL) transport method. All backups will be targeted to a local primary backup SAN repository and copied to a secondary offsite location.

The environment described in this architecture is one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on a physical server and use the network transport (NBD) method. The backup target will be servers with a Hitachi Vantara VSP SAN Attached array.

Updated - V12.1The environment described in this architecture consists of one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of storage space. The proxies are physical servers using the Network Block Device (NBDSSL) mode. All backups will be targeted to a local primary backup SAN repository and copied to a secondary offsite location.

The environment described in this architecture consists of a main datacenter with a single Kubernetes cluster running Red Hat OpenShift Container Platform with multiple application namespaces on Azure Cloud Computing services. All local snapshots will be exported to an immutable backup repository to protect against deletion or encryption attacks. Additionally, backups are imported onto a standby cluster for disaster recovery.

The environment described in this architecture is one main datacenter containing 1000 VMS and 100 physical servers.  Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method. The backup target will be a server with an attached SAN array.

The processes described in this architecture utilize the Veeam Data Platform Premium and its backup scan capability using Yara rules to find classified data stored in an unclassified backup archive system. The ”Scan Backup” feature uses a customized Yara rule to find files in a backup archive and mark the affected archive as infected. These marked backup archives can then be sanitized. Remediation would align with the agency policy and may include sanitization, relocation of media, or reclassification.

Federal hardening guideThe environment described in this architecture is one primary data center containing 1,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method.

Updated - V12.1The environment described in this architecture is one main data center containing 1,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository. Copies of these backups will be stored on magnetic tape media. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method.

Updated - V12.1The environment described in this architecture is a main datacenter containing 10,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on physical servers and use the network transport (NBD) method.

The environment described in this architecture is one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on physical servers and use the network transport (NBD) method.

The environment described in this architecture is a Veeam Hardened Repository that contains Windows VM backups and Veeam Agent backups. The backups need to be scanned for malware and/or sensitive content using anti-virus and YARA rules during restore operations or manually via any of the following methods: Instant Recovery, entire VM restore, virtual disk restore, disk export or a restore to AWS EC2, Azure, or Google Compute Engine (GCE).

The environment described in this architecture is a Microsoft 365 deployment with 2000 users.Veeam One will provide monitoring, alerting, and telemetry metrics for the Veeam Backup for M365 (VB365) environment installed in Microsoft Azure. The Veeam ONE database will be hosted on a Microsoft SQL Standard Server.

Updated - 12.1The environment described in this architecture is one EPIC ODB Caché 25TB production database. Backups will be performed from a “backup host” where clones of the quiesced database production LUNs have been presented and exposed as NFS shares. Backups will be targeted to a primary backup repository and copied to a secondary offsite location. Proxies are installed on a physical server and use the network transport (NBD) method. The backup target will be Veeam Hardened Repositories set for Immutability.

The environment described in this architecture is one primary data center containing 5000 protected VMs and 100 protected physical servers. Veeam One will provide monitoring, alerting, and telemetry metrics for the Veeam Backup and Replication environment. The Veeam ONE database will be hosted on a Microsoft SQL Standard Server.

The environment described in this architecture shows a company with 3 Salesforce ORGs (2 production ORG and 1 sandbox) that need to be protected. The protection scope includes all data, metadata, and files. The total space consumed across the 3 ORGs is 300GB of data and 300GB of file storage.