Security Blueprints

The environment described in this architecture is one main datacenter containing 5 PB of NAS data. The NAS environment contains 50 shares and 2 billion files. All backups will be targeted to Immutable Object Storage. The general-purpose proxies and gateways will be collocated on the same server hardware.

The environment described in this architecture consists of one primary data center containing a mixture of VMs and physical servers. A third-party backup solution currently protects the environment. Veeam Backup and Replication has been purchased and will replace the existing backup solution. In addition to Veeam Backup and Replication, block-based storage hardware has been purchased to hold the production backup archives and a replica of the backup archives at an off-site location.

The environment described in this architecture consists of one primary data center containing a mixture of VMs and physical servers. A third-party backup solution currently protects the environment. Veeam Backup and Replication has been purchased and will replace the existing backup solution.Veeam Backup and Replication will ultimately use all the existing backup storage target. To help with this, a small storage array has been acquired as temporary swing space to host Veeam Backup and Replication backup archives until enough storage space becomes available (i.e., the legacy backups age out of retention) on the existing backup target to host all Veeam Backup archives.

The environment described in this architecture is one main datacenter containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method. The Veeam Hardened repository will be on Dell PowerEdge R760xd2 servers.

The environment described in this architecture is a Veeam Backup for Google Cloud deployment with 1000 workloads to protect.  The protection scope includes Google Compute Engine(GCE) and CloudSQL.  All backups will be targeted to an object storage repository in Google Cloud Storage(GCS) with Standard Storage Class and archived to GCS with Archive Storage Class.

Updated - V12.1The environment described in this architecture focuses on a single, 1 TB database instance. Most environments have multiple database instances, across multiple servers that may range from a few gigabytes (GB) in size to multiple terabytes (TB). This scenario can be used as a baseline to deploy for those multiple database environments.

The environment described in this architecture is a Microsoft 365 (M365) deployment with 10,000 users.  Included within the protection scope is Mailboxes, Archive Mailboxes, and OneDrive for Business.  Additionally, 1,000 SharePoint Online sites and 1,000 Teams.  Total Space consumed in Microsoft 365 across the above applications is 100TB.  All backups will be targeted to an object storage repository in Azure and copied to Azure Archive storage using a backup copy job. Veeam Backup for Microsoft 365 will be installed on Azure VMs.

The environment described in this architecture is one main datacenter containing 1,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on a VM and will use the Virtual Appliance (hot add) backup method. The backup target will be servers attached to a Pure FlashArray//C 

The environment described in this architecture is one main datacenter containing 10,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on physical HPE DL380 servers (or similar)  and will use the Network Block Device (NBD) backup method. The Veeam Hardened repository will be on HPE Alletra 4140 servers.

The environment described in this architecture is one main datacenter containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on physical HPE DL380 servers (or similar) and will use the Network Block Device (NBD) backup method. The Veeam Hardened repository will be on HPE Alletra 4140 servers.

The environment described in this architecture is one main datacenter containing 1,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method. The Veeam hardened repository will be on HPE Alletra 4140 servers.

Updated 12.1The environment described in this architecture is one main datacenter containing 1,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a primary backup repository and copied to a secondary offsite location. Proxies are installed on a physical server and use the network transport (NBD) method. The backup target will be ObjectFirst Ootbi set for Immutability and accessed via Gateway servers.

The environment described in this architecture is one Regional Datacenter with 1000 VMs and 100 physical servers and a ROBO site containing 100 VMs and 10 physical servers. Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location secured with Veeam Cloud Connect for the Enterprise (VCCE).

The environment described in this architecture is one Regional Datacenter with 5000 VMs and 100 physical servers and a ROBO site containing 100 VMs and 10 physical servers. Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location secured with Veeam Cloud Connect for the Enterprise (VCCE).

Updated - V12.1The environment described in this architecture builds of the 1000 VMs “Single production datacenter to offsite datacenter” scenario. The local repositories are defined as the Performance Tier of a Scale-out Backup Repository (SOBR). The Capacity Tier is a “public-cloud” Object Store. This reference architecture covers capacity tier copy + move operations. It accounts for the potential concurrency of primary backup and offload operations by detailing additional required resources. Each VM and physical server has an average of 200 GB of used storage space (1000 VMs and 100 servers).

Updated - V12.1The environment described in this architecture is one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on physical servers and use the secure network transport (NBDSSL) method.  The backup repository is an ExaGrid appliance.

The environment described in this architecture is one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on a physical server and use the network transport (NBDSSL) method. The backup target will be servers attached to a Pure FlashArray//C.

The processes described in this architecture utilize the Veeam Data Platform Premium, adding value to existing security countermeasures.An Incident Response Plan (IRP) has been developed to facilitate a quick and systematic response to a cyber-attack or a data security incident. The IRP is part of a broader Disaster Recovery Plan (DRP) and covers the following response steps: preparation, detection and analysis, containment eradication and recovery, and post-incident activity.What is described here is purposefully focused on Veeam and assumes other counter-measures and processes have been implemented, for example, clear lines of communication and assigned responsibilities in the event of a breach.

The environment described is that of a Veeam Cloud Service Provider (VCSP) infrastructure providing data protection services for a tenant/customer workload. The VCSP utilizes the Veeam Service Provider Console (VSPC) solution to provide licensing, consumption monitoring, and reporting for the Veeam platform. The tenant is described as running 1 Veeam Backup & Replication server protecting up to 1,000 VMware/Hyper-V VMs and up to 9 Veeam Backup for Public Cloud Appliances protecting up to 270 VMs, for a total up to 1,270 VMs. The tenant also protects up to 10,000 M365 Users and less than 250 Veeam Backup Agents managed by VSPC.

Updated - V12.1The environment described in this architecture is three ROBO sites containing 100 VMs and ten physical servers. Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method.

The environment described in this architecture consists of one main data center containing 10,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of storage space. The proxy service is installed on physical servers and uses the Network Block Device (NBDSSL) transport method. All backups will be targeted to a local primary backup SAN repository and copied to a secondary offsite location.

The environment described in this architecture is one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of used storage space. All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on a physical server and use the network transport (NBD) method. The backup target will be servers with a Hitachi Vantara VSP SAN Attached array.

Updated - V12.1The environment described in this architecture consists of one main data center containing 5,000 VMs and 100 physical servers. Each VM and physical server has an average of 200 GB of storage space. The proxies are physical servers using the Network Block Device (NBDSSL) mode. All backups will be targeted to a local primary backup SAN repository and copied to a secondary offsite location.

The environment described in this architecture consists of a main datacenter with a single Kubernetes cluster running Red Hat OpenShift Container Platform with multiple application namespaces on Azure Cloud Computing services. All local snapshots will be exported to an immutable backup repository to protect against deletion or encryption attacks. Additionally, backups are imported onto a standby cluster for disaster recovery.

The environment described in this architecture is one main datacenter containing 1000 VMS and 100 physical servers.  Each VM and physical server has an average of 200 GB of used storage space.  All backups will be targeted to a local primary backup repository and copied to a secondary offsite location. Proxies are installed on VMs and use the virtual appliance (hotadd) backup method. The backup target will be a server with an attached SAN array.