Veeam ONE

Hi @jaceg23 - pretty much all you need to know is in the VONE User Guide:

https://helpcenter.veeam.com/docs/one/deployment/about.html?ver=120

I recommend installing VONE on its own server/VM.

I’d pay particular attention to the Deployment Planning/Prep section of the Guide:

https://helpcenter.veeam.com/docs/one/deployment/deployment_planning_preparation.html?ver=120

As well as Deployment Scenarios:

https://helpcenter.veeam.com/docs/one/deployment/deployment_planning_preparation.html?ver=120

And, Install Options:

https://helpcenter.veeam.com/docs/one/deployment/install_veeam_one.html?ver=120

@MicoolPaul when you say “Veeam ONE should sit outside of domain and any related trusts” can you elaborate on that more? 

Sure thing.

So, Veeam ONE is, as I mentioned previously, a monitoring & reporting platform. Veeam can trigger alarms to do with environmental performance, issues that are emerging, if it has detected ransomware etc.

If you are a malicious entity, you will want to silence the monitoring platform, to ‘blind’ your intended victim to the ongoing activities you will perform. So, regardless of whether you have a single production domain, or a dedicated management domain for admin activities, it is still best to leave Veeam ONE sitting alone as its own little island, secured & hardened as best possible, and observing everything going on around it.

I’ll make a hypothetical situation here: You might be thinking ‘well what can Veeam ONE really tell me that I don’t already know?’

Well, Veeam knows Veeam really well, as well as the infrastructure it interacts with. So in the security mindset still, Veeam ONE could tell me:

• Which backup jobs have been disabled (signs that someone is risking the organisation’s ability to recover from an incident
• Suspicious incremental backup size (signs that ransomware might’ve been deployed and we’ve seen an unusually high change rate as a result)
• Veeam Malware detection change tracking (signs that someone is reconfiguring my jobs to blind me to malicious activities taking place such as Dark Web data exfiltration
• Failed backup jobs (Risks to organisation’s ability to recover)
• vSphere: Potential Ransomware Activity (High CPU/Disk Write/Network over XYZ metrics could be an indication that malicious workloads are consuming host resources such as encrypting data)
• vSphere: Host Cluster Destroyed (Could be a malicious attempt at breaking the ESXi environment)

You get the idea, this is just a small subset and a particular focus, check out the predefined alarms section to get a greater idea of how Veeam ONE can help: Predefined Alarms - Veeam ONE Monitoring Guide