ransomware veeam

Ransomware tips from VeeamON

I attended the Veeam Ransomware session at VeeanON.  I picked up some useful tips so thought I would share my notes from the session. Credit for all the information to Rick Vanover,Dave Kawula, Brett Hulin.

ransomware veeam

Background

  • Data is key to all businesses
  • Must protect data and therefore the business from threats including ransomware

Prevention

Three pronged approach, not just technical considerations:

  • Education of users and administrators
  • Backup and recovery implementation
  • Remediation plan

Attack methods

Ransomware attacks occur in three most common ways:

  • RDP compromise, number one method of ransomware attack
  • Email phishing, second most common attack method. Surprising I would have thought this was the most frequent
  • Software vulnerabilities

Veeam Data Labs

Allows testing patches and quick recovery

  • ON demand sand box – restore not directly into production for safety
  • Sure backup and sure replica – boot VM in virtual lab and test before re-introducing to production
  • Secure restore – Mount backup for AV scan before restore

Ultra-Resilient Backup

Safest option is to have an ultra-resilient backup.  This could be air gapped, immutable or offline. For example:

  • Tape
  • Immutable backups e.g. S3 – Backup onsite to performance tier then have policy tier to cloud storage which can be S3. Policy can be set for an immediate copy of data or an archive of the oldest data. Based on Scale Out Repositories
  • Veeam Cloud Connect + Insider protection. Insider Protection provides an additional data copy that can only be access with a call to support to make it visible

Brett Hulin General Tips

  • Establish a DR site. Cloud or physical
  • If possible run Veeam replication to this secondary site
  • Have your DR plan documented
  • Understand your recovery order
  • Involve multiple people
  • Consider licencing implications of being at fail-over site
  • Establish chain of command before an incident

Brett Recovery Tips

  • Shut down servers to prevent further infection
  • Consider when attack occurred and which backups and replicas are therefore clean
  • Recover servers without network and check with AV before re-enabling network
  • Recover infrastructure servers, e.g. AD first
  • Force password resets
  • Have multiple restore copies at recovery site. So can recover from different times
  • Have an air gapped backup e.g. tape

Other tips I picked up from the Veeam Ransomware guide at the Veeam resource library:

  • Veeam server ensure it has no internet access
  • Accounts as much separation as possible
  • Tight file permission on datastore shares
  • Veeam servers require 2FA for RDP access
  • Prepare early

Published by

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.