Introduction

With cyber threats growing in sophistication and the looming threat of ransomware attacks, we’re harnessing the power of AWS global infrastructure in conjunction with Veeam. Furthermore, the integration of AWS and Veeam enables organisations to implement a layered defence strategy. This includes leveraging AWS’s security features, such as identity and access management (IAM), network security, and encryption, alongside Veeam’s ransomware protection mechanisms, such as backup immutability and data integrity checks. This comprehensive approach not only strengthens cybersecurity defences but also ensures business continuity and minimises the potential impact of cyber incidents. It also ensures smooth backup and restoration processes across virtual, physical, NAS, and cloud-native environments.

The adoption of cloud-based backup storage has become standard practice in the industry due to its superior security and efficiency compared to local storage on hard drives. Veeam enables using AWS’s extensive infrastructure to deliver reliable, cost-effective, and flexible backup storage solutions with Amazon S3.

Why Veeam?

Even though there is a native backup tool in AWS called AWS Backup, Veeams offers three premier features:

  • A Scale-Out Backup Repository (SOBR) is a unified target for backup and copy jobs. It comprises a performance tier for fast access using locally hosted repositories and a capacity tier for long-term storage utilising Amazon S3 Glacier. You can read more about it here: https://helpcenter.veeam.com/docs/backup/vsphere/backup_repository_sobr.html?ver=120
  • Customers can opt to configure their capacity tier for Veeam backups to Amazon S3 by immediately copying backups after job completion or moving them from the performance tier once the backup chain is sealed and outside a defined operational restore window.
  • Veeam’s backup chain comprises full and incremental backups, with a chain deemed “sealed” upon completion of a new synthetic full backup; once inactive, Veeam validates and removes data blocks from the performance tier to Amazon S3, enabling seamless data recovery from S3 without administrator intervention during restoration.

Securing Your Backup With Immutable Backup

Before we start, I want to touch on Veeam’s mutable and immutable backups. This becomes a decisive factor in your strategy when managing your IT infrastructure down the line since you have considered your costs, retention periods, and the safety of your backup data.

Mutable backup refers to a type of backup where the data can be altered or modified after it has been backed up. In mutable backups, the data can be added, edited, or deleted without affecting the integrity of the backup itself. This means that even after the initial backup is created, subsequent changes to the data can be reflected in the backup without requiring a completely new backup process. This flexibility is particularly useful in environments where data is frequently updated or modified, as it allows for efficient and up-to-date backups without the need for constant full backups.

In 2023, MGM Resorts fell victim to a ransomware attack, which disrupted its daily operations and resulted in a financial loss of $100 million. Additionally, the company incurred less than $10 million in one-time expenses for risk remediation, legal fees, third-party advisory services, and incident response measures. According to the Merriam-Webster dictionary, “immutable” means incapable of or resistant to change. An immutable backup is where the stored data cannot be altered, deleted, or modified once backed up. In an immutable backup setup, the backup data remains unchanged over time. In MGM Resorts’ case, an immutable backup effectively mitigated the ransomware threat by allowing for a secure and immutable data restoration. 

Immutable backups are highly regarded for their security benefits, and the US Cybersecurity and Infrastructure Security Agency (CISA) recommends their use alongside encryption to mitigate cyberattack threats. Here are several well-known threats that immutable backups help to mitigate:

  • Ransomware – Ransomware is malware that locks and encrypts a victim’s data, files, devices or systems, rendering them inaccessible and unusable until the attacker receives a ransom payment.
  • Data corruption – Data corruption can happen for various reasons, such as hardware failures, software bugs, network errors, human errors, malicious attacks, or environmental factors.
  • Accidental human error – Incidents such as accidental deletion or misconfiguration.

In addition, immutable backups offer faster Recovery Time Objectives (RTOs) by eliminating the need to search for intact backups post-attack and providing multiple known-good Recovery Point Objectives (RPOs).

Two Important Factors To Consider

Immutable backups come with additional features, but there are a couple of cost-related charges to consider:

  • Immutable backups incur higher costs not due to storage size or S3 bucket configuration but primarily because of the increased frequency of API calls from Veeam to S3, which can be four to five times more frequent than mutable backups. These API calls can significantly contribute to expenses, with a million API calls equivalent to 1TB of data, underscoring the importance of considering these costs in your backup strategy.
  • With immutable backup, the AWS account associated with the S3 storage will be responsible for the duration of the object lock. For instance, if the S3 bucket has an object lock enabled for 7 years, the account owner will bear the storage costs for the entire 7-year period. Note that you can change the object lock configuration even after creating the bucket in the Veeam console. 

Backing Up To The Cloud Using AWS

S3: The Preferred Immutable Backup Storage

Veeam facilitates storing backups to an Amazon S3 bucket, Amazon’s cloud object storage solution. 

Amazon S3 Standard provides highly durable, available, and performant object storage optimised for frequently accessed data. It offers low latency, high throughput, and a 99.99% availability backed by a 99.9% SLA, making it the ideal solution for backup and restore tasks. 

Specific configuration adjustments are necessary to enable immutable backup. Initially, the S3 bucket must enable both S3 versioning and object lock. You cannot perform an immutable backup with Veeam without either enabled. Enable this feature when configuring the S3 bucket. Once an object is uploaded to the bucket, it becomes impossible to disable versioning and object lock.

Create an S3 bucket with object locked enabled

aws s3api create-bucket my-bucket –region ap-southeast-2 --object-lock-enabled-for-bucket

Enable S3 bucket versioning

aws s3api put–bucket–versioning —bucket my–bucket —versioning–configuration Status=Enabled

The following additional S3 actions are required when configuring a bucket policy for an immutable backup:

"s3:ListBucketVersions"
"s3:GetObjectVersion"
"s3:GetObjectRetention"
"s3:GetObjectLegalHold"
"s3:PutObjectRetention"
"s3:PutObjectLegalHold"
"s3:DeleteObjectVersion"

In addition, you want to restrict who can access this bucket. Thus, the bucket policy must cater to certain IAM users with certain permissions.

Note: Be careful with the bucket policy. Even with administrator access, you may be locked out of the S3 bucket.

Connect Veeam To S3 Using IAM User

Veeam allows users to establish a secure, direct connection to S3 via HTTPS protocol. Within the Veeam console, administrators can easily configure this connection by inputting their specific Access Key ID and Secret Access Key. 

Like the bucket policy above, you want to give the IAM user additional S3 actions that allow it to perform an immutable backup. 

Conclusion

While backups may not be the main focus of day-to-day operations, ensuring proper backup implementation is essential for effective IT infrastructure management. At Mantalus, we strongly advocate for implementing thorough backups to mitigate the diverse threats in today’s landscape. Many companies overlook the significance of backups until they encounter a cyberattack or accidental human error, highlighting the urgency of implementing comprehensive backup strategies to manage cyber threats and ransomware attacks effectively.