Home Latest Feeds Technology News Veeam – Attack-Resistant Data Protection – ComputerTrends

Veeam – Attack-Resistant Data Protection – ComputerTrends

Veeam – Attack-Resistant Data Protection – ComputerTrends


Cyberattacks interrupt the operations of companies most often, yet only a third of them could restore their data in a short time, according to a recent survey by Veeam. To reduce security risks, the supplier has developed a zero trust data protection model.

The article was published in the February 14, 2024 issue of ComputerTrends magazine.

More than three-quarters of organizations were hit by at least one ransomware attack in the past year, the number one cause of downtime was a cyber security incident of this type or a similar one, stated Veeam Software in its report published in January (Data Protection Trends Report 2024). The supplier, known for its data protection and data recovery solutions, asked 1,200 IT and business leaders at the end of last year about the challenges experienced in the field, as well as their company’s data protection strategy.

More than three-quarters of respondents consider their company’s cyber defense capabilities to be lacking, and less than a third said they could restore their critical data in less than a week after even a minor attack. The vast majority of respondents (92 percent) will therefore further increase their data protection spending this year, and 88 percent of them also plan to introduce cloud-based BaaS or DRaaS services for at least some of the servers.

“Ransomware remains one of the biggest threats to business continuity,” said Dave Russell, Veeam’s vice president of corporate strategy, when the report was released. – Nowadays, most downtimes are caused by such incidents, and the defense against them also hinders efforts towards digital transformation. Although companies are increasing their defense spending, less than a third believe that they could quickly recover from even a minor attack. Our report this year therefore draws attention to the need for continuous cyber vigilance and the importance of all organizations building adequate protection and recovery capabilities.

Backup in a hybrid environment

In its report, Veeam also makes noteworthy findings concerning, among other things, the saving of containers, the rethinking of the backup strategy, and the opportunities inherent in labor market challenges.

Many organizations use containers, but don’t back up all of them – Containerization continues to take off, with 59 percent of companies already using the technology in production environments, and another 37 percent implementing it or planning to do so. However, only 25 percent of them use a backup solution that is specifically used for backing up containers, while the rest make do with saving one component of the environment – for example, storage spaces or the contents of databases. Unfortunately, neither method guarantees that applications and services can be restored after a crisis situation, or even after an incorrect data entry or misconfiguration.

2024 will be the year of those looking for a job outside their company – Almost half of those surveyed (47 percent) plan to look for a new job in the next 12 months, but do not envision the change within their current organization. In terms of data protection initiatives, this is a challenge for companies, but also an opportunity for them. The departure of experienced specialists in the field is always disadvantageous in view of the high level of exposure to attacks, but at the same time, labor market movements give organizations the opportunity to recruit fresh talent, with which they can support their modern workloads placed in the cloud – Microsoft 365, Kubernetes and other IaaS or PaaS environments – can also protect them better.

Backup needs to be reconsidered due to hybrid architectures – Similar to last year’s survey, the respondents highlighted reliability and the protection of cloud-based (IaaS and SaaS) workloads as the two most important aspects of choosing a corporate backup solution. However, this can be a problem for organizations that rely on older, more data center-centric data protection solutions. As they move their workloads from one platform to another or to the cloud, IT teams using traditional backup solutions that are poorly suited to protecting cloud environments find it difficult to maintain their SLAs, especially when introducing cloud-native application and container services.

A model for increasing resilience

Shortly before the report was published, Veeam announced its Zero Trust Data Resilience (ZTDR) model late last year, which can help organizations reduce data security risks and strengthen their overall cybersecurity resilience. ZTDR, developed jointly with Numberline Security, applies the principles of the zero trust approach that does not anticipate trust in data protection and recovery as an extension of the CISA maturity model (Cybersecurity and Infrastructure Security Agency Zero Trust Maturity Model). The essence of ZTDR is to separate backup management systems and their associated storage layers into separate zones in order to reduce the attack surface and limit the range of potential damage. An equally important element of the model is the immutable storage of backups, which prevents data from being modified even in the event of a ransomware attack.

The traditional and increasingly less efficient approach to security focused on the network edge is nowadays being replaced by zero trust-based cyber protection. However, many zero trust frameworks do not cover data backup and recovery systems, despite the fact that backup data is often the first target of ransomware and other types of attacks – according to last year’s Veeam privacy trends report, the majority (93 percent) of ransomware attacks, for example it was directed against the backup containers. To mitigate the resulting risks, Numberline and Veeam offer useful Zero Trust Data Resilience tools, including principles, architecture and a maturity model. With their help, organizations can close gaps in their security strategy and increase their resilience to threats by extending a trustless approach.

CISA’s zero trust maturity model is built on five pillars, one of which is data, with five key areas: data inventory management, data classification, and data availability, access, and encryption. To extend this model to the key areas of data protection and recovery, ZTDR incorporates principles such as least privilege, immutability, systems resilience, proactive authentication, and operational simplification. The application of the principles is supported by the ZTDR maturity model and reference architecture, including guidance on segmentation – the separation of backup software and storage – and on making the backup immutable.

– Our survey this year shows that 75 percent of ransomware attacks launched against backups are successful – he said Danny Allan, CTO of Veeam – For business continuity, it is essential that companies make their data immutable and follow good practice, which includes Zero Trust Data Resilience. Based on our ZTDR model, every organization can plan its way to achieving greater data security and reducing downtime. We have always been committed to this architectural approach, and we are also working with our storage vendor partners to implement an industry-leading zero trust model.

According to the Enterprise Strategy Group, the fight against increasingly intense ransomware and other cyber attacks requires a joint increase in the efficiency of IT and security with the help of frameworks such as zero trust.

– According to our latest market survey, 86 percent of companies consider the zero trust approach to be key to protecting against ransomware – he said Christophe Bertrand, director of ESG. – The importance of Zero Trust Data Resilience is fundamental from this point of view, since faster and more reliable data recovery increases the security resilience of the organization.

The Zero Trust Data Resilience model – along with the principles, recommended architecture and maturity model – is described in a white paper that can be downloaded for free from the Veeam website. In January of this year, the supplier also launched a new service called the Cyber ​​Secure Program, which, in addition to the target technology, also helps companies defend against ransomware attacks with expert support.



Please enter your comment!
Please enter your name here