Disaster Recovery Procedure

[hirratas]

Hello

Are there documentation on how to a disaster recovery in a small business (as it is the case with us(.
Imagine having ransomware in the infrastructure and I have to buy new servers and build the infrastructure up from scratch.

I Think first thing to do would be to download B&R and install it on a new server and scan my immutable backup server so that I can restore it.
But it would be a benefit to use the Veeam Database, so I do not have to rescan the immutable backup server.

But everytime I backup the veeam server itself (which also hosts the veeam sql db) the backup fails because of error "Error: The operation is not allowed in the current state."
Do you have any recommendation for me about this, too?

Thanks a lot!

[Mildur]

Hi Hirratas

You don't have to back up the Veeam SQL DB. Just use the configuration backup and restore the configuration to your new Veeam Server.
Make sure to have an air gapped configuration backup available. It will not be immutable on the hardened repository.
https://helpcenter.veeam.com/docs/backu ... ml?ver=110

If you don't have the configuration backup, you can follow Hannes blog post to restore your VMs:
https://www.veeam.com/blog/restoring-in ... veeam.html

Thanks
Fabian

[hirratas]

Hi, Thanks, will look into that.

But what do you mean by air gaped?

That the hardened repo is in a different data centre?

[Mildur]

Air gapped means, it's not reachable from the VBR server (over network or direct attached). A disconnected USB Disk, Tape or RDX Drive.
Worst case scenario, your attacker deletes the configuration backup if they are reachable from the backup server.

The hardened repository must not be "air gapped". The backups of your vms and physical machines will be immutable.
But it cannot protect the configuration backup files. They won't be immutable.

It is not a big issue.
If you don't have the configuration backup, just use Hannes Blog Post to install a new VBR server and reconnect the hardened repository.