Discussions specific to tape backups
Post Reply
gary.miles
Novice
Posts: 3
Liked: never
Joined: Sep 19, 2018 10:15 am
Full Name: Gary Miles
Contact:

Airgap Backup ?

Post by gary.miles » Sep 19, 2018 10:23 am

Hi All,

I'm just after finding out how other people perform airgapped backups. We currently use Veeam to backup to local repositories and then offsite backups to take these offsite.

With the ransomware threat etc we are looking for a solution to airgap backups as well but I cant decide on a solution, do we use tape or maybe an airgap switch with a couple of storage arrays behind it. each week the airgap gets switched over etc ?

thanks in advance

ejenner
Expert
Posts: 403
Liked: 59 times
Joined: Mar 23, 2018 4:43 pm
Full Name: EJ
Location: London
Contact:

Re: Airgap Backup ?

Post by ejenner » Sep 19, 2018 1:58 pm

One suggestion is to use a different type of OS for a separate repository. So if you mostly use Windows for your repositories you can create a Linux repository to store a copy on as well. The theory behind this is that writers of malware or attacks on your network will find it difficult to jump platforms as the exploitation will be through some flaw or using files which won't be common to both. i.e. the attack you're trying to protect your data from is unlikely to be compatible with all kinds of OS.

pkelly_sts
Expert
Posts: 570
Liked: 62 times
Joined: Jun 13, 2013 10:08 am
Full Name: Paul Kelly
Contact:

Re: Airgap Backup ?

Post by pkelly_sts » Sep 19, 2018 2:08 pm

Depending on your budget you could use WORM tapes too, at least for some of the backup copies.

gary.miles
Novice
Posts: 3
Liked: never
Joined: Sep 19, 2018 10:15 am
Full Name: Gary Miles
Contact:

Re: Airgap Backup ?

Post by gary.miles » Sep 19, 2018 2:33 pm

Thanks for the responses.

We've ruled out the other OS idea as our backup servers are locked down already however as long as they are "on the network" we worry that given time worst case scenario they can still be got at.

Only will airgapped give us that peace of mind. WORM tapes are probably out of the loop as we need to reuse the media.

We currently backup 10's of TB of data so my worry with tapes is that it will be too slow, which is why we thought about the NAS & airgapped switch idea?

pkelly_sts
Expert
Posts: 570
Liked: 62 times
Joined: Jun 13, 2013 10:08 am
Full Name: Paul Kelly
Contact:

Re: Airgap Backup ?

Post by pkelly_sts » Sep 19, 2018 2:46 pm

Bear in mind that tape will always ever be a *copy* of a first-stage backup, you can't back up straight to tape even if you wanted to.

Tape also supports GFS/synthetic full backups too so daily backups can be quick (incremental) and it's only the synthetic fulls that take longer (generally at weekends).

Beware of NAS as without having an agent local to the storage, NAS backups can be very poor performing.

One compromise depending on how hands-off you need to be is that you can simply flip the write-protect tab on tapes as they fill up but you'd be reliant on people doing that, plus relient on them reversing it when the tape is due to be overwritten.

That leaves tapes in the library and available for restore, but you could also simply remove tapes & put them on the shelf/in a cupboard as dictated by your policy but, again, a hands-on process.

Finally one thing that helps with tape speed is having fast storage where the synthetic full maps are blocked out.

csydas
Expert
Posts: 193
Liked: 46 times
Joined: Jan 16, 2018 5:14 pm
Full Name: Harvey Carel
Contact:

Re: Airgap Backup ?

Post by csydas » Sep 19, 2018 5:53 pm

I'm not a fan of air gapped drives unless you have a very good retention/test method set up. I've worked with too many customers who thought it was just fine to toss an HDD into a safe and call it a day, only to find that years later when they needed to recover data, they plugged the drive in and it refused to spin up. I wouldn't even dare test an SSD in this scenario either.

Tape is a solid answer because at the end of the day, it has the history behind it to back the use case. Pop the tape in and be sure to eject the tapes after every write. It'll be slow (both write and read), but at the end of the day, would you rather spend a day restoring data to get your entire infra back, or start over from scratch?

Just read the best practices on Veeam Tape so you know what you're getting into. There aren't __too__ many gotchas but there are a few Veeam-isms to deal with, but it's nothing too bad. Just ask here on the forums or in a support ticket before you go all-in on a strategy.

skrause
Expert
Posts: 438
Liked: 91 times
Joined: Dec 08, 2014 2:58 pm
Full Name: Steve Krause
Contact:

Re: Airgap Backup ?

Post by skrause » Sep 20, 2018 5:45 pm

Tape is your friend for pretty much any airgap situation.
Steve Krause
Veeam Certified Architect

gary.miles
Novice
Posts: 3
Liked: never
Joined: Sep 19, 2018 10:15 am
Full Name: Gary Miles
Contact:

Re: Airgap Backup ?

Post by gary.miles » Sep 24, 2018 8:29 am

Thanks all, just one last thing, what do you think to using aws as a solution ?

csydas
Expert
Posts: 193
Liked: 46 times
Joined: Jan 16, 2018 5:14 pm
Full Name: Harvey Carel
Contact:

Re: Airgap Backup ?

Post by csydas » Sep 24, 2018 5:16 pm

Just be ready for the bill.

I'm always suspicious of Amazon, Google, and Microsoft, cause it's easy to get your data up to them, but it's hard to get it out. Sure, they're reliable for keeping the data, but I've seen those bills add up really fast. For regular backups, a misconfiguration can easily rack up a x*$1000 bill. With a VTL, it's usable, but again, you should just be sure you understand the costs you're getting into and check what your potential DR is going to cost you when you need to do it (cause you will eventually need to)

maryhollen
Lurker
Posts: 1
Liked: never
Joined: May 12, 2019 1:02 am
Full Name: Mary Hollen

Re: Airgap Backup ?

Post by maryhollen » May 12, 2019 1:13 am

Business located in tsunami evacuation zone: Air gap backups to rotating media, using CrystalDisk to check the integrity of each external disk before/during backup, have been very successful. I highly recommend air gaps (using a different external hard drive every week). It's a great a way of thumbing your nose at ransomware attacks, too.

How do you set the backup to make a full backup and delete the old backups when the media runs out of space? The control panel dialog is less than clear. Thank you.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests