Encrypted Offsite Backup Files

[larry]

mmartin19 I am also in the financial industry and using true crypt pass the exam. Been using on disks for years. One side effect is you can control which admin's can even mount a truecrypt drive to do a restore. Veeam admin can backup but not mount the offsite backups.

[mmartin19]

It's not going to be released in the next couple of months, if this is what you are asking. So if you have to have the encryption now, you need to implement some workaround. Thanks!

That's what I was looking for as a time frame, thanks. I still hope it's sooner rather than later.

[leehardy]

I've heard Veeam 8, Q3 release is targeted to support this. Can anyone confirm if this is actually correct?

[Gostev]

We have not made any official announcements regarding the next version functionality, so anything you hear about the next version is rumors. We will only announce any v8 functionality publicly only when we can be sure it is going to make it into the release.

[leehardy]

Thankyou Gostev for the confirmation

[tsukraw]

So in this weeks Community Forum Digest by GOSTEV at the bottom he talked about encryption:
"This problem with encryption got to be a very common issue - and yet, surprisingly, it is still not addressed by any vendor in over 50 years of software backup industry > Recover Encrypted Backup Exec data, without Encryption Key? Every backup software I saw will, at the very best, approach this issue by giving you a warning when you enable encryption, saying that you are on your own if you lose that password, and that their support will not be able to help. Unfortunately, it happens quite often that passwords (or people who set them) are lost. And when this happens, you just throw your backups away because "it would take from now until near the heat death of the universe to crack [AES-256] using the computational power available to most IT shops". This is a perfect example that even most basic and standard features like encryption still have lots of space left for innovation. Here comes Veeam!"

The Comment "Here Comes Veeam" is that a hint that a upcoming veeam release is going to have some function of encryption?
We have had countless customers who were ready to embrace the copy to tape functions of veeam only to be disappointed that was no encryption for this offsite media.
It would be a well appreciated addition!!

[EdwardsCP]

I also just read that quick note from Gostev. My concern is that the encryption "issue" that is discussed is not really a technical problem at all. Encryption Keys should be private and only available to the person(s) that create them (and whomever they share those keys with). I'm all for innovation and making improvements where they are needed, but I hope I'm taking what Gostev said too literally and there isn't an implication that Veeam plans to build in a way for tech support to recover the keys.

[cparker4486]

but I hope I'm taking what Gostev said too literally and there isn't an implication that Veeam plans to build in a way for tech support to recover the keys.

I'm with you on that. If they do intend to escrow the key(s) then I hope they make it something that can be disabled (the "escrowing" of keys that is.)

[Gostev]

The Comment "Here Comes Veeam" is that a hint that a upcoming veeam release is going to have some function of encryption?
We have had countless customers who were ready to embrace the copy to tape functions of veeam only to be disappointed that was no encryption for this offsite media.
It would be a well appreciated addition!!

Yes, we have officially announced this functionality couple of weeks ago. Scroll down to Data Loss Avoidance on this page > Veeam Availability Suite v8

build in a way for tech support to recover the keys

If they do intend to escrow the key(s)

No and No. But Yes, you will certainly be able to disable this functionality, if so desired

It's more like this: you will be able to recover the backup even without knowing the password. This sounds insane, I know. But let me just tell you that I have presented the architecture 4 times to 4 different and very technical crowds last month (over 100 geeks collectively), and I have not heard a single real objection. Not even from Tom Sightler

[EdwardsCP]

It's more like this: you will be able to recover the backup even without knowing the password. This sounds insane, I know. But let me just tell you that I have presented the architecture 4 times to 4 different and very technical crowds last month (over 100 geeks collectively), and I have not heard a single real objection. Not even from Tom Sightler

It certainly does sound insane, but intriguing at the same time. I can't wait for an opportunity to hear more!

[Yuki]

My guess is that there are multiple keys/passwords. One for backup and restore and one just for restore for example.

Alternatively, having a source VM may serve as a key for backup file level or full VM restore if password is not available.

Of course i'm just guessing here, it's always good fun.

[Gostev]

We will have pretty detailed blog post out later this week

[skanx]

Hello,

Sorry to wake up this old thread, but I have a question I can't seem to find the answer to anywhere.
Will the encryption feature be supported on Veeam Essentials, and on which editions? Standard, Enterprise and/or Enterprise Plus?

Regards,
Nicolas

[Vitaliy S.]

The feature list for all Veeam B&R editions will be available closer to the release date. We are unable to comment on it at this time, as the current plans may change.

[Gostev]

Just to add to that, since our encryption implementation has some pretty advanced features, it would be a safe bet to say that not all features will be available in all editions. But, I am pretty sure that at least basic encryption will be included in the Standard edition, because it is a core feature that is "expected" by our prospects.

[mfields]

It talks about tape encryption in the below blog post, but not in detail. Basically, my local repository of backups does not need to be encrypted but the backups on tape that rotate offsite do.

https://www.veeam.com/blog/encryption-c ... te-v8.html

Will there be an "encryption" option under the Veeam "Tape Job" type? And will it apply to both "Files to Tape" and "Backups to Tape"?

[foggy]

Yes, there will be an ability to encrypt files offloaded to tapes by both types of jobs (although you have the ability to do that even with v7, using hardware-based encryption).

[mfields]

Thanks foggy. I would like to utilize the new native Veeam software based encryption for offsite tapes only, which I believe is not available yet. Hardware encryption is not supported (or should I say purchased) for my tape library.

I would rather just accomplish it in Veeam.

[veremin]

I would like to utilize the new native Veeam software based encryption for offsite tapes only, which I believe is not available yet.

According to the plan, both features (support for remote tape libraries and native software encryption) will be available in the upcoming version. So, stay tuned. Thanks.

[kewnev]

Considering this thread hasn't been used in a while I was unsure whether to continue with this thread or start a new one. Apologies if I should have started a new one!

Just have a question about the Encryption feature in the upcoming Veeam B&R v8. I've looked around and I can't seem to find whether or not it will be included in the Standard Edition, or will I require Enterprise?

Thanks.

[foggy]

Yes, Standard edition includes encryption functionality.