We use Veeam 10 to backup/restore vSphere VMs in a special secure zone consisting of several vlans isolated via DC firewalls. Everything is supposed to be encrypted from transit to at rest. Works fine and all. However, due to our segmented network we have to use the NBD protocol for restores. This achieves a max throughput of 10MB/sec, which is too slow for a real world scenario in which you have to restore a 1TB production machine within a reasonable time. I would like to internally propose the use of un-encrypted restores to achieve better throughput and be able to meet our RTO objectives.
Our Audit department are asking for proof/explanation of how Veeam ensures target data integrity to prevent man-in-the-middle attacks. They are worried that if an attacker was aware of the use of un-encrypted restores and has enough access to inject/replace data in the restore stream they could drop malicious code in the secure zone. I know, I know, purely theoretical in nature and not very realistic (if you have that type of access why would you bother with such an exotic and unlikely to success attack vector?) but that's not the point - you know how audit can be
I have read the admin guide and knowledge base and forums and the only useful reference to this topic I could find was wan_CRC - Data Block Verification (https://helpcenter.veeam.com/docs/backu ... ml?ver=110). However, this kb article is very explicit in that this mechanism is used by WAN acceleration. It does not mention at all if this is also performed for normal restores without WAN acceleration.
Now comes the question: Does Veeam B&R always make a checksum verification at the end of a full VM or disk restore? Or in other words, does Veeam guarantee that the restored VM is always identical to the VM in the backup repository? Is this documented somewhere I have overlooked?
Thanks a lot for taking the time folks!
