Cloud data management vendor Veeam Software has introduced Zero Trust Data Resilience (ZTDR), a model to help organisations reduce the risk of growing data security threats and improve their overall resilience.
Developed in collaboration with zero trust expert Jason Garbis of Numberline Security, ZTDR applies zero trust principles to backup and recovery as an extension to the Cybersecurity & Infrastructure Security Agency (CISA) Zero Trust Maturity Model.
Essential to ZTDR is the separation of backup management systems and their storage tiers into distinct resilience zones, to reduce the attack surface and limit the potential blast radius from breaches; and immutable backup storage, to ensure that data cannot be modified even in the event of a ransomware attack.
Veeam says modern, effective security is based on zero trust, replacing the increasingly ineffective perimeter-based security approach. Yet, it points out, "most" zero trust frameworks do not include the security of data backup and recovery systems, despite the fact backup data is often the primary target of malicious actors in both ransomware and data exfiltration attacks.
The annual Veeam Data Protection Trends Report 2023 found 93% of ransomware attacks are targeting backup repositories.
“Backup infrastructure by its nature has a large attack surface, because it must have read and write access to production, spanning virtually all enterprise applications and data sources, both on-premise and in the cloud,” said Jason Garbis, founder at Numberline Security.
“To reduce that risk, Numberline and Veeam are proposing practical Zero Trust Data Resilience tools, including core principles, an architecture, and a maturity model. Our goal is to help organisations fill a gap in their security strategy by extending zero trust to backup and recovery to achieve greater cyber resilience.”
"Our research shows that 75% of ransomware attacks on backups are successful,” added Danny Allan, CTO at Veeam. “To keep businesses running, it’s essential to ensure data immutability and to follow best practices like Zero Trust Data Resilience (ZDTR).
"While Veeam has always been committed to this architectural approach, we are working with storage partners to implement an industry-leading zero trust model."
