NetBackup and NetBackup Appliances Hardening Guide

Configuring isolated recovery environment (IRE)

Organizations can minimize ransom demands by using encryption and creating a stringent security perimeter. In addition, they need to isolate, analyze, and preserve a copy of data to ensure business continuity. IRE enables organizations to meet these needs and satisfy strict regulatory and retention requirements. Veritas customers can easily deploy an IRE using their existing Veritas NetBackup infrastructure as part of a multi-layered resiliency strategy.

NetBackup Flex Scale uses the Pull model to pull the replication request from the IRE domain through a specific window as defined in the IRE air gap schedule. By initiating a data transfer request from inside the IRE domain, there is better control over data flow to secure the environment further both logically and physically. You can determine the Service Lifecycle Policy (SLP) windows and configure the air-gapped schedule for maximum protection.

The NetBackup Flex Scale IRE solution optimizes data movement whereby the request to send data comes from the IRE side, the MSDP reverse connection. You can deploy another the tertiary copy of the backup images behind a firewall to an isolated environment without opening any inbound firewall ports to NetBackup. This keeps the environment secure, allowing a sandbox approach to perform malware scans or test recovery procedures before recovering at a larger scale. You can optionally add a physical air gap as an additional layer of protection. By empowering the destination environment to request the data from the source environment (by invitation only), it is possible to support 24x7 data movement while isolating the stored data from any potential threats.

The IRE solution also supports multiple configurations. Hence, you can have a single IRE domain for multiple production domains. Another key feature of this solution is that the IRE domain is not required to have the same configuration as your production domain. You can configure an IRE domain as per your requirements and use it to securely transfer backups from production to IRE.

The requirements to configure isolated recovery environment (IRE) in a Pull model are as follows:

For more information, refer to the NetBackup Deduplication Guide on SORT.