cancel
Showing results for 
Search instead for 
Did you mean: 

Would ramsomware affect a Netbackup with Data Domain using DDboost?

JoseGomez
Level 3

Hello,

According to Veeam its backups can be deleted if the backup repository is a CIFS (https://forums.veeam.com/veeam-backup-replication-f2/yes-ransomware-can-delete-your-veeam-backups-t4...)

It seems to me that the same situation could happen with NetBackup if we send backup images to a Data Domain using CIFS. My question is what would happen with NetBackup sending backup images to a Data Domain using DDboost (OST).

Thanks in advance,

6 REPLIES 6

quebek
Moderator
Moderator
   VIP    Certified

Hello

I find it hard that ransoware could affect NBU using DD with DDboost... As far as I recall there was no CIFS available from DD and NBU could 'talk' to it using only OST-plugin. That was the main reason for me to choose DDboots instead of CIFS/NFS mounted share. As to such share anyone with permission can enter and delete data - without NBU involvment... havign DDboost in place make me believe that only NBU was able to delete backup images.

Of course I do speak under correction as the ransomware coders are more and more cleaver....

Genericus
Moderator
Moderator
   VIP   

I have Data Domains - and this is one reason we still write to tape.

I have heard that dell/emc is coming out with some software so if you write to data domain within Netbackup the image will be protected until it's assigned expiration, only able to be removed earlier with a secured method.

(two factor? or requested to be deleted by user 1 and confrmed by user 2? - i do not know)

NetBackup 10.2.0.1 on Flex 5360, duplicating via SLP to Access 3350, duplicating via SLP to LTO8 in SL8500 via ACSLS

X2
Moderator
Moderator
   VIP   

From what I understand, the OST plugin (on the media server) does write to Data Domain but internally uses NFS. I need to find more literrature about this to back my claim though... we have not specified any NFS/CIFS on the DDs but I have seen NFS transfers.... more later when I have time.

quebek
Moderator
Moderator
   VIP    Certified

Hi

Having a copy on tape is always good ;)

About DD on today I received such ETA - please check if you are not affected as this works 'better than ransomware' ;) - even ddboost will not save you ;)

 

ETA 498457: Data Domain DD OS 6.0: File segments may be unexpectedly deleted during the DD OS cleaning cycle, which may result in data loss


Article Number 000498457

 

Genericus
Moderator
Moderator
   VIP   

OOPS ! 

ETA 498457: Data Domain DD OS 6.0: File segments may be unexpectedly deleted during the DD OS cleaning cycle, which may result in data loss

Gald I have not upgraded to 6.0 yet, there is no way I can NOT send data to my data domains during cleaning.

NetBackup 10.2.0.1 on Flex 5360, duplicating via SLP to Access 3350, duplicating via SLP to LTO8 in SL8500 via ACSLS

X2
Moderator
Moderator
   VIP   

@Genericusthanks for the ETA details. I have already disabled cleaning on my DDs and will upgrade to 6.0.1.20 next week.