(upbeat intro music)
- Hi everyone, I'm Utsav.
I'm a product manager at Azure BCDR
and today we're going to talk about how Azure BCDR
can help you protect yourself better
against various threats like ransomware attacks.
But before we get there, let's take a look
at why do you need BCDR in the first place?
So apart from various traditional factors
that require you to have a BCDR strategy
there are newer challenges that we need to address nowadays.
With rapidly growing data estates, it is important
that your BCDR strategy is able to scale accordingly.
The world is witnessing an increased number
of cyber threats that have also, unfortunately
become extremely sophisticated with time.
And lastly, your organizations might have several internal
and external compliance requirements to meet.
As a result of all these you would also see
various international standards like
NIST and CIS recommending
that you have a robust BCDR strategy in place,
and this is where Azure BCDR can help.
while Azure BCDR includes Azure Backup
and Azure Site Recovery, in this particular video,
we're going to talk about Azure backup
and the security capabilities it offers.
And these can help you protect yourself better
from the threat that we talked about.
To recap, Azure Backup is a built-in cloud service
that helps you protect your workloads
in a simple, secure and cost effective manner.
Azure backup helps you protect a variety
of workloads running both on premises and
in the cloud, and also provides you various tools
that can help you manage your backup better.
Now, backups are considered to be your last line
of difference, so it's absolutely necessary to make sure
that your backups are well protected
against any unauthorized accesses, data exfiltration
or malicious actors trying to tamper
and encrypt your backups.
The good part is
that Azure Backup provides you a variety
of out-of-the-work security capabilities
that can help you protect from all
of these threats systematically and effectively.
And here's a quick view of how it helps you do that.
By giving you more control on who can access your BCDR data
and who can perform operations on it.
By giving you options to perform backup securely, and
by helping you make sure that your backup data is kept away
from production workloads to provide better chances
of recovery in cases of attacks in addition
to these backup can also help you govern better
with built-in alerting and reporting
and meet your compliance requirements effectively.
Now let's dive into some of these features to
understand what they are and how are they useful
in enhancing your security and recoverability,
starting with Air Gapping.
Traditional Air Gap Solutions store your backup data
in isolated locations or in an offline environment
with no direct connectivity to production workloads.
Azure Backup provides modern version of this concept
by storing all your backups in a separate subscription
and tenant that is completely isolated
from your production workloads.
Also, the only way to access
and manage the backup Storage is through Azure backup APIs
which mitigates any chance of direct access to backups.
There are also additional capabilities that you can use
to your advantage to make sure your data is transferred
and stored securely.
Let's take a look at some of these.
Being a native and built-in Azure service
Azure backup leverages Azure Active Directory
for managing and verifying identity.
So you can use capabilities provided
by Azure Active Directory like multifactor authentication
to ascertain if users are who they claim to be
and thus preventing any damages due
to credentials being compromised.
With role-based access control,
Azure Backup provides built-in roles that can be assigned
to users based on their responsibilities
without having to overexpose permissions.
In addition to built-in roles
you can create custom roles as per your requirements.
Backup recently introduced a new capability,
called multi-user Authorization for critical operations,
that adds an additional layer
of protection for operations that
in the wrong hands can potentially lead to loss of backups.
To do this, Azure Backup user a new Azure resource
called the Azure Resource Guide
which is owned by a different user referred
to as a security administrator in this case.
Now, if the backup admin wants to perform
a critical operation they would need to first
get a contributor role on this Resource Guard.
Only after the security administrator assigns
the required permissions to the backup admin
can they successfully perform the operation,
otherwise the operation would result in a failure.
Multi-user authorization is already generally available
for Recovery Services role and is now in public preview
for Backup roles.
Encryption is another key aspect to keep
in mind when talking about transferring and storing backups.
Your backed up data is always encrypted
at risk using AES 256 encryption.
By default, this is encrypted using Microsoft Managed Keys.
Also, all the communication and data transfer
is done securely using the latest versions of DNS.
In addition to the capabilities available by default
you can opt to use your own encryption keys
toward the Azure keyboard.
You can also opt to use double encryption
which adds another layer
of infrastructure encryption using a separate set
of cryptographic library.
Azure Backup also supports backup of encrypted workloads
like virtual machines using Azure Disc Encryption
or CMK-encrypted disks
and also databases that use transparent data encryption.
And this can help you provide end-to-end encryption
for your workloads.
Azure Backup helps you perform backups
with minimal compromises to your production network security
while keeping all the data always on Azure.
When backing up Azure Virtual machines
all the communication and data transfer is done
through Azure Fabric without you needing to
make any exceptions to your firewall rules.
If you're trying to databases running side virtual machines,
you can leverage private endpoints
to perform backup securely.
If not opting to use private endpoints
you can use Azure Backup NSG and Firewall tags
for easily managing your network requirements.
Backup of Azure Pass resources ensures that data is always
on Azure when operational backup store data
within your source resource or subscription.
Thus, we're always in your boundaries.
You can also back
up your on-Premises servers using private endpoints created
for connected Azure virtual networks
or you can use your existing express route circuits
for your backups.
Soft Delete allows you to recover your data
till up to 14 days after deletion.
If you think the data should not have been deleted
you can un-delete this data
and you can also start protecting it again.
If you do not un-delete the data within 14 days
this data will be permanently deleted.
It's also worth noting that data that is there
in Soft Delete state or backup items that are there
in Soft Deleted state, they're not charged
and that data is retained free-of-cost.
Soft Delete is enabled for all new vaults that get created
however you can disable it as needed.
You can also protect disabling
of Soft Delete by multi-use authorization
for backup that we discussed earlier to protect
if any unauthorized attempts are made to disable it.
We recently launched a preview of enhanced Soft Delete
which improves upon the existing Soft Delete offering
by providing a way to make it irreversible.
So once the Soft Delete is enabled
and selected to be always on, it cannot be reversed.
This helps further prevent any malicious actors
from disabling Soft Delete
and proceeding to delete your backups.
Unlike the existing Soft Delete capability.
Enhanced Soft Delete also allows you to provide
a custom retention period for your Soft Deleted data
plus increasing your chances of recovering
from threats such as a advanced persistent threats.
Enhanced Soft Delete is now in preview for recovery services
vaults as well as backup vaults.
Backup recently added another key capability
in the form of Immutable Vaults to help you protect
your backups against various internal
and external attackers.
Immutable Vaults helps you ensure
that the recovery point that is once created cannot
be deleted before it's set expiry.
And this expiry is in turn governed by the backup
policy that was active at the time of creation
of this recovery point.
This results in certain operations being disallowed
on a vault that is configured to be an Immutable Vault.
Such as modifying and changing backup policies
to reduce retention or stopping and deleting
backups for a backup item.
Such operations will be blocked since they can
result in loss of backup data.
Once you're convinced about enabling immutability
permanently on a vault
you can choose to make it irreversible.
Now, let us take a look at how such vault are different
from a vault that does not have immutability enabled.
So here I am
in the properties of my recovery services vault
and there is a new capability that's been added
over here called Immutable Vaults.
Currently it says it's not enabled.
So what happens is, if I go to a backup policy
I can go ahead
and modify this policy to any retention period I want.
I can simply go and update this policy.
So effectively I could reduce the retention
of this backup policy if I choose to.
Similarly, if I go to a protected item under this vault
and if I try to stop backups, I can simply go ahead
stop backups and delete all my backup data.
So these operations
they should typically not be allowed for Immutable Vaults.
Now let's see what happens if I enable immutability
for this particular vault.
Go over to these settings
and I enable Vault Immutability, and I click apply.
Now we see that the state has changed to enable,
but not locked.
Now, if I try to modify an existing backup policy
and try to reduce the retention, let's see what happens.
This doesn't allow me to go through.
Similarly, if I try to stop protection
and delete backup data
I don't have an option to delete the backup data this time.
And this is not just in the portal.
Even if you're using other clients
you would not be allowed to delete backup data
or reduce policy retentions, likewise.
Now, another thing that you would've noticed
in the properties is that it says unlocked right now
and the reason is immutability at this point is reversible.
However, if you've made sure that your configuration
of the world is done properly
and your backup policies are how they're supposed to be
you can go ahead and log this immutability
which will ensure
that this immutable setting cannot be reversed.
So this is how immutability
or Immutable Vaults can help you protect yourself
from a variety of scenarios involving malicious actors
like ransomware attackers.
While Zero Trust principles often apply
to broader architectures, it is possible to imagine them
for your backup systems as well.
Hence, every access should be verified explicitly
to begin with.
Secondly care should be exercised
when assigning permissions.
You can use built in RBAC roles
or choose to create custom roles so as to ensure
that users have only enough access to do their jobs.
MUA can further help you add additional guardrails
to critical operations.
Lastly, use protection capabilities
to their potential to make sure your backup data
is safe even in cases of breaches.
As we come towards the end of the video
I would like to call out the various tools that
can help you manage your backup estate efficiently at scale.
You can leverage Azure policies to ensure your backups
and the securities as per the organization's expectations.
Backup also provides built in monitoring, reporting
and alerting capabilities to help you keep yourself aware
of everything that's going on with your backups.
So that's it from our side for now.
Here are some links that you might find useful.
Do check them out.
For anything else,
write to us at AskAzureBackupTeam@microsoft.com
and thanks for watching.
Hope you like the video.
(upbeat outro music)