Overview

Cyber recovery is one of five functions that are described in the NIST Cybersecurity framework. It is defined as the development and implementation of appropriate activities to maintain plans for resilience and to restore any capabilities or services that are impaired due to a cybersecurity incident. The other four functions are identify, protect, detect, and respond.

This documentation describes two solution architectures that can be used to assist with your cyber-recovery requirements. The solution architectures use VMware Cloud Foundation for Classic - Automated and Veeam® Backup and Recovery for VMware vSphere®. The two solution architectures are named as Immutable backup and Isolated recovery environment.

The immutable backup solution architecture uses the Veeam Linux® hardened repository design as an immutable storage repository within the production environment. Key elements of the solution architecture include:

• A VCF for Classic - Automated instance that provides compute, storage, and network resources for the virtual machines.
• The Veeam service that provides backup for the virtual machines.
• The Veeam service is enhanced with a Veeam Linux hardened repository that is hosted on an IBM Cloud® bare metal server.
• Optionally you can use Veeam technologies, such as vPower NFS Service and Mount servers to assist with cyber-recovery tasks.
• The solution architecture does not preclude any of the VCF for Classic - Automated options, such as Caveonix, Entrust, and VMware Aria® Operations™.
• This solution is suitable for clients who want to extend their Veeam backup with immutability by minimizing costs and by using existing processes and resources.

The isolated recovery solution architecture uses a VCF for Classic - Automated instance in an air-gapped recovery environment separate from the production environment. It is managed and accessed by using a separate team of cyber-recovery specialists. Key elements of the solution architecture include:

• A VCF for Classic - Automated instance used for cyber-recovery tasks only, deployed in an IBM Cloud account restricted to cyber-recovery activities.
• The VCF for Classic - Automated instance does not host production or disaster recovery workloads.
• The VCF for Classic - Automated instance includes an edge cluster to host Juniper® vSRX appliances to protect VCF for Classic - Automated instance networks. It also provides a network air gap between the production environment and the isolated recovery environment.
• A Veeam instance under separate management used for cyber recovery only.
• An immutable repository based on the Veeam Linux hardened repository hosted on an IBM Cloud bare metal server.
• The solution architecture does not preclude any of the VCF for Classic - Automated options such as Caveonix, Entrust, and VMware Aria Operations.
• Sandboxes can be provisioned by using VMware NSX-T™ overlay segments to provide network-isolated zones to mount cyber-recovery backups for inspection by your cybertoolsets.
• Cyber toolsets are customer-supplied tools that run as virtual machines (VMs) in the isolated recovery environment.
• Cyber admins are customer personnel who are authorized to access the isolated recovery environment.
• The air gap enables network connectivity between the production environment and the isolated recovery environment only when required.
• The solution architecture:
  • Is independent of the location of the production environment. However, it is required network connectivity between the production environment and the cyber-recovery site.
  • Is independent of the production backup solution.
  • Requires that the production environment is vSphere based.
  • Requires that cyber-recovery backup proxies that are registered with the cyber-recovery environment are installed on the ESXi hosts in the production environment.
  • Requires that the cyber-recovery backup infrastructure has access with sufficient privileges to the production vCenter and ESXi hosts.
• This solution is suitable for clients who want to copy critical data away from the production environment. Also, that cyber-recovery backup systems and personnel are separate from production and disaster recovery processes.