How to improve security level for Backup Vault

bhen76 0

I am setting up Azure VM Backups but the security level is poor. How can I improve this security and how long does it take to show the higher security levels?

SadiqhAhmed-MSFT 45,276 Reputation points Microsoft Employee

2024-07-11T14:39:56.69+00:00

Hello @bhen76 Thank you for reaching out to us on Microsoft Q&A platform. Happy to help!

Azure Backup offers several security features to ensure the protection and confidentiality of your backup data. Here are the key security features provided by Azure Backup:

Encryption of data

Encryption protects your data and helps you to meet your organizational security and compliance commitments. Data encryption occurs in many stages in Azure Backup:

Within Azure, data in transit between Azure storage and the vault is protected by HTTPS. This data remains on the Azure backbone network.

Backup data is automatically encrypted using platform-managed keys, and you don't need to take any explicit action to enable it. You can also encrypt your backed-up data using customer managed keys stored in the Azure Key Vault. It applies to all workloads being backed up to your Recovery Services vault.

Azure Backup supports backup and restore of Azure VMs that have their OS/data disks encrypted with Azure Disk Encryption (ADE) and VMs with CMK encrypted disks. For more information, learn more about encrypted Azure VMs and Azure Backup.

When data is backed up from on-premises servers with the MARS agent, data is encrypted with a passphrase before upload to Azure Backup and decrypted only after it's downloaded from Azure Backup. Read more about security features to help protect hybrid backups.

Soft delete

Azure Backup provides security features to help protect the backup data even after deletion. With soft delete, if you delete the backup of a VM, the backup data is retained for 14 additional days, allowing the recovery of that backup item with no data loss. The additional 14 days retention of backup data in the "soft delete state doesn't incur any cost. Learn more about soft delete.

Azure Backup has now also enhanced soft delete to further improve chances of recovering data after deletion. Learn more.

Immutable vaults

Immutable vault can help you protect your backup data by blocking any operations that could lead to loss of recovery points. Further, you can lock the immutable vault setting to make it irreversible that can prevent any malicious actors from disabling immutability and deleting backups. Learn more about immutable vaults.

Multi-user authorization

Multi-user authorization (MUA) for Azure Backup allows you to add an additional layer of protection to critical operations on your Recovery Services vaults and Backup vaults. For MUA, Azure Backup uses another Azure resource called the Resource Guard to ensure critical operations are performed only with applicable authorization. Learn more about multi-user authorization for Azure Backup.

Enhanced soft delete

Enhanced soft delete provides you with the ability to recover your data even after it's deleted, accidentally or maliciously. It works by delaying the permanent deletion of data by a specified duration, providing you with an opportunity to retrieve it. You can also make soft delete always-on to prevent it from being disabled. Learn more about enhanced soft delete for Backup.

Monitoring and alerts of suspicious activity

Azure Backup provides built-in monitoring and alerting capabilities to view and configure actions for events related to Azure Backup. Backup Reports serve as a one-stop destination for tracking usage, auditing of backups and restores, and identifying key trends at different levels of granularity. Using Azure Backup's monitoring and reporting tools can alert you to any unauthorized, suspicious, or malicious activity as soon as they occur.

**
Source**: https://learn.microsoft.com/en-us/azure/backup/security-overview

Would be glad to help you further if you could share your requirements.

If the response helped, do "Accept Answer" and up-vote it

Share via

How to improve security level for Backup Vault

Your answer