Education & Training

Technology alone cannot close the security gap. Across the vast majority of successful breaches, the initial point of entry involves a human decision: clicking a phishing link, reusing a password, approving a fraudulent request, or misconfiguring a system through simple oversight. People are both a potential vulnerability and, when properly prepared, one of the most effective defenses an organization has.

For backup infrastructure specifically, this is especially important. Backup administrators typically hold some of the most privileged access in the entire environment: the ability to read, restore and, in some configurations, delete every protected workload. An attacker who compromises one such individual through social engineering does not need to defeat segmentation, encryption, or immutability directly: a phished Backup Administrator or Security Officer credential walks past controls that a technical attack would have had to break.

This is the layer Defense in Depth lists last for a reason: every technical control on this page’s neighbors (Micro-Segmentation, End-to-End Encryption, immutability, four-eyes) assumes the person operating them is who they claim to be. Training is what keeps that assumption true.

Why People Remain a Primary Attack Vector

Phishing and social engineering remain among the most common initial access techniques used by ransomware operators, precisely because they are cheaper and more reliable than exploiting technical vulnerabilities. Backup infrastructure also gives attackers a particular reason to prefer this route.

  • Backup and Security Officer credentials are a disproportionately valuable target. A single phished Backup Administrator account can reach every protected workload; a phished Security Officer credential targets the one role designed specifically to prevent unilateral, damaging action. Spear-phishing these individuals by name is a deliberate, rational attacker strategy.
  • Four-Eyes Authorization is also a social-engineering target. An approval workflow that requires a second person’s sign-off can be undermined by convincing that second person to approve without genuinely reviewing it, for example through an urgent message claiming to be from a colleague or executive, timed to a plausible-sounding change. For four-eyes to stay meaningful, approvers need training too.
  • The pre-attack pattern is recognizable if administrators know to look for it. Ransomware operators typically attempt to disable or delete backups before encrypting production, precisely because backups are the recovery path. Unusual authentication attempts against the backup server, unexpected requests to disable immutability or extend retention downward, or access attempts outside normal hours are early indicators, provided someone has been trained to recognize them.
  • Misconfiguration caused by human error is also a training problem. An administrator leaving a repository unencrypted “temporarily,” skipping a Security Officer approval because it felt like friction, or granting a broader vCenter role than a job required, are the human-side equivalent of the drift that Proactive Validation watches for, and training reduces how often it happens in the first place.

Build Role-Specific, Ongoing Training

Generic, one-time security training is not sufficient, and for backup infrastructure it tends to skip the roles that matter most. Training should be:

  • Regular and recurring. Threats evolve, and awareness fades without reinforcement. This matters all the more because Veeam regularly ships version changes with security impact (see the port and protocol changes in v13/v13.1 in Micro-Segmentation), and operational staff need to understand them as well as apply them.
  • Role-specific, with particular depth for the Backup Administrator and Security Officer roles. A Backup Operator needs to recognize a phishing attempt; a Backup Administrator or Security Officer needs to additionally understand what an attacker gains from compromising them specifically, and why requests to bypass MFA, disable immutability, or approve an unusual restore should trigger scrutiny.
  • Relevant to current threats, incorporating recent, real-world examples of backup-targeted ransomware tactics, such as attackers deleting snapshots and backup jobs before encrypting production, targeting repository credentials directly, or impersonating Veeam support or IT leadership to request configuration changes.
  • Tied to the operating model. Moving to the Veeam Software Appliance changes what a legitimate request looks like: no interactive shell, no local software installs, host-level changes gated behind Security Officer approval and a time-boxed one-time password (see Multi-Factor Authentication). An administrator unfamiliar with this model who works around an unexpected approval prompt is a larger risk than the friction itself. Training on VSA should explicitly cover what should require approval, so a genuine attempt to bypass one is recognized as anomalous.

Learn Through Practice

Awareness delivered only as a slide deck or annual e-learning module has limited impact. Practice-based approaches build genuine readiness, and for backup infrastructure the most useful exercises are built around the ways Veeam environments fail or get attacked:

  • Run periodic simulated phishing campaigns aimed at backup and IT administrators, since they are the ones most likely to hold credentials an attacker actually wants. Use the results to target further training, without assigning blame.
  • Run a tabletop on “the Security Officer is unavailable and a host-level change is blocked.” This tests a procedure your team will actually hit on the Veeam Software Appliance, and it surfaces whether your approval model has a single point of human failure. It is the same question Defense in Depth asks of technical controls, applied to people.
  • Run a tabletop on “the backup repository shows signs of unauthorized access”. Walk through detection (see Proactive Validation), the decision to isolate or preserve evidence, and who is authorized to act, before it happens for real during an active incident.
  • Include a scenario where a request to disable MFA, extend job retention downward, or approve a Four-Eyes request arrives under time pressure and claims executive origin. This is the specific social-engineering pattern most likely to be used against backup infrastructure, and it is rarely covered in generic phishing training built around fake invoices or password-reset links.
  • Include backup and recovery scenarios in general incident response drills as well. A ransomware tabletop that never reaches “now restore from the immutable copy” has not tested the capability the rest of this guide is built to protect.
  • Rotate scenarios across different attack vectors and roles so training does not become predictable, and so both Windows-based and VSA-based operating models are exercised where both are in use.

Foster a Culture of Early Reporting

Technical and procedural training is only effective if people feel safe acting on it. For backup infrastructure, the cost of a delayed report is unusually high, since the window between initial compromise and an attacker reaching backups is often the only window in which recovery capability can still be protected.

  • Encourage staff to report suspicious activity, mistakes, or successful phishing clicks immediately, without fear of blame or punishment. A self-reported credential compromise that reaches the backup team within minutes is far more useful than one detected technically after the fact.
  • Make reporting simple and well-known: a clear, easy channel (a dedicated address, a one-click reporting button) removes friction that might otherwise discourage timely reporting, particularly from an administrator who suspects they personally made the mistake.
  • Share lessons learned from real incidents with backup and IT staff, whether internal or industry-wide, including publicized ransomware cases that targeted backup infrastructure. This shows that the training reflects real, current attacker behavior.

References

Back to top

Copyright © 2019 - 2026 Solutions Architects, Veeam Software.
Please note that information provided in this guide is not produced or verified by Veeam R&D but is a result of community effort based on the field observations.