Control Plane Hardening

Reducing the attack surface of a Veeam backup infrastructure starts before any configuration is applied - it starts with the choice of deployment platform. The fewer components exposed, the fewer opportunities an attacker has to exploit them.

Veeam Software Appliance

For new deployments, the recommended starting point is the Veeam Software Appliance (VSA). The VSA runs on a stripped-down Linux OS (Just Enough OS, JeOS), hardened to DISA STIG standards, with built-in immutability and Zero Trust access controls. Security updates are managed automatically by Veeam, removing the operational burden of manual OS patching. For air-gapped or internet-restricted environments, the VSA supports the configuration of a local mirror of the Veeam repository directly from the Veeam interface, making automated updates viable even without direct internet access.

The VSA embodies the Secure by Default principle discussed in System Resilience - it provides a strong, vendor-hardened baseline that significantly reduces the attack surface out of the box. As discussed there, this baseline is a starting point, not a substitute for your own security design decisions.

When to Stay on Windows

There are two main scenarios where a Windows-based deployment remains necessary:

For all other cases, migration to the VSA is strongly recommended:

  • For large or complex environments, follow the formal migration process documented in KB4800.
  • For small environments, a formal migration is often unnecessary. Recreate the Veeam components and jobs directly in the VSA, mount the existing repositories, and continue operations. This is frequently faster and cleaner than a formal migration procedure.

Hardening Windows Deployments

If a Windows deployment is required, the following measures reduce the attack surface to an acceptable level.

Limit Access to the Veeam Console

The Veeam Backup & Replication console is a client-side component that allows multiple operators and administrators to connect to the backup server simultaneously. Corporate laptops and general-purpose workstations are a significant risk in this context: they are exposed to a broad range of threats and can be compromised by malware capable of stealing credentials or hijacking active sessions. An attacker with access to a compromised laptop running the Veeam console has a direct path into the backup infrastructure.

To reduce this risk, install the console on dedicated administrative workstations positioned in a secure network zone, isolated from general corporate traffic. Where operationally feasible, connecting via RDP directly to the Windows backup server - where the console runs locally - can further reduce exposure by keeping the session within a controlled boundary.

This is a balance between security and operational convenience. The right choice depends on your environment, but the risk of running the console on an uncontrolled endpoint should be a conscious decision, not an oversight.

Enforce MFA when authenticating to the Veeam Backup & Replication console (supported from v12 onwards). Disable Remote Desktop and any other remote access protocol on the backup server unless explicitly required for administrative access.

Configuration Database Protection

The Veeam Backup & Replication configuration database stores credentials used to connect to virtual infrastructure and other systems. All passwords are encrypted, however a user with administrator privileges on the backup server can decrypt them. Refer to KB4349 for further details.

To reduce this risk:

  • Restrict access to the backup server and to the server hosting the configuration database if it runs remotely.
  • Enable encryption for configuration backups. Note that user accounts and passwords are not stored in configuration backups when encryption is not active.

The configuration backup is designed to protect and enable the restore of the whole control plane. It holds the entire data protection strategy captured in one artifact: every policy, every index of protected data, every connection to the production systems it safeguards, credentials included. Schedule it regularly, frequently, keep it encrypted, and store it in a resilient repository - ideally offsite. By default it’s stored in the default local repository created on disk C:\, change it as soon as you add a new repository. A single destructive event takes out both the system and the only path back to recovering it.

Unused Components and Services

Remove all non-essential software from Veeam components - web browsers, Java, PDF readers, and any tool that does not belong to the operating system or to active Veeam components. Every additional application increases the attack surface and the patching burden.

Disable or remove Veeam services and roles that are not in use:

  • Disable the vPower NFS Service on components where SureBackup, Instant Recovery, or non-Windows File Level Recovery are not used.
  • Remove the default proxy and default repository roles from the VBR server if not needed.
  • Uninstall Enterprise Manager if it is not actively used.

Patching and Updates

Keep operating systems, firmware, and all software on Veeam components up to date. The majority of successful attacks exploit known vulnerabilities for which patches already exist.

  • Track CVEs relevant to your systems and components.
  • Apply guest OS updates promptly on all backup infrastructure servers.

Ports

Use the ports and protocols required by Veeam components as documented. Do not attempt to obscure them by using non-standard ports - as discussed in Secure by Design, obscurity is not security and introduces management complexity without meaningful protection.

Apply firewall rules to restrict network communications to the minimum required by each component.

References

Table of contents

Back to top

Copyright © 2019 - 2026 Solutions Architects, Veeam Software.
Please note that information provided in this guide is not produced or verified by Veeam R&D but is a result of community effort based on the field observations.