Veeam Backup & Replication 9.5 Update 4
User Guide for Microsoft Hyper-V
Related documents

Encryption Best Practices

To guarantee the flawless process of data encryption and decryption, consider the following recommendations.

Password

  1. Use strong passwords that are hard to crack or guess:
    • The password must be at least 8 characters long.
    • The password must contain uppercase and lowercase characters.
    • The password must be a mixture of alphabetic, numeric and punctuation characters.
    • The password must significantly differ from the password you used previously.
    • The password must not contain any real information related to you, for example, date of birth, your pet’s name, your logon name and so on.
  1. Provide a meaningful hint for the password that will help you recall the password. The hint for the password is displayed when you import an encrypted file or tape to the backup server and attempt to unlock it.
  2. Keep passwords in the safe place. If you lose or forget your password, you will not be able to recover data from backups or tapes encrypted with this password, unless you use Enterprise Manager keys in the encryption process.
  3. Change passwords for encrypted jobs regularly. Use of different passwords helps increase the encryption security level.

Data recovery without a password and Enterprise Manager keys

  1. If you use the Enterprise or Enterprise Plus Edition of Veeam Backup & Replication, connect backup servers to Veeam Backup Enterprise Manager. In this case, Veeam Backup & Replication will employ Enterprise Manager keys in the encryption process, which will let you to recover data from encrypted backups and tapes even if the password is lost or forgotten. For more information, see Decrypting Data Without Password.
  2. Create and activate new Enterprise Manager keysets regularly. When you activate a keyset, the public Enterprise Manager key is automatically propagated to backup servers connected to Veeam Backup Enterprise Manager and used for encrypted jobs on these servers.
  3. Create backup copies of Enterprise Manager keysets and keep them in a safe place. If your installation of Veeam Backup Enterprise Manager goes down for some reason, you will lose private Enterprise Manager keys. As a result, you will not be able to use the Veeam Backup Enterprise Manager functionality to recover data from backups and tapes without a password. For more information, see Decrypting Data Without Password.

Encryption for Existing Jobs

If you enable encryption for an existing job, during the next job session Veeam Backup & Replication will create a full backup file. The created full backup file and subsequent incremental backup files in the backup chain will be encrypted with the specified password.

Encryption Considerations Note:

After enabling or disabling encryption for an existing backup copy job you will need to create an active full backup manually. For more information, see Creating Active Full Backups.

Encryption is not retroactive. If you enable encryption for an existing job, Veeam Backup & Replication does not encrypt the previous backup chain created with this job. If you want to start a new chain so that the unencrypted previous chain can be separated from the encrypted new chain, follow this scenario: this Veeam KB article.

If you change the password for the already encrypted job, during the next job session Veeam Backup & Replication will create a new incremental backup file. The created backup file and subsequent backup files in the backup chain will be encrypted with the new password.

Encryption Considerations Note:

To unlock a backup encrypted with several passwords, you must decrypt it in the following manner:

  • If you import a metadata file (VBM), provide the latest password that was used to encrypt files in the backup chain.
  • If you import a full backup file (VBK), provide the whole set of passwords that were used to encrypt files in the backup chain.

For more information, see Decrypting Data with Password.

This Document Help Center
User Guide for VMware vSphereUser Guide for Microsoft Hyper-VEnterprise Manager User GuideVeeam Cloud Connect GuideVeeam Agent Management GuideVeeam Explorers User GuideBackup and Restore of SQL Server DatabasesVeeam Plug-ins for Enterprise ApplicationsPowerShell ReferenceVeeam Explorers PowerShell ReferenceRESTful API ReferenceRequired Permissions ReferenceQuick Start Guide for VMware vSphereQuick Start Guide for Microsoft Hyper-VVeeam Backup for AWS DocumentationVeeam Availability for Nutanix AHV DocumentationVeeam Backup for Microsoft Office 365 DocumentationVeeam ONE DocumentationVeeam Agent for Windows DocumentationVeeam Agent for Linux DocumentationVeeam Management Pack Documentation
I want to report a typo

There is a misspelling right here:

 

I want to let the Veeam Documentation Team know about that.