General Security Considerations

This section describes best practices that help you to harden the managed infrastructure, build a more secure environment and mitigate risks of being compromised. Ensure that your infrastructure meets these recommendations. For more information on hardening specific Orchestrator components, see Securing Veeam Recovery Orchestrator.

Network

To secure the communication channel for network traffic, consider the following:

• Create network segmentation policies to define network boundaries, control traffic between subnets and limit access to security-sensitive Orchestrator components.
• Make sure that only ports used by Orchestrator components are opened. For more information, see Ports.
• Use an isolated network to transport data between Orchestrator components.

• Disable the following outdated network protocols:

• SSL 2.0 and 3.0 as they have well-known security vulnerabilities and are not NIST-approved. For more information, see NIST guidelines.

• TLS 1.0 and 1.1 if you no longer need them. For more information, see NIST guidelines.

• LLMNR and NetBIOS to prevent spoofing and man-in-the-middle (MITM) attacks.

• SMB 1.0 as it has a number of serious security vulnerabilities including remote code execution. For more information, see this Microsoft article.

User Permissions

Administrative privileges on the machine where the Veeam Recovery Orchestrator server is deployed allow users to access other infrastructure components. If an attacker gains these permissions, they can erase most of the production data as well as compromise other systems in your environment. To mitigate risks, use the principle of least privilege. Provide the minimal permissions required for users to perform operations correctly. For more information, see Permissions.

File System

You must not add paths writable by untrusted users to the PATH environment variable. A potential attacker may exploit this vulnerability to execute malware or access sensitive data. For more information, see this CWE article.

Security Audit

You must perform regular security audits to assess your managed infrastructure against security criteria and understand if it is compliant with best practices, industry standards and federal regulations.

To reduce the risk of exploiting vulnerabilities by attackers, also consider the following:

• Regularly install the latest security updates and patches on the Veeam Recovery Orchestrator server and other components.
• Develop an update management strategy to prevent a negative impact on the production environment.

Microsoft Windows Server

To secure Microsoft Windows-based components in the managed infrastructure, consider the following:

• Use operating system versions with Long Term Servicing Channel (LTSC). For these versions, Microsoft provides extended support including regular security updates. For more information, see this Microsoft article.
• Regularly install the latest operating system and security updates for Microsoft Windows. To prevent a negative impact on the production environment, develop an update management strategy.

• Enable Microsoft Defender Firewall with Advanced Security. Configure rules for inbound and outbound connections based on your infrastructure requirements and Microsoft best practices. For more information, see this Microsoft article.
• Disable the following remote services if you no longer need them: Remote Desktop Service, Remote Registry service, Remote PowerShell and Windows Remote Management service.