09. Whiteboard: backup and ransomware immutability

The board is the deliverable. If the customer photographs it, you won.

Whiteboard outcome

By the end, the board shows: production, a local backup repository, an immutable off-site copy on B2 with Object Lock, an optional second-region replica, the attacker path that fails, and the restore path with time and cost written next to it.

Before you draw: four questions

1. Which backup software? (Veeam, Rubrik, Commvault, MSP360, Synology)
2. RPO/RTO for tier-1?
3. Retention schedule?
4. Who can delete backups today?

Draw it in 9 steps

1. Left edge, draw three boxes stacked: VMs, physical servers, M365/SaaS. Label the group “Production”. Say: “This is what we protect.”
2. Middle-left, one box: “Backup server” with their software name. Arrow from production. Say: “Your backup software stays. Nothing changes here.”
3. Below it, a cylinder: “Local repo (fast restore)”. Arrow from backup server. Write their RTO next to it.
4. Right side, a large rounded rectangle: “Backblaze B2 (region: US East)”. Inside, a bucket icon labeled “Object Lock: ON, compliance, 30 days”. Say: “This copy cannot be deleted or changed until the date passes. Not by you, not by an attacker with your admin password, not by Backblaze support.”
5. Arrow backup server to B2, label it “S3 API, scoped app key, TLS”. Write “SOBR capacity tier or direct-to-object” for Veeam.
6. Draw the attacker: a red figure top-center with a red arrow to the local repo (X: encrypted) and a red arrow to B2 that stops at a wall. Write “DeleteObject → AccessDenied (locked)”. Say: “This is why insurers ask for immutable off-site copies.”
7. Optional, below B2: a second rectangle “B2 EU Central (2nd account)” with a dashed arrow “Cloud Replication”. Say: “If you need region-loss survival, we replicate to a second region. Note: Object Lock cannot be set on a replication source bucket, so design which side is locked.”
8. Restore path in green: arrow from B2 back to a “Clean recovery environment”. Write “Always hot. No retrieval tier. Restore tests free up to 3x stored per month.”
9. Bottom, write the rule: “3-2-1-1-0: 3 copies, 2 media, 1 off-site, 1 immutable, 0 errors on restore test.” Circle the “1 immutable”.

flowchart LR
  subgraph Prod[Production]
    VM[VMs]; PHY[Physical]; SAAS[M365 / SaaS]
  end
  BK[Backup server<br/>Veeam / Rubrik / Commvault]
  LR[(Local repo<br/>fast restore)]
  subgraph B2[Backblaze B2 - primary region]
    BKT[(Bucket<br/>Object Lock: compliance 30d)]
  end
  B2R[(B2 second region<br/>separate account)]
  ATK{{Attacker with admin creds}}
  CR[Clean recovery env]
  VM --> BK; PHY --> BK; SAAS --> BK
  BK --> LR
  BK -- S3 API, scoped key, TLS --> BKT
  BKT -. Cloud Replication .-> B2R
  ATK -- encrypts --> LR
  ATK -- delete attempt: denied --> BKT
  BKT -- restore: hot, no retrieval fee --> CR

The design decisions you must make with them

Veeam specifics

• v12+ supports direct-to-object to B2 with immutability (Backblaze guide). v10/v11 or SOBR: capacity tier offload guide.
• Veeam Ready partner status per Backblaze integration page. [verify current Veeam Ready category on veeam.com]
• Backblaze claims setup “takes less than 20 minutes”.
• Also: Veeam Backup for Microsoft 365, Kasten K10 for Kubernetes with Object Lock.

Rubrik specifics

• Rubrik defaults to SigV2 for S3-compatible targets; B2 requires SigV4. There is no UI switch; open a Rubrik support case to enable V4 first (Backblaze docs). Put this in the POC plan on day one.

Commvault, MSP360, Synology, TrueNAS

• Backblaze publishes integration guides for each (see 16-partner-plays.md). MSP360 and Synology Hyper Backup also have Fireball rapid-ingest guides for seeding.

What they say / what you say / how you prove it

From the SE chair

Lead with the restore, not the backup. Everyone can write data somewhere. Ask “when did you last restore everything from off-site?” and let the silence do the work.