Search <book_title>...

NetBackup™ Security and Encryption Guide

Last Published: 2024-09-30

Product(s): NetBackup & Alta Data Protection (10.5)

Configure risk engine-based anomaly detection

The NetBackup risk engine detects certain system anomalies in a proactive manner and sends appropriate alerts. It helps you take corrective action before you face any security threat in your environment.

You can configure the following options that the risk engine uses to detect anomalies for the given operations:

Detect suspicious image expiration

Use this option to detect when images are expired in an unusual or a suspicious manner.

By default, a system anomaly is generated when the risk engine detects an unusual or a suspicious image expiration attempt and allows the operation to proceed.

However, for additional security, you can configure multi-person authorization for such image expiration attempts, where an MPA approver needs to approve the operation.

Important notes on the Detect suspicious image expiration option

If the audit retention period is set to less than 3 months, this option accumulates data of 3 months and then becomes active.
This option supports full backup schedules. Other types of schedule are not considered. The retention level of an image is also not considered for this rule.
Images are expired by media ID, server name, or by recalculating the retention period.

Select Edit and select the Generate multi-person authorization ticket if images are deleted in a suspicious manner option.

Note:

To successfully review the multi-person authorization tickets, ensure that one or more MPA approvers are available in your environment.

See About multi-person authorization.

See RBAC roles and permissions for multi-person authorization.

Secure critical operations

Use this option to protect critical operations such as modifying global security settings and creating API key. When you select this option, you are required to reautneticate yourself by entering the one-time password that you see in the authenticator application on your smart device before you perform the given critical operations.

Ensure that you have configured multifactor authentication for your user account. If multifactor authentication is not configured, you are not prompted to reauthenticate.

Note:

It is strongly recommended that you configure multifactor authentication in your environment to prevent security threats by malicious sources.

See Configure multifactor authentication for your user account.

Detect possible session hijack

Use this option to detect if there is a possible user session hijack by a malicious source.

The risk engine detects if the same user session token is used by another IP address, and sends a maximum of 10 alerts per day.

Select Edit and select the check box to terminate the user session when the risk engine detects that there is a possible session hijack.