NetBackup™ Security and Encryption Guide

About immutable and indelible data

NetBackup protects your data from being encrypted, modified, and deleted using WORM properties.

WORM is the acronym for Write Once Read Many.

WORM properties provide two additional levels of security for backup images:

Configuring these WORM properties protects your data from certain malware attacks to some extent, for example ransomware.

NetBackup provides the ability to write backups to WORM storage devices so their data cannot be corrupted. Additionally, it lets you take advantage of advanced options available from your storage vendors to ensure backups are retained unaltered on storage platforms to meet regulatory and compliance requirements.

All NetBackup image copies have an Expiration Time. This time is calculated by using the configured retention level in the schedule and the start time of the backup job.

When a NetBackup image is written to a WORM-enabled storage unit, the data cannot be altered or deleted until the WORM Unlock Time for that image has elapsed. Unlike the Copy Expiration time that is calculated from the start time of the backup job, the WORM Unlock Time is associated with the WORM storage. The WORM Unlock Time value is calculated using the configured retention level and the write completion timestamp for the backup image onto WORM storage.

When you use bpimagelist to view an image that is written to WORM storage, the timestamp that is associated with the Copy Expiration time precedes the WORM Unlock Time for that copy of the backup image. For longer-running backups or duplication jobs, the difference is greater between Copy Expiration Time and WORM Unlock Time.

As part of normal operations, copies of backup images on WORM storage are not removed from the catalog and storage until both Copy Expiration Time and Worm Unlock Time timestamps have elapsed. The WORM Unlock Time of a copy that is written to WORM storage can only be extended and cannot be shortened. To extend the expiration date, use the bpexpdate -extend_worm_locks command.

In special circumstances, the bpexpdate -try_expire_worm_copy option can be used to force an attempted removal of a WORM indelible image from the NetBackup catalog. This option is only recommended to be used after removing WORM locks directly on the storage device. Only use this option with assistance from Veritas technical support.

When duplicating an image onto WORM storage, the WORM Unlock Time can be configured to match the Copy Expiration Time by running the bpduplicate command using the -worm_unlock_match_expiration option that was introduced in NetBackup 10.1.

If older backup images are duplicated to WORM storage without using this command option, the WORM Unlock Time for the duplicated copy is calculated using the configured retention level, and the timestamp when the duplication job was complete.

The bpduplicate -worm_unlock_match_expiration command option is not used for SLP driven duplications. For SLP driven duplications, the retention period is applied from the end of the duplication job to calculate WORM Unlock Time of the new copy. The Copy Expiration Time for the new copy is calculated from the retention period that is applied to the backup time (for copy 1).

For AIR jobs, the retention period is applied from the end of the import job to calculate the WORM Unlock Time of the imported copy. The Copy Expiration Time is calculated as the retention period that is applied from the beginning of the import job.

For more information about the bpduplicate command and the bpexpdate command, see the NetBackup Commands Reference Guide.