Best Practices for Backup Storage

Use Cloud Storage for All Important Backups

If you work with regulated data like medical records or sensitive data like legal or accounting data, or want to make sure any data you are backing up uses the best security against disaster/malware, then you must back up to the cloud. You can create local backups to a network share and the cloud in a single pass using our hybrid backup technology, or you can back up directly to the cloud. The cloud helps protect your backups from malware or a bad actor that can easily access your local backups from the network.

Lock Out Files Deletion on The Backup Agent

The Storage tab of Backup Agent is the place where most of the metadata is stored. You can restore files from it with a few clicks. You can also delete data from this tab.

To disable this option, proceed as follows:

1. Open the Management Console.
2. In the Settings menu, select Global Agent Options.
3. In the General group, unselect the Allow data deletion in Backup Agent check box.
4. Click Save Changes.

Require Additional Verification for Access

If a user is accessing sensitive data in the cloud, automatically require Two-Factor Authentication to prove their identity.

Enable Two-Factor Authentication

Two-Factor Authentication (2FA) adds a second layer of login security for the main administrator and sub-admin accounts. You can use Google Authenticator or Microsoft Authenticator with your iOS or Android mobile devices to require a second code to be entered when logging into Managed Backup.

To enable 2FA on the main Administrator account, proceed as follows:

1. Open the Management Console and log in with the main administrator credentials.
2. In the Settings menu, select *General.
3. In the Security area, click the Enable Two-factor Authentication button.
4. Follow the instructions stated in the Enable Two-factor Authentication dialog box. It is recommended using MSP360 Control app.

To enable 2FA is enabled, save generated alternative codes that can be used to access the Management Console in case of emergency: for instance, if you accidentally remove yourself from the IP Allowlist. To do this:

1. Click the 2FA Alternative Codes link.
2. Click Generate new codes. Once codes are generated, download or print them. These codes can be used for authentication within the Management Console, so, for security reasons, keep them in a safe place.

Force Two-Factor Authentication for All Administrators

You can also force 2FA to be switched on for all your sub-administrators. To do this, proceed as follows:

1. Log in to the Management Console with the root account.
2. In the Settings menu, select General.
3. In the Security area, turn on Force Two-Factor Authentication for all administrators.
4. Save the changes.

Once complete, your admin accounts will be secured with 2FA access. If someone accidentally saved their username and password in a browser or someone gained access to an admin password, they will not be able to log in to Managed Backup without access to the administrator's mobile device.

Turn ON SSO-only access for all administrators

Require all administrators to use a Google or Microsoft account to access the Management Console. Password login will be disabled for them

1. Log in to the Management Console with the root account.
2. In the Settings menu, select General.
3. In the Security area, turn on SSO-only access for all administrators.
4. Save the changes.

Keep All Administrators Signed In

To reduce the number of authentication prompts while maintaining an appropriate level of security, you can configure the Management Console to keep you and all administrators signed in for a specified number of days.

1. Log in to the Management Console with the root account.
2. In the Settings menu, select General.
3. In the Security area, set the the Keep me and all the administrators signed in for period in days. It is recommended to set the shortest period that meets your organization's operational requirements. Shorter sign-in periods reduce the time during which an unauthorized person could potentially use an active session.

| Top |

Use IAM Role Access to your AWS S3 Storage

When creating your AWS S3 storage in Managed Backup, use Identity and Access Management (IAM) roles instead of the legacy Access / Secret keys. IAM roles eliminate the need to store long-term access keys and provide temporary credentials for accessing S3 storage.

For details on configuring your S3 accounts in Managed Backup with IAM roles, see Create IAM Role for Amazon S3 Account.

Activate MFA for Wasabi Account Control Manager (WACM)

1. Log in to your WACM account: WACM.
2. Navigate to My Profile.
3. In the MFA (Multi-Factor Authentication) section, click Turn On.
4. Scan the displayed QR code with an authenticator app.
5. Enter the generated code in Confirmation Code and click Register.
6. Click Update to apply profile changes, where applicable.

| Top |