Commvault Multi-level Cyber Security

Great set of questions.  I’ll give you a quick overview here, but just a heads-up: some of this really depends on how your environment is set up, so it’s a good idea to reach out to your Commvault Account Team or Professional Services to help with the design.

Commvault has a feature called Threat Scan that checks for malware in backup data. It doesn’t scan the data at the source but does the check after the backup completes. It’s useful to make sure you’re not keeping infected data. You’ll need to deploy a Threat Scan server and keep its definitions up to date.

For short-term storage on HSX nodes, you can create a logical air-gap using network isolation, immutability, and strict access controls. For long-term storage like tape, physical air-gap is easy since the tapes can be taken offline. For object storage, you can enable WORM settings and restrict access at the storage level.

Right choice towards software immutability. Just make sure compliance lock is enabled and retention policies are set properly on both short and long-term tiers. It works well if planned correctly.

HSX nodes are already hardened and don’t allow root access by default. Still, it's best practice to limit access, lock down the network paths, and use storage-level immutability to prevent any accidental or malicious deletion.

For Media Agents, CommServe, and Threat Scan appliances, you should enable MFA, apply patches regularly, follow role-based access controls, and enable logging and monitoring to keep things secure.

Lastly, outside of Commvault itself, you can secure the whole solution with network segmentation, locking down ports on switches, and restricting who has access to storage systems. These steps help complete the security picture.