New Zero Trust Data Resilience Model

Veeam Software introduced Zero Trust Data Resilience (ZTDR), a model to help organisations reduce the risk of growing data security threats and improve their overall resilience. Developed in collaboration with Zero Trust expert Jason Garbis of Numberline Security, ZTDR applies Zero Trust principles to backup and recovery as an extension to the Cybersecurity & Infrastructure Security Agency (CISA) Zero Trust Maturity Model. Essential to ZTDR is the separation of backup management systems and their storage tiers into distinct resilience zones to reduce the attack surface and limit the potential blast radius from breaches; and immutable backup storage, to ensure that data cannot be modified even in the event of a ransomware attack.

Modern, effective security is based on Zero Trust, replacing the increasingly ineffective perimeter-based security approach. Yet most Zero Trust frameworks do not include the security of data backup and recovery systems, despite the fact backup data is often the primary target of malicious actors in both ransomware and data exfiltration attacks. The Veeam Data Protection Trends Report 2023 found 93% of ransomware attacks are targeting backup repositories.

“Backup infrastructure by its nature has a large attack surface, because it must have read and write access to production, spanning virtually all enterprise applications and data sources, both on-premises and in the cloud,” said Jason Garbis, Founder at Numberline Security. “To reduce that risk, Numberline and Veeam are proposing practical Zero Trust Data Resilience tools, including core principles, an architecture, and a maturity model. Our goal is to help organizations fill a gap in their security strategy by extending Zero Trust to backup and recovery to achieve greater cyber resilience.”

Within the CISA Zero Trust Maturity Model, “Data” is one of five pillars, under which it identifies five key functions: Data Inventory Management, Data Categorization, Data Availability, Data Access and Data Encryption. To extend this model to the critical function of data backup and recovery, the ZTDR principles are:

  • Least Privilege Access
  • Immutability
  • System Resilience
  • Proactive Validation
  • Operational Simplicity

To help organizations begin their journey to implement these principles, Numberline has developed a detailed ZTDR Maturity Model, as well as a ZTDR Reference Architecture which includes these key attributes for improved data resilience:

  • Segmentation, for clear separation of Backup Software and Backup Storage layers to create distinct resilience zones that minimize the attack surface and reduce the blast radius when an attack occurs.
  • Backup storage immutability, ensuring data cannot be modified or deleted.

“The latest Veeam research shows that 75% of ransomware attacks on backups are successful,” said Danny Allan, CTO at Veeam. “To keep businesses running, it’s essential to ensure data immutability and to follow best practices like Zero Trust Data Resilience (ZDTR). With the ZTDR Maturity Model, every organization can chart their path to greater data security and less down time. While Veeam has always been committed to this architectural approach, we are working with storage partners to implement an industry leading zero trust model.”

“To combat escalating cyber threats like ransomware, there is a pressing need to unify and strengthen IT and security effectiveness leveraging frameworks like Zero Trust,” said Christophe Bertrand, Practice Director at ESG. “We have found in our latest ransomware state of the market research that 86% overall think Zero Trust is a key strategy for ransomware protection. Zero Trust Data Resilience is fundamental in addressing those needs to deliver a more robust security posture through faster and safer recovery.”

Read more exclusives and news in our latest issue here.

Never miss a story… Follow us on:
LinkedIn Security Buyer
Twitter logo @SecurityBuyer
Facebook @Secbuyer

Media Contact
Rebecca Morpeth Spayne,
Editor, Security Portfolio
Tel: +44 (0) 1622 823 922
Email: [email protected]

About Security Buyer

Security Buyer is the leading authority in global security content, delivering expert news, in-depth articles, exclusive interviews, and industry insights across print, digital, and event platforms. Published 10 times a year, the magazine is a trusted resource for professionals seeking updates and analysis on the latest developments in the security sector.

To submit an article, or for sponsorship opportunities, please contact our team below.

Rebecca Spayne picture 2025

Rebecca Spayne

Managing
EDITOR

Georgina Turner image

Georgina Turner

Sales
Manager

Afua Akoto image - Security Buyer

Afua Akoto

Marketing Manager

Read the Latest Issue

Follow us on X

Follow us on X

Click Here

Follow us on LinkedIn

Follow us on LinkedIn

Click Here

Advertise here

Reach decision makers and amplify your marketing

Advertise here

Click Here

Related News

OneLink

Product Spotlight – Gallagher’s OneLink

Gallagher Security presents, OneLink – the product that is elevating remote security through the power of the cloud 
Pinaccle systems

Pinnacle Systems further supports Installers and System Integrators

Pinnacle Systems has launched the Pinnacle Partner Programme, a new initiative designed to provide enhanced support for installers…
Stephen Tickle

Comelit-PAC Appoints Stephen Tickle as Regional Sales Manager

Comelit-PAC has appointed Stephen Tickle as its new Regional Sales Manager.  Stephen will focus on supporting PAC’s access control…
Intersec Saudi

Intersec Saudi Arabia returns with record exhibition space

Intersec Saudi Arabia, the premier industry platform for security, safety and fire protection, will return to the Riyadh…
Abloy UK

Abloy Academy breaks attendance records

Abloy UK has achieved record breaking attendance at its Academy, with more professionals than ever attending its…
Hikvision

Hikvision Introduces X-ray Baggage Inspection System

Hikvision India has recently introduced X-ray Baggage Inspection System with AI- enabled Intelligent Recognition Capabilities…
GBV

IFPO Column: The Quiet Signals of Danger

Yoyo Hamblen of IFPO and Gary Simpson, Nonverbal and Behavioural specialist discuss the important topic of Gender-Based Violence..
Doorbird Carousel

Product Spotlight – Door Communication for the “Neue Wallufer”

 A customised solution case study for a residential complex is presented by DoorBird and CompuNet Systems GmbH 
suprema

Suprema Achieves EN 60839 Certification

Suprema, a global provider of AI-powered access control and security solutions, has achieved EN 60839-11-1:2013 Grade 3 certification
ASSA ABLOY

Electric locks are a vital component in digital access

To protect the important openings in their buildings, organizations need locks they can trust. This means more than just strength…
Scroll to Top