Home  ›  Glossary  ›  Backup Software

What is backup software?

Backup software is the application that decides what gets backed up and when. It copies data to separate storage, keeps a record of every copy and restores from those copies on request.

Veeam, Commvault, Rubrik, Cohesity, HYCU and Veritas NetBackup are common choices in mid-sized organizations.

The dispatcher behind every job

Backup software works like a dispatcher at a delivery firm. It holds the schedule, sends out the drivers and logs every parcel. It rarely carries anything itself.

Most products have four parts. A central server runs the schedule and the admin console, and a backup catalog records every restore point. Backup agents or proxies read the data, and storage targets hold the copies.

Each night the server starts the jobs, the data moves to storage and the catalog notes the new restore points. Expired ones are then cleaned up.

Everything rests on one login

To do its work, the software stores powerful credentials. These include hypervisor logins, database accounts, cloud keys and the keys to the backup storage. Whoever controls the console controls every restore point behind it.

Safeguards inside the application, such as recycle bins or delete confirmations, assume the person signed in is trusted. An attacker using a stolen admin login sees the same menus.

In small teams, the backup server is often a Windows virtual machine joined to the production domain, on the same cluster it protects. One domain-wide breach then reaches the backups too. This is what administrative blast radius describes.

Questions worth asking about it

  • Can the backup server run outside the production domain, with its own accounts and multi-factor sign-in?
  • Does it support S3 Object Lock for every workload it protects, not just virtual machines?
  • Can each application or team use its own bucket and storage key?
  • How long does a clean reinstall take to see existing backups again?
  • Do its reports show restore tests, or only job success?

Many estates run more than one product, for example one for virtual machines and another for Microsoft 365. Shared storage keys across them mean a breach of one reaches all. Veeam Backup & Replication is the most common starting point in mid-sized estates, and its basics are covered under data backup.

ARTESCA and backup software

Scality publishes ARTESCA compatibility pages for Veeam, Commvault, Cohesity, Rubrik, HYCU, Veritas NetBackup and Zerto, with ARTESCA as the S3 storage target. ARTESCA has its own accounts and access keys, apart from the backup application and the production directory. Keys can be limited to specific buckets and actions.

Taking over the backup console does not hand over control of the storage. A hijacked console can still send whatever its keys allow, including deletes of unlocked data. Objects written under S3 Object Lock in compliance mode stay until their retain-until date, whoever sends the request.