Independent Security Test Report for Ootbi Appliance

This document is an independent security test report detailing the findings from a comprehensive assessment conducted by the NCC Group on the Object First Ootbi appliance. The assessment aimed to evaluate the security measures in place for the Ootbi solution, which is designed to serve as a secure storage target for Veeam backup data. The report outlines the testing process, which involved two rounds of evaluations focusing on software source code and penetration testing over a span of 54 days. The NCC Group identified a total of 20 issues during the first round, with 19 being resolved before the second round. The report includes a summary of the vulnerabilities found, their assessed risk levels, and the current status of each issue. Additionally, the document emphasizes the importance of implementing Zero Trust frameworks in backup architecture to enhance data resilience and ensure that even privileged users cannot modify or delete data. The findings underscore Object First's commitment to maintaining high security standards.