With Eversync s cloud data tiering, the customer can tier data protection as follows:

Transcription

1 APPLICATION NOTE: CLOUD DATA TIERING Eversync has developed a hybrid model for cloud-based data protection in which all of the elements of data protection are tiered between an on-premise appliance (software or hardware) and a cloud storage service. Overview With Eversync s cloud data tiering, the customer can tier data protection as follows: Choose the data retention period to keep onsite, and choose the extended data retention period to be kept in the cloud. Keep a disaster recovery copy of the data in the cloud; in the event of a disaster, recover and run virtual applications in the cloud. Choose the archive data to be kept onsite, and choose the archive data to be kept in the cloud. Keep an archive copy in the cloud of SaaS application data. Eversync s hybrid solution addresses all of the biggest challenges of cloud access for small- and mediumbusinesses: Ensuring that data with compliance restrictions can be segmented and kept locally. Enabling the customer to disconnect from the cloud and still maintain control of their data, or to switch cloud providers without data loss.

2 On-premise software technology to reduce the amount of data that must be stored and transferred over the network to the cloud so that SMBs can protect large amounts of data (up to 100 TB) with relatively slow internet connections. Enabling the cloud to act as a second site for disaster recovery where applications can be restored and run until the customer s computing environment is back up and running. Providing local access for mass restores while also providing direct cloud access without a restore for recovering old s or files. Enabling SMBs to collect one authoritative archive copy of all of their data even the data hidden in SaaS applications that never resides on site. A single pane of glass for managing all of the data being protected regardless of whether it resides on premise, in the cloud, or in SaaS applications that comes as a web interface or a mobile app. Architecture The cloud data tiering solution is comprised of several key components: 1. Cloud services 2. On-premise appliance (physical or virtual) 3. Software agents that run on the servers that are being protected (only for physical servers; virtual servers are agentless) 4. Mobile app for management Cloud Services The cloud services components run in a public cloud. The initial release will run in the Amazon cloud, and will incorporate all of the benefits and characteristics of the Amazon cloud, including: Reliability Eversync offers two levels of reliability for cloud data, mirroring the levels offered by Amazon: High Reliability 11 9 s of reliability for any data stored (can withstand the loss of any 2 copies of the data) Normal Reliability 4 9 s of reliability for any data stored (can withstand the loss of any 1 copy of the data) To help ensure durability, your data is synchronously stored across multiple facilities. Once stored, the durability of your data is ensured by quickly detecting and repairing any lost redundancy. Eversync regularly verifies the integrity of data stored using checksums. If corruption is detected, it is repaired using redundant data. In addition, Eversync calculates checksums on all network traffic to detect corruption of data packets when storing or retrieving data. Page 2 of 8

3 Compliance Eversync offers a set of capabilities to ensure that customers can meet their regulatory and business requirements, including: Availability zones to ensure that multiple copies of applications and data reside in separate zones for business continuance. Regions Data is guaranteed to never leave the region, including the entire availability zone for the data. Eversync is currently available in eight regions: US East (Northern Virginia), US West (Oregon), US West (Northern California), EU (Ireland), Asia Pacific (Singapore), Asia Pacific (Tokyo), South America (Sao Paulo), and AWS GovCloud. The Eversync cloud using Amazon has in the past successfully completed multiple SAS70 Type II audits, and now publishes a Service Organization Controls 1 (SOC 1) report, published under both the SSAE 16 and the ISAE 3402 professional standards. In addition, the Amazon cloud has achieved ISO certification, and has been successfully validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS). In the realm of public sector certifications, the Amazon cloud has received authorization from the U.S. General Services Administration to operate at the FISMA Moderate level, and is also the platform for applications with Authorities to Operate (ATOs) under the Defense Information Assurance Certification and Accreditation Program (DIACAP). We will continue to obtain the appropriate security certifications and conduct audits to demonstrate the security of our infrastructure and services. For more information, see Appendix A. Security Eversync provides the following security measures for cloud services: Access control Encryption Secure upload and download of data via SSL Disaster Recovery In the event of a disaster, Eversync cloud services will: restore virtual applications and associated data from the Eversync DR copy of the most recent backup run virtual applications in the cloud, providing users with remote access to the virtual machines restore all on-site servers and data from the most recent backup once the customer site is back up and running Page 3 of 8

4 Cloud Seeding and Full Restores in the Case of a Disaster Eversync accelerates moving large amounts of data into and out of the cloud using portable storage devices for transport. Eversync transfers your data directly onto and off of storage devices using Amazon s high-speed internal network and bypassing the internet. For significant data sets, Eversync Import/Export is often faster than internet transfer and more cost effective than upgrading your connectivity. You can use Eversync Import/Export for migrating data into the cloud, distributing content to your customers and disaster recovery. It is intended that Eversync will support additional public cloud providers as options for customer who want alternatives to Amazon. On-premise Appliance The Eversync appliance that resides at the customer site can be deployed as either a fully integrated hardware appliance, or as a virtual software appliance under VMware. The onpremise appliance performs the following functions: Schedule and automate backup jobs Create archives of some or all backup jobs for compliance Block and file-level deduplication of backup data Byte-level change-based replication of backup jobs to the cloud for disaster recovery purposes Tiering of backup jobs to the cloud, based on user-provided retention schedules Tiering of selective archive data to the cloud, based on user-provided policies Network bandwidth optimization through Eversync s proprietary Block Print Replication, to minimize the amount of internet bandwidth used between the customer site and the cloud Management and reporting of data protection functions Software Agents Eversync provides software agents for all physical servers that have data to be backed up. Agents are available for all major server operating systems including Linux, MacOS, Windows, Netware, and others. These agents communicate with the on-premise appliance to coordinate backups of data. Mobile App for Management Eversync provides a mobile app for Apple and Android devices that allows the user to manage and control their data protection solution (both the on-premise appliance and cloud services) from their mobile device. Page 4 of 8

5 Product Roadmap Pricing The Eversync hybrid solution is available in two options: Single monthly subscription that includes the on-premise appliance, data stored in the cloud, cloud services, and data transfer to and from the cloud. A combination of a licensing/purchase price for the on-premise appliance, along with a monthly subscription that includes data stored in the cloud, cloud services, and data transfer to and from the cloud. With this option, the customer may choose to discontinue use of the cloud services and keep all of their data on their local appliance. Roadmap and Availability The Eversync on-premise solution is available today, either as a physical appliance or as virtual backup software, including the ability to make an offsite copy of the data through replication to a private cloud or secondary customer site. In the second half of 2013, Eversync will introduce the option to replicate to our public cloud service for disaster recovery and to archive to the cloud for data retention. A seamless webbased user interface will give customers direct access to all of their data, regardless of where it is stored. This release will introduce subscription-based pricing for the cloud services. In subsequent releases, Eversync will introduce full cloud data tiering capability, with cloud services for backup, DR, and archiving as well as virtual application restores in the cloud. About Eversync Eversync provides innovative data protection solutions that ensure continuity of business, control of critical information and confidence in recovery systems. Eversync offers Disk2Disk2Disk disk backup and recovery solutions with deduplication and replication that allow automated backup schedules for every client on the network and allows critical data to be stored safely off-site from a single disk backup appliance. Exchange and SQL agents are included. For more information, contact Eversync at or sales@eversyncsolutions.com to locate a reseller in your local area. Or visit Eversync at Page 5 of 8

6 Appendix A: Certifications and Accreditations Eversync Cloud Services The Eversync cloud services components are built on Amazon Web Services (AWS), including Amazon Elastic Compute Cloud (EC2), Amazon Simple Storage Service (S3), and Amazon Elastic Block Storage (EBS). These services have been designed by Amazon to meet the highest compliance and security requirements. Details for the various compliance regulations are provided below. SOC 1/SSAE 16/ISAE 3402 Amazon Web Services now publishes a Service Organization Controls 1 (SOC 1), Type 2 report. The audit for this report is conducted in accordance with the Statement on Standards for Attestation Engagements No. 16 (SSAE 16) and the International Standards for Assurance Engagements No (ISAE 3402) professional standards. This dual-standard report can meet a broad range of auditing requirements for U.S. and international auditing bodies. The SOC 1 report audit attests that AWS control objectives are appropriately designed and that the individual controls defined to safeguard customer data are operating effectively. Our commitment to the SOC 1 report is on-going and we plan to continue our process of periodic audits. This audit is the replacement of the Statement on Auditing Standards No. 70 (SAS 70) Type II report. FISMA Moderate AWS enables U.S. government agency customers to achieve and sustain compliance with the Federal Information Security Management Act (FISMA). FISMA requires federal agencies to develop, document, and implement an information security system for its data and infrastructure based on the National Institute of Standards and Technology Special Publication , Revision 3 standard. FISMA Moderate Authorization and Accreditation requires AWS to implement and operate an extensive set of security configurations and controls. This includes documenting the management, operational, and technical processes used to secure the physical and virtual infrastructure, as well as the third-party audit of the established processes and controls. AWS has received a three-year FISMA Moderate authorization for Infrastructure as a Service from the General Services Administration. AWS has also successfully achieved other ATOs at the FISMA Moderate level by working with government agencies to certify their applications and workloads. PCI DSS Level 1 AWS has achieved Level 1 PCI compliance. We have been successfully validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS). Merchants and other service providers can now run their applications on our PCI-compliant technology Page 6 of 8

7 infrastructure for storing, processing, and transmitting credit card information in the cloud. Other enterprises can also benefit by running their applications on other PCI-compliant technology infrastructure. PCI validated services include Amazon Elastic Compute Cloud (EC2), Amazon Simple Storage Service (S3), Amazon Elastic Block Storage (EBS) and Amazon Virtual Private Cloud (VPC), Amazon Identity and Access Management (IAM), and the underlying physical infrastructure and the AWS Management Environment. ISO AWS has achieved ISO certification of our Information Security Management System (ISMS) covering the cloud infrastructure, data centers, and services used by Eversync to create its Cloud Services including Amazon Elastic Compute Cloud (Amazon EC2), Amazon Simple Storage Service (Amazon S3) and Amazon Virtual Private Cloud (Amazon VPC). ISO 27001/27002 is a widely-adopted global security standard that sets out requirements and best practices for a systematic approach to managing company and customer information that s based on periodic risk assessments. In order to achieve the certification, a company must show it has a systematic and ongoing approach to managing information security risks that affect the confidentiality, integrity, and availability of company and customer information. This certification reinforces Amazon s commitment to providing transparency into our security controls and practices. AWS s ISO certification includes all AWS data centers in all regions worldwide and AWS has established a formal program to maintain the certification. A copy of our ISO certificate, available to AWS customers, describes the ISMS services and geographic scope. International Traffic In Arms Compliance The AWS GovCloud (US) region supports US International Traffic in Arms Regulations (ITAR) compliance. As a part of managing a comprehensive ITAR compliance program, companies subject to ITAR export regulations must control unintended exports by restricting access to protected data to US Persons and restricting physical location of that data to US land. AWS GovCloud (US) provides an environment physically located in the US and where access by AWS Personnel is limited to US Persons, thereby allowing qualified companies to transmit, process, and store protected articles and data under ITAR. The AWS GovCloud (US) environment has been audited by an independent third party to validate the proper controls are in place to support customer export compliance programs for this requirement. FIPS The Federal Information Processing Standard (FIPS) Publication is a US government security standard that specifies the security requirements for cryptographic modules protecting sensitive information. To support customers with FIPS requirements, the Amazon Virtual Private Cloud VPN endpoints and SSL-terminating load balancers in AWS GovCloud (US) operate using FIPS validated hardware. AWS works with AWS GovCloud (US) customers to Page 7 of 8

8 provide the information they need to help manage compliance when using the AWS GovCloud (US) environment. Other Compliance Initiatives The flexibility and customer control that the AWS platform provides permits the deployment of solutions that meet industry-specific compliance requirements. HIPAA Customers have built healthcare applications compliant with HIPAA s Security and Privacy Rules on AWS. AWS provides the security controls customers can use to help to secure electronic health records. CSA AWS has completed the Cloud Security Alliance (CSA) Consensus Assessments Initiative Questionnaire. This questionnaire published by the CSA provides a way to reference and document what security controls exist in AWS s Infrastructure as a Service offerings. The questionnaire (CAIQ) provides a set of over 140 questions a cloud consumer and cloud auditor may wish to ask of a cloud provider. January 2013 Eversync. All rights reserved. Page 8 of 8