Smarter Endpoint Backup. This whitepaper discusses Druva's unique approach to smarter backup of endpoint devices.

Transcription

1 Smarter Endpoint Backup This whitepaper discusses Druva's unique approach to smarter backup of endpoint devices.

2 Table of Contents Introduction... 2 Challenges of Endpoint Backup... 3 Storage Requirements are Growing Faster than Available Bandwidth... 3 Wireless WANs Have Unreliable and Spotty Coverage... 4 Non-VPN Data Transfers are Subject to Higher Security Risks... 4 Resource Intensive Backup Diminishes User Experience on Endpoints Limitations of Existing Solutions... 5 Sub-optimal Server Triggered Backup Architecture Dependence on Low Latency, High Bandwidth Network Lack of Support for Mobile Devices... 5 No Protection Against Data Breach... 5 Highly Intrusive End-user Experience... 5 Costly Deployment and High Maintenance Druva insync Smart and Secure Backup for Endpoints Client Triggered Backup Architecture... 6 Enterprise Security... 6 Smarter Deduplication... 7 Advanced WAN Optimization Integrated Data Loss Prevention... 9 Mobile User Empowerment Non-intrusive End-User Experience Enterprise-grade Scalability Flexible Deployment and Easy Management Secure File Sharing and Collaboration...11 Enhanced IT Control and Visibility with Rich Data Analytics...11 Laptop Backup Benchmarks About Druva Data Sources and References Smarter Endpoint Backup

3 Introduction The face of the modern enterprise is changing as more and more employees are using laptops and mobile devices leading to a rapid increase in the number of endpoints accessing key corporate data. A recent IDC study indicates that the global mobile worker population will reach 1.3B representing 37%+ of total workforce by Of this growing workforce over 70% of individuals never plan a backup of their endpoint devices. The risk of loss of key corporate data stored on endpoints is greater than ever and will continue to rise. The IT department of an enterprise is ultimately responsible for the security of corporate data and needs to ensure that data on endpoints is securely backed up. This whitepaper discusses the challenges that IT faces in performing secure endpoint backups and describes important shortcomings of existing solutions. It concludes with a discussion of how Druva insync solves these challenges and provides a smarter endpoint backup for enterprises. 2, 3, 4 Reasons for Investing in a Smart Endpoint Backup Solution Corporate data loss is rising 260% annually Nearly 38% of all corporate data resides on users devices 17% of these devices lose data that cannot be recovered About 200 million employees work remotely, i.e. they are not at their desk while accessing s. Only 35% of enterprises backup laptops, even fewer backup smartphones & tablets Over 70% of mobile employees never plan a backup either before or during travel Over 600,000 notebooks are lost at US airports every year 2 Smarter Endpoint Backup

4 Challenges of Endpoint Backup Endpoints are different from desktop PCs in that they connect over public WANs, and are typically battery powered which makes their backup significantly more complex than that of PCs. Several factors make endpoint backup challenging: The Main Factors That Drive the Increased Complexity of Endpoint Backup: FAST BACKUP SPEED MIN MAX 1 Storage requirements are growing faster than available bandwidth 2 Wireless WANs have unreliable and spotty coverage 3 Non-VPN data transfers are subject to higher security risks 4 Resource intensive backup diminishes end-user experience Storage Requirements are Growing Faster than Available Bandwidth Recent statistics show that an average corporate laptop has about 10GB of critical corporate data a 20X increase from At the same time, the bandwidth on corporate networks available for laptop users has increased at a much slower pace, making backup of these laptops significantly more difficult. Total Storage & Bandwidth Needed by Traditional Software to Backup 1,000 Users 10,000 20X INCREASE 10,000 MB Data (MB) 8,000 6,000 4,000 2, KB/Sec 500 MB 100 KB/Sec 512 KB/Sec 1,000 MB 2,000 MB 1,000 KB/Sec Bandwidth (KB/Sec) 0 YEAR Source: Matt s Hardware Trends website, UCLA Computer Science Dept Study One case that is specifically problematic for IT is backup of data. Almost 80% of corporate laptop data is in the form of archived s. The rate of addition/change of data is about 1% but the actual differential change doubles to about 2% because of the archival formats used by most clients (like Microsoft Outlook), which make a horde of post-processing and index changes on archived data. 3 Smarter Endpoint Backup

5 Transferring this differential data (160 MB) over a WAN connection can be especially problematic and is likely to interfere with users tasks such as reading and answering new s. Total Storage & Bandwidth Needed by Traditional Software to Backup 1,000 Users Total Storage (TB) Total Bandwidth (MB/Sec) YEAR Source: Matt s Hardware Trends website, 4 UCLA Computer Science Dept Study Based on the graph above the backup of data from 1000 corporate laptops using traditional backup software requires 30 TB in storage. Wireless WANs Have Unreliable and Spotty Coverage Unlike desktop PCs, laptops and mobile devices are often not connected to a corporate LAN or a VPN. Users connect their endpoint devices via networks with varying level of reliability and bandwidth e.g. hotspots, home networks, airport networks. This complicates the task of backing up an endpoint device in three main ways. First, unreliable networks may cut out at any time e.g. right in the middle of a backup. Second, the bandwidth assigned to endpoints on these networks is significantly lower than the bandwidth available on corporate networks. Third, endpoint devices do not get a static IP address. Sometimes the endpoint devices do not even get a publically visible IP address on these networks making it very difficult for the backup server to connect and exchange data with the endpoint device. Non-VPN Data Transfers are Subject to Higher Security Risks Ensuring security is the most obvious challenge of endpoint device backup when compared to desktop backup. Endpoint devices typically connect over non-vpn networks such as Wireless WANs. For instance, employees may use their devices over unprotected hotspots. Given the possibility of unencrypted data transmission over WANs, there is a much higher security risk with endpoint backup than with desktop backup that is performed over a LAN connection. Resource Intensive Backup Diminishes User Experience on Endpoints Mobile endpoints typically have less processing power than desktop PCs in order to conserve battery life. As a result, backup software may consume critical processing resources in endpoints when run simultaneously with other applications, leading to a poor end-user experience. 4 Smarter Endpoint Backup

6 Limitations of Existing Solutions Most of the existing solutions ( legacy solutions) are derived from tape backup or network backup solutions for mainframes. Consequently, legacy solutions have multiple limitations when used with endpoints: Sub-optimal Server Triggered Backup Architecture Server-based backup systems use a central backup server, which initiates backup and restore requests. Such architecture works relatively well for desktop PC backup. However, server triggered backup architecture imposes three key limitations with regard to endpoints: 1. SECURITY The server initiates and sends network requests outside the corporate network when a user is traveling. Unlike a web or server, this is a special case and needs more attention. 2. ACCESS TO THE USER S DEVICE A user s device must be visible to the server on a published IP address. This becomes a problem when the user is traveling and connected through WAN/Internet. 3. SOLUTION SCALABILITY As the number of endpoints grows, server load becomes a bottleneck when handling backup schedules, reconnects, dependencies on last backup status, etc. Dependence on Low Latency, High Bandwidth Network Thanks to the tape-backup legacy, most network backup systems today use same old R-Sync style checksum algorithms for incremental backups. These algorithms require a large number of network interactions and deteriorate the performance of legacy backup systems, which need low-latency for less network turn-around times and faster execution. Endpoint devices rarely have the luxury of low-latency networks; these devices usually connect via WANs that have variable reliability. Lack of Support for Mobile Devices Legacy systems often do not support mobile operating systems such as ios, and Android. Lack of support for smart phones and tablets is a major shortcoming given the sharp rise in enterprise use of these devices. No Protection Against Data Breach These systems do not provide any functionality ensuring that data cannot be accessed maliciously from a lost or stolen device. DLP is not a major concern for desktop PCs, since desktops rarely get lost or stolen. However, DLP has become a major concern as more and more employees are using endpoint devices for work. These small and mobile devices often get lost offsite (airports, coffee shops etc.) and can fall into the wrong hands. Highly Intrusive End-user Experience Legacy systems are resource intensive and significantly compromise the end-user experience by utilizing a high percentage of available CPU and bandwidth resources. Users often have to stop working, and wait for the backup to complete; eventually they begin to dread and avoid backups altogether. Costly Deployment and High Maintenance Traditional systems require significant time and effort in order to achieve an enterprisewide rollout and maintenance over time. The installation process often requires weeks with onsite professional services help. Maintenance usually includes a costly contract with onsite professional services help. In addition, these solutions are limited to an on-premise deployment, which suits only some organizations. Other organizations may prefer a cloud deployment because of its easier rollout, on-demand scaling, and flexible pricing. 5 Smarter Endpoint Backup

7 Druva insync Smart and Secure Backup for Endpoints Druva insync is an automated enterprise endpoint backup solution that protects corporate data while in office or on the move. It features simple backup, point-in-time restore, and patent-pending deduplication technology that increase backup speed and minimize resource use. With several unique features, insync is designed to handle endpoints and overcome limitations of legacy solutions. Client Triggered Backup Architecture Druva insync uses a client triggered backup architecture enabling high levels of scalability and security. insync has two components : 1. insync CLIENT is a client agent that is installed on endpoints. It is equipped with sufficient backup intelligence to initiate and accomplish backup. Configuring a client takes five simple steps and can be completed within minutes of installation. 2. insync SERVER is a software service that runs either on a dedicated server on-premise server or on cloud, and scales to handle terabytes of enterprise data. It accepts backup and restore requests on published IP addresses. Enterprise Security insync was built from the ground up with highest security standards in mind. insync employs the following security technologies and practices: DATA ENCRYPTION insync features 256-bit SSL encryption for data in transit and 256-bit AES encryption for data in storage. CERTIFICATIONS insync runs on Amazon Cloud infrastructure, which is SAS-70 certified. Druva cloud operations and design is also ISAE 3000 certified. ENCRYPTION KEY MANAGEMENT While some cloud providers use the same encryption key for all of their users and fail to compartmentalize data from their multiple customers, insync, in an industry-first, provides sophisticated two-factor encryption. insync uses unique encryption key management for each customer as well as unique authentication and access control for each customer. This setup ensures that no one, including Druva employees, can gain access to a customer s encrypted data except the customer with access credentials. SINGLE SIGN-ON - insync uses Security Assertion Markup Language (SAML), an XML-based open standard, to provide single sign on capabilities. Users can securely sign-on to insync over the Web using their credentials on external identity services, such as Microsoft Active Directory. 6 Smarter Endpoint Backup

8 Smarter Deduplication Within any enterprise, proliferation and preservation of many versions and copies of s and documents contribute to tremendous data growth. insync s global client-side data deduplication technology eliminates unnecessary duplication and saves a single copy of content that is duplicated across all users and endpoints of an enterprise.. MORE THAN 80% of enterprise data 5 is duplicated across users, creating storage & bandwidth bottlenecks during backup Steps to Eliminate Duplicates in Backup The insync client agent 1 continuously monitors & captures file level changes. Before performing a backup, it uses patent pending advanced 2 file fingerprinting to check with the server if a file, or even a part of a file has been backed up before, by any user from any endpoint. 5 During restore, a user sees all his files irrespective of the duplicates. The server maintains only a single copy of duplicated 4 data & multiple references. 3 content Then, it sends only the unique to the server. 7 Smarter Endpoint Backup

9 Salient Features of Druva s Deduplication Technology Global: data redundancy is eliminated 1 across all users and endpoints Client-side: duplication checks and caching of these checks are performed at the client substantially reducing bandwidth and speeding up backups. Application aware: understanding of on-disk formats of applications (e.g., Outlook, Office, & PDF) results in 100% accurate, faster deduplication and reduced storage requirements. High performance & Scalable: HyperCache technology reduces disk I/O by up to 80% and optimization for SSDs improves overall backup throughput by 5x. A detailed explanation of deduplication techniques and Druva s innovative approach to deduplication is available in a white paper on data deduplication for endpoints at 8 Smarter Endpoint Backup

10 Advanced WAN Optimization insync automatically detects networks (LAN/WAN/VPN) and changes in a network. Its advanced WAN optimization boosts speed and efficiency of data transfers over WAN networks. insync optimizes packet size and uses parallel connections to make best use of available bandwidth. When a backup is interrupted over a weak network, insync ensures that the backup is resumed. Users or IT administrators can set limits on percentage of network bandwidth and CPU usage. insync s WAN optimization makes it highly suitable for endpoints as they often connect over weak WAN links. Optimizes Packet Size based on network noise, & latency Smart Bandwidth throttling adapts to varying network conditions Auto-Resume Backup saves critical user time & productivity Integrated Data Loss Prevention insync prevents critical corporate data from falling into the wrong hands. With insync, data on an endpoint device is encrypted so no one but the device owner or an IT administrator can access that data. insync also allows remote wipe out of endpoint data. insync puts IT in control; IT can set policies enforcing which files on a device are encrypted as well as when files should be remotely wiped out (e.g. if device has not connected for N days). Further, IT administrators can immediately wipe a device if they believe that it has been compromised. Finally, insync uses an advanced positioning algorithm based on Wi-Fi access, GPS satellites and cell towers to locate endpoints with a meter accuracy. Protect critical data with automated encryption & decryption on selected files & folders Remotely wipe out of endpoint data on lost devices (administrator initiated or by auto-delete policy) Geo-locate endpoints with an accuracy of 10-20m Use same set of policies (folder selection, include & exclude filters) for backup and DLP. 9 Smarter Endpoint Backup

11 Mobile User Empowerment In addition to working across multiple operating systems such as Windows, Linux, and Mac OS, insync offers a strong suite of data access and protection capabilities for all mobile endpoints laptops, tablets, and smartphones. Users can access their data including PDF, Word, Power Point, and Excel, files from their mobile devices such as ipads, iphones and Androids. In addition, mobile devices can be backed up and enabled for data loss prevention. Access data anywhere, anytime with iphone, ipad & Android apps Backup and encrypt critical data on smartphones & tablets Track and remotely deactivate stolen or lost mobile devices Easily manage mobile policies which reside in the same user profiles as backup & DLP Non-intrusive End-User Experience Employees expect enterprise products to have the same intuitive interfaces as consumer products. Druva is well aware of this fact and has built insync for endpoints, and with the end user in mind. The insync client has an easy to use interface, runs in the background without interfering with users tasks, and requires virtually no end-user interaction. With insync employees will not have to interrupt their work just to wait for a backup to complete. Enterprise-grade Scalability Most enterprises grow their workforce faster than they can hire the needed supporting IT staff. Therefore enterprises need software solutions that can seamlessly handle increases in the number of end users. insync utilizes Amazon s AWS infrastructure to provide true on demand storage expansion. Enterprises can tap into the cloud storage and increase the number of users without ever hitting a limit. With on premise deployments insync server can scale to handle up to 10,000 users on a single server. Further, insync uses HyperCache technology to allow an increase in the number of users. HyperCache is a server-side selective in-memory cache that reduces disk I/O and enables Druva s unique deduplication technology to scale while saving on storage and bandwidth. 10 Smarter Endpoint Backup

12 Flexible Deployment, and Easy Management Choosing between storing data on cloud or on premise is often based on factors such as budget, timeline, IT strategy, corporate policies, and external compliance regulations among others. insync gives businesses multiple options for deployment. It can be deployed on cloud, on premise or even as a hybrid providing benefits of both on cloud and on premise options. insync is designed for simplicity and ease of use allowing IT administrators to use their time efficiently. insync can be installed in minutes and requires virtually no maintenance. It comes with default user profiles that can be quickly modified to change backup and restore policies for a new profile. 1-Click configuration allows administrators to set up commonly used data sources such as , desktop, documents etc. for backup. With its mass deployment feature that takes advantage of Active Directory, Microsoft SCCM, and Casper, insync can be easily deployed to numerous end users without requiring their involvement. The clients, further, upgrade automatically when a new version of the application is available. IT administrators can centrally apply policies and monitor alerts, server health, and user statistics. Elastic architecture supports large-scale enterprise deployments on cloud or on premise Global, mass client deployment options make getting started quick and efficient Secure File Sharing and Collaboration insync provides end users with rich collaboration features. With insync once users share a folder on their device, the contents of that folder are automatically accessible on a collaborators device as well as through the insync web interface. Users can also keep their files synced across several endpoints. In addition, users can share a file with others who do not have insync by creating, with one click, a URL link to the file and sending them the URL. IT administrators have the ability to enforce security policies, including permissions to share files within and outside the organization, link expirations, sharing on mobile devices etc. IT also gets visibility into all sharing activities in the organization. Enhanced IT Control and Visibility with Rich Data Analytics The statement knowledge is power holds especially true when it comes to IT management. insync s Data Analytics gives IT full visibility into corporate data stored on endpoints. With insync s powerful tools, IT can analyze trends and use insights gained from these reports to plan for future storage and bandwidth needs. insync also provides real-time federated search capability which enables e-discovery by allowing IT to discover and track confidential files across any endpoint device across the organization at any time. 11 Smarter Endpoint Backup

13 Laptop Backup Benchmarks The following table benchmarks insync s performance against incumbent installations at four different customers in different industry verticals. These benchmarks clearly demonstrate the benefits delivered by insync in terms of backup time and storage utilization. CUSTOMERS NO OF PCs AVG. BACKUP TIME LAN (MIN) AVG. BACKUP TIME VPN/WAN (MIN) TOTAL STORAGE USED (TB) Old App insync Old App insync Old App insync LARGE FINANCIAL CORP. OIL & GAS COMPANY CONSULT. GROUP GRAPHIC COMPANY N/A N/A FOR EXAMPLE, if an with 1 MB attachment is sent to 1000 users, traditional incremental backup software would backup this 1 MB attachment from each of the 1000 different mail boxes. Druva insync would, in contrast, backup 1 MB from the first user, and then skip all the other 999 copies as duplicates, saving over 99.9% backup time, bandwidth and storage. Average Reduction in Backup Time Average Reduction in Sorage Utilization 100% Traditional Backup 30% Traditional Backup Druva insync 20% Druva insync 50% 10% 0% Backup Time 100 Mbps LAN (mins) Backup Time 1 Mbps WAN (mins) 0% Server Storage (TB) 12 Smarter Endpoint Backup

14 About Druva Druva offers a full suite of endpoint data management solutions for enterprise laptops, PCs, smart phones, and tablets. Its flagship product, insync, empowers a mobile workforce with automated backup, file sharing & collaboration, data loss prevention, and rich analytics. Deployed either on the cloud or on premise, insync is the only solution built with both IT needs and end-user experiences in mind. Druva has over 1,250 customers and protects 900,000 endpoints across 46 countries. With offices in the United States, India and the United Kingdom, Druva is privately held and is backed by Nexus Venture Partners and Sequoia Capital. Information on Druva is available at Data Sources and References 1. IDC Study, Worldwide Mobile Worker Population, 2. Gartner Report # Options for PC Data Backup 3. tom s hardware: 15 Years of Disk Performance, 4. PC World / Ponemon Institute, Laptops lost like hot cakes, us_airports.html 5. Microsoft Report SIS and its effects at Microsoft Druva, Inc. Americas: Europe: +44.(0) APJ: sales@druva.com