inSync Cloud: Distributed Endpoint Data Protection - Druva

The goal of ESG Lab reports is to educate IT professionals about data center technology products for companies of all types and sizes. ESG Lab reports are not meant to replace the evaluation process that should be conducted before making purchasing decisions, but rather to provide insight into these emerging technologies. Our objective is to go over some of the more valuable feature/functions of products, show how they can be used to solve real customer problems and identify any areas needing improvement. ESG Lab’s expert third-‐party perspective is based on our own hands-‐on testing as well as on interviews with customers who use these products in production environments. This ESG Lab report was sponsored by Druva.

© 2013 by The Enterprise Strategy Group, Inc. All Rights Reserved.

Data Protection Challenges Today’s workforce is increasingly mobile, with a good portion of workers connecting to corporate resources outside of a traditional office. This shift has contributed to higher worker morale and reduced absenteeism—often a boost to productivity. It’s also created challenges for backing up endpoints (i.e., laptops, tablets, smartphones, etc.) distributed outside the confines of the corporate environment. While backup of endpoint data can be valuable, endpoint users neither want the responsibility of doing it themselves, nor do they like the disruption that can often accompany the process. IT organizations reported to ESG in a recent research survey that improving backup and recovery, application support on mobile devices, and improving collaboration were all among their most important IT priorities for 2013.1 These priorities present their own challenges, considering the volume of data typically retained on endpoint devices and the bandwidth required to back it up.

The Tested Solution: Druva inSync Cloud In August of 2011, ESG Lab tested the on-‐premises version of Druva inSync, a fully automated endpoint backup solution designed to protect corporate data for office and remote users using corporate infrastructure.2 Druva offers inSync as a hosted cloud service, with regional storage to serve users in any geography. Like the on-‐premises versions, inSync Cloud comes in three editions: inSync Professional, which is for installations with less than 250 users, inSync Enterprise, designed for larger organizations with up to 5,000 users, and inSync Unlimited, for organizations larger than 5,000 users. Some of the key benefits provided by the Druva inSync solution are listed here:

• Client-‐side Global Data Deduplication: Stores only a single copy of duplicate data across all users connected to an inSync Cloud data center. The deduplication happens at the client, eliminating the need to move large amounts of duplicate data across the network. Overall, full backups are faster while providing significant bandwidth and storage savings.

• WAN-‐optimized Backups: Designed to provide transparent and efficient backups over the internet. With bandwidth throttling and multi-‐threaded backup process architecture, the solution is designed to work efficiently from any location.

• Data Loss Prevention (DLP): inSync DLP enables protection of critical data on devices using native OS encryption, remote wipe, and geo-‐tracking.

• Anytime, Anywhere Access: From a web browser, iPad/iPhone, or Android mobile device, users can browse folders and files under multiple point-‐in-‐time backups or search for a file name or extension and quickly restore any point-‐in-‐time copy of any file.

1 Source: ESG Research Report, 2013 IT Spending Intentions Survey, January 2013. 2 Source: ESG Lab Review, Druva inSync: Simplified, Robust Endpoint Data Protection, August 2011

ESG Lab Review

Druva inSync Cloud: Distributed Endpoint Data Protection Date: March 2013 Author: Tony Palmer, Senior Lab Analyst

Abstract: This ESG Lab Review documents hands-‐on testing of Druva inSync Cloud, an endpoint backup solution with a focus on ease of deployment and use, near-‐continuous data protection, access and restore, and data deduplication in a mixed Windows and Mac environment.

ESG Lab Review: Druva inSync Cloud 2


• Simple to Deploy and Use: Druva inSync is designed with a focus on simplicity and ease-‐of-‐use. Easy to mass deploy and upgrade, inSync clients can be silently installed on end-‐user devices. Backups with inSync are nonintrusive and don’t impact end-‐user productivity.

• File Sharing: inSync Share provides secure peer-‐to-‐peer file sharing. Users can synchronize files between multiple devices while administrators retain visibility into sharing activity and control of sharing policies, with the ability to remotely wipe files from endpoint devices.

• Analytics: In addition to detailed reporting on an organization’s endpoint data usage and trends, a federated real-‐time search enables administrators to locate and retrieve any backed up file on any device and analyze usage trends.

• Security and Data Privacy: In addition to DLP encryption of data on the device, inSync secures endpoint data with 256-‐bit encryption both in transit and in storage. inSync Cloud ensures data privacy by providing compartmentalization of customer data. Two-‐factor encryption key management in the cloud means that Druva has absolutely no access to customer data.

The inSync Cloud Enterprise and Unlimited editions offer additional features designed to optimize performance and scalability for larger organizations:

• Delegated Administration: Enables role-‐based administration with profile administrators. • Mass Client Deployment: Administrators can set up an automatic synchronization of users and groups from

Active Directory and employ tools such as Microsoft SCCM and Casper (JAMF software) to deploy the inSync client across thousands of endpoints.

• Single Sign-‐on with SAML: Advanced identity management using Security Assertion Markup Language (SAML) for integration with Active Directory or any other ID provider.

• Global Multi-‐Region Deployment: Deployment of users with access to storage in up to three geographic regions with the Enterprise edition, and any number of storage regions with the Unlimited edition.

As seen in Figure 1, Druva inSync Cloud is designed to provide an end-‐to-‐end, capacity and performance optimized, cloud-‐based data protection option for all of an organization’s users, across any geography.

Figure 1. Druva inSync



The ease of administration and use of Druva inSync Cloud across multiple platforms were validated using ESG Lab’s own users and data from home and office locations in Northern California, Massachusetts, and New Hampshire. Specific areas of interest were client provisioning by both administrators and users as well as backup, restore, and access from heterogeneous endpoint devices.

Getting Started and Backing Up Druva inSync is a lightweight cloud service that provides data protection for Windows, Mac, Linux, IOS, and Android endpoints. ESG Lab looked at the ease of installation and management of the Druva inSync Cloud service and client software. Testing was executed in an environment that consisted of several geographically distributed Windows and Mac endpoints connecting to the Druva inSync Cloud service, as seen in Figure 2.

Figure 2. The ESG Lab Test Bed

ESG Lab Testing

Registration and Setup – ESG Lab began by activating and configuring the Druva inSync cloud service by browsing to Druva's website, clicking on the 30 day evaluation box at the top of the home page, and selecting the Enterprise Cloud Deployment. The activation and configuration of Druva inSync Cloud consisted of a few simple steps. First, ESG Lab entered basic company and contact information. inSync Cloud was immediately activated and an e-‐mail was sent to the administrator address with a link to the Druva Cloud service and credentials. Clicking on the link automatically launched the web console in a browser to complete configuration.



Figure 3. Setting up inSync Cloud

Overall, installation and configuration took about ten minutes, including configuring additional administrators, configuring the default profile, and creating the first user, as seen in Figure 3.

User Profiles – Profiles enable the inSync administrator to group users with similar backup policies into configuration “containers.” The inSync administrator can then set backup policies in the profile, which automatically apply to all the users using that profile. In user profiles, an administrator can specify numerous parameters, such as bandwidth throttling, storage quotas, whether a user can change her backup schedule, and whether a user can add additional devices, among others.3 ESG Lab created one profile, enabling all users to back up files and content, protect mobile devices, and securely share files.

Users – Next, ESG Lab configured accounts for the users whose laptops, tablets, and smartphones would be protected. For larger installations, inSync allows automated mass-‐deployment of clients and periodic import of users and groups from Active Directory, but in these tests, we had a smaller group of users, and so their accounts were created by importing usernames and e-‐mail addresses from a comma-‐separated-‐values (CSV) file. Figure 4 shows the user import dialog. When users are created, each user receives an e-‐mail with the URL of the Druva cloud service and the user’s unique authentication key.

3 See the Druva inSync Administrator’s Guide for detailed information on user profiles.



Figure 4. Importing Users Using the Druva inSync Web Console

When the welcome e-‐mails were received, the inSync Client software was installed by each user on his or her own laptop. For each user, the client installation took less than five minutes. Once the client was installed, each user activated Druva inSync, which kicked off the first backup and activated DLP and inSync Share.

Figure 5. Client Installation

Users with smartphones and tablets were able to download the inSync app from the app store, and activate it using the same credentials they used for their laptop, as seen in Figure 6.



Figure 6. Users Adding Client Devices

Backup Performance – While the initial backups were running, ESG Lab testers looked at performance monitors on their client devices. On each client, testers observed low resource utilization. Users went about their normal business, opened and edited documents using Microsoft Word or presentations using Microsoft PowerPoint, and sent and received e-‐mails using Microsoft Outlook. The systems were responsive using all of these applications and there was no measurable impact of running backups.

Figure 7. The inSync Web Console

Figure 7 shows the inSync web console after several backups had been completed. In all, 12 users with 15 devices were connected to inSync Cloud for these tests.



Why This Matters Improving backup and recovery was among the top challenges reported by IT managers in a recent ESG research survey.4 Providing an easy-‐to-‐implement, capacity-‐ and bandwidth-‐efficient cloud-‐based solution for data protection is a powerful value proposition for companies looking to protect their local and remote endpoint devices. With a simple to use GUI and a very efficient memory and CPU footprint, inSync Cloud requires no special training or expertise for users or IT administrators and no on-‐premises hardware or software to implement or manage. Combining ease of use with enterprise-‐class features such as deduplication, WAN optimization, data loss prevention, and online file sharing with a robust, regionally distributed cloud-‐based platform offers organizations a rapid path to full endpoint data protection with minimal cost.

ESG Lab was able to quickly and easily deploy Druva inSync Cloud and was protecting Windows, Mac, and IOS clients with minimal effort and no impact to users’ normal workflows within 20 minutes of sitting down at the keyboard of the server.

Data Access and Restore Over the course of several days, users were instructed to work as they normally would, creating and editing documents and presentations, sending and receiving e-‐mail, and all other normal day-‐to-‐day functions of a typical knowledge worker. Observing each subsequent backup, only the new or changed data was transferred, allowing backups to complete quickly.

ESG Lab tested data access and selective restore of files to remote clients using the inSync Client on a user’s device and using the inSync web console. As shown in Figure 8, all devices registered to a user are available for restore.

Figure 8. Selecting a Restore Point

4 Source: ESG Research Report, 2013 IT Spending Intentions Survey, January 2013.



First, a file was permanently deleted from the Documents folder on one client’s machine. ESG Lab deleted the file ESG_Lab_East.csv.

Next, a restore from the web-‐based administrator console was executed. When restoring from the console, the administrator has multiple options for delivery of the restored files, including downloading the file to the administrator's machine. As shown in Figure 9, the administrator can elect to restore the files to the user's desktop, to the original location, or to any other location on the user’s machine.

Figure 9. Restoring Files From the Web Console

It is important to note that while files can be restored to any location on the end-‐user’s machine using the Restore to given location option, the administrator must know the correct path to the location of the file. The simpler method is to simply restore the files to the original location on the user's machine.

Next, ESG Lab repeated this test from the inSync Client software. The procedure was just as easy, allowing the user to browse to exactly the correct version of the file desired, and restore it with one click. Users can also perform self-‐restores from the web, or access backed-‐up data from mobile devices, as shown in Figure 10.

Figure 10. Self Restore from the Web and Mobile Access



Finally, ESG Lab examined deduplication in the Druva inSync Cloud. After 30 days of users working normally with Druva inSync backing up users’ devices on a regular schedule, ESG Lab logged into the web console and ran the storage status report. While the cumulative capacity of all of the backups performed by the inSync server totaled 540GB, the storage space actually used was only 32.5 GB. Figure 11 illustrates the effects of data deduplication over time as observed by ESG Lab.

Figure 11. Deduplication Savings Over Time

Each user’s system was protected by near continuous data protection, with backups scheduled to run every eight hours for 30 days. Deduplication effectiveness is commonly expressed in two ways, as a percentage of the total volume of protected data that was actually stored to disk, or as a ratio of protected data to data stored on disk. In this example, the amount of data stored on disk by Druva inSync after 30 days was 32.5GB—about 6% of the total 540GB of user data protected. This represents a 94% reduction in data storage requirements or a deduplication ratio of 16:1.

What the Numbers Mean

• The amount of capacity reduction that can be achieved with Druva inSync will vary according to the retention period for backups being stored and the type of data being backed up. In this scenario, capacity was reduced by 94% over 30 days with just 12 users.

• inSync’s global, client-‐side deduplication technology is application-‐aware and saves only a single copy of e-‐mails and attachments duplicated across users. By understanding the disk-‐structure of commonly used file-‐formats, inSync performs deduplication at the object level for Microsoft Outlook, Office documents, and PDFs.

• inSync’s client-‐side deduplication also provides significant bandwidth savings because less data needs to be sent from the user device over the network to the inSync Cloud servers.

0

100

200

300

400

500

600

0 4 8 12 16 20 24 28

Capa

city (G

B)

Days

Capacity Protected Deduplicated Data Stored

94% Capacity Savings



Why This Matters ESG research indicates that cost and impact to performance are two of the leading obstacles to data deduplicated backup deployments. The ability to efficiently deduplicate data across all users’ backups with client-‐side processing addresses both of these issues by reducing the amount of data transmitted over the internet and retained on disk while providing optimal performance.

In addition, when asked to name their organization’s most important IT priorities with respect to supporting remote office/branch office locations, 32% of respondents to an ESG research survey chose improving backup and recovery processes.5 Simplifying backup and, more importantly, recovery for administrators and users creates significant value for widely dispersed IT environments with an increasingly mobile workforce.

Through hands-‐on testing, ESG Lab validated the ease of use and consistent management functions for backup and recovery of local and remote users, including Windows, Macintosh and IOS systems performing multiple simultaneous deduplicated backups with little to no impact on clients. The end-‐user experience was also simple and powerful, enabling users to configure additional folders for backup, add mobile devices, and restore files without administrator intervention.

ESG Lab has also validated that data deduplication provided by Druva inSync can be used to reduce disk capacity and bandwidth requirements significantly with minimal impact to clients. Administrators can effectively provide high-‐performance backup services to remote users, plus fast and reliable restores, using disk capacity on demand from the cloud. This lowers the cost per GB for backup data and enables companies to retain larger numbers of users’ data exponentially longer while minimizing the impact of deduplication on users’ workflows.

5 Source: ESG Research Report, Remote Office/Branch Office Technology Trends, June 2011.



Secure File Sharing, Analytics, and Data Loss Prevention inSync file sharing is designed as an enterprise-‐ready collaboration solution to enable employees to securely share files across multiple, heterogeneous devices while providing IT with visibility and control over corporate data. inSync file sharing and collaboration is integrated seamlessly with inSync’s backup and DLP, and offers IT unified policy management for end-‐to-‐end data protection and collaboration.

During the course of testing, the ESG Lab team shared screenshots, documentation, and collected data using inSync file sharing. When the client is installed, a folder is created in the user's default folder called inSync Share. Any files or folders copied or moved into the folder are automatically and securely stored in the cloud and synced across all of the user's devices. inSync provides security features expected in a corporate file sharing offering, such as user-‐ and device-‐level permissions to restrict or disable sharing and enable DLP. Druva encrypts data in flight using 256-‐bit SSL and data at rest using 256-‐bit AES.

Users can access their files from any device with Druva inSync installed, as shown in Figure 12.

Figure 12. inSync File Sharing and Collaboration

Users can share access to folders with colleagues by simply right-‐clicking the folder to be shared, selecting inSync Share, and then clicking Share this folder. Figure 13 shows the Manage Collaborators dialog box, after entering other users' e-‐mail addresses. Files can also be shared with external users using links, which expire automatically, instead of e-‐mail attachments.



Figure 13. Managing Collaborators with inSync Share

Shared folders can be unshared at any time. Once unshared, the content is deleted from the other user's machines. IT can set policies to control whether sharing is enabled for users in a profile, which other profiles they can share with, and whether they can share with external users using links. The admin dashboard gives insight into all sharing activities in the organization via an activity stream indicating users involved in sharing, files getting shared, and the time of the activity.

Detailed reporting and analytics are also included with inSync Cloud. ESG Lab’s administrator was able to locate a particular file on a specific device by simply searching for the file name. Once the file was located, the administrator has the capability to retrieve the file with just two clicks, as seen in Figure 14.

Figure 14. Analytics–Finding Content in the Cloud



inSync integrates data loss prevention (DLP), enabling organizations to track devices and prevent unauthorized access in case of loss or theft of the device. Data is encrypted on laptops and mobile devices to protect important corporate data. As shown in Figure 15, the locations of devices are displayed on a clickable active map.

Figure 15. Tracking Devices with DLP

Finally, ESG Lab decommissioned a device using the administrator console, and then confirmed that the device's data was wiped when the device next connected to inSync. The administrator console also provides the capability to conduct a selective wipe on mobile devices wherein only data within inSync’s container is wiped. This feature is particularly useful for BYOD devices that contain both personal and corporate data.



The Bigger Truth Reducing backup and recovery times for heterogeneous endpoint devices is a perennial challenge reported by IT managers in ESG research. Providing an easy-‐to-‐implement, capacity-‐ and bandwidth-‐efficient cloud-‐based solution for data protection is a powerful value proposition for companies looking to protect their local and remote endpoint devices. With a simple-‐to-‐use GUI and transparent operation for end-‐users, inSync Cloud requires no special training or expertise for IT administrators. Combining ease of use with enterprise-‐class features such as deduplication, WAN optimization, secure online file sharing, and data loss prevention with a distributed cloud infrastructure that keeps storage close to users, inSync gives customers a rapid path to full endpoint data protection with minimal cost and effort.

ESG Lab was able to quickly and easily deploy inSync Cloud and was protecting distributed remote Windows, Mac, and IOS clients with minimal effort and no impact to users’ normal workflows within 20 minutes of sitting down at the keyboard.

Through hands-‐on testing, ESG Lab validated the ease of use and consistent management functions for remote users’ heterogeneous endpoint devices, including Windows, Mac, and IOS systems performing multiple simultaneous deduplicated backups of heterogeneous systems with little to no impact on clients. Secure online file sharing was particularly easy to set up and manage, including user quotas and administrator control. inSync Cloud also provided detailed, robust reporting and analytics, enabling an administrator to quickly locate files anywhere in the environment, locate endpoint devices, and remotely decommission devices and delete data.

ESG Lab found compelling end-‐user benefits as well—backups were transparent and nonintrusive, with the ability to self-‐restore from any previous backup to any location. The use of a single client for backup and file sharing was a highlight, providing universal access to backups and file sharing from any device.

Organizations are still looking for cost-‐effective, easy-‐to-‐manage solutions for endpoint data protection while they begin to embrace file sharing and collaboration services. ESG Lab was able to deploy inSync Cloud and begin protecting users’ laptops and mobile devices in 20 minutes, while providing a fully integrated, highly secure file sharing and collaboration service. With enterprise-‐class distributed data deduplication and user management built-‐in, Druva delivers a compelling, multifaceted endpoint data management solution for businesses of all sizes.

All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-‐copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of The Enterprise Strategy Group, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at 508.482.0188.