George Crump

by

The performance impact of retention means that VMware snapshots have a high cost, which further means that IT professionals must compensate by investing more than they should into storage and backup infrastructure. Below are the best practices of VMware’s snapshot functionality, according to VMware’s knowledge base article:

  1. Don’t Use Snapshots As Backups
  2. While the maximum number of supported snapshots per virtual machine is 32, the best practice is not to use more than 2 or 3.
  3. Don’t retain a snapshot for more than 72 hours.
  4. Ensure that snapshots are deleted when using third-party backup software
  5. Never increase the virtual machine disk size while there are active snapshots.

The weaknesses of VMware’s Snapshots are just one of the hidden costs of using VMware in the data center. To learn all four, watch our on-demand webinar, “The 4 Hidden Costs of VMware“.

VMware Snapshots Are Not Backups

VMware states the reason VMware snapshots should not be considered backups of virtual machines (VMs) is “The snapshot file is only a change log of the original virtual disk. It creates a placeholder disk, virtual_machine-00000x-delta.vmdk, to store data changes since the snapshot was created. If the base disks are deleted, the snapshot files are insufficient to restore a virtual machine.”

The need to track changes in a separate file means that every time new data is written to a VM’s primary volume, it leads to significant overhead and dependency on the original volume. The overhead limits customers’ ability to use VMware’s snapshot technology for backup because only two or three snapshots can be active at any point in time. The dependency is the final nail in the coffin. If the primary fails, then all of your snapshots become useless.

The Impact of VMware Snapshots Not Being Backups

Most customers would still choose a separate backup software solution even if VMware could provide unlimited snapshots without performance impact. The fact that VMware snapshots are so hindered forces customers to invest more heavily in a backup solution. The weakness of VMware’s data protection capabilities has led to the creation of companies like Veeam and fueled its growth.

Backup solutions are the only products that can extract any usefulness from VMware Snapshots. They can execute one VMware snapshot, mount it to their backup application, and back it up. Then when the backup completes, the software can delete the snapshot it took so it doesn’t impact overall performance. That same knowledge base article advises IT to make sure their backup software selection can delete the snapshots it takes. (Item 4 above)

The Cost of VMware Snapshots Not Being Backups

VMware’s deficient snapshot capability is not unique. Although not as severe, many dedicated storage systems have similar limitations on how frequently you can execute a snapshot and how long you can retain those snapshots. All of the legacy snapshot technologies are plagued with this problem. Each successive snapshot depends on the snapshot before it, and all snapshots depend on the original volume. If that original volume is removed, all the snapshots are invalidated.

One of the most important priorities for IT is to protect the digital assets that the organization creates and uses to make decisions. Since that priority is paramount, IT must work around the weakness in snapshot technology and invest in a separate process, backup, and recovery, to mitigate the risk.

The investment in the backup and recovery process is not insignificant. There is the cost of the backup software and the need for and cost of a separate storage system. There is also the cost of time to transfer that data from production storage to the secondary storage device. The transfer time means significant gaps in which data is unprotected, something ransomware uses to its advantage. Finally, there is also the time involved in transferring data back into production if something goes wrong with primary storage. There is a place for separate backup and recovery, but it should not be the primary means to protect and recover production data.

IT professionals largely ignore the cost impact of these limitations because they assume that there is no alternative.

The Clone Alternative to VMware Snapshots

As discussed in our previous article, “Snapshots or Clones for Data Protection”, a Clone, i.e., a complete copy of a virtual machine or volume, except for one limitation, is a much better means to protect data:

  1. Clones are independent
  2. Clones don’t impact performance
  3. Clones can be retained indefinitely

A limitation of clones is that they are exact copies of the original, which means there is a transfer time problem and a capacity consumption issue. This limitation goes away, though, if, at an infrastructure level, global inline deduplication is integrated into the core code. Global inline deduplication enables the creation of copies of any virtual machine, or even the entire environment. The clones can be made near instantly, and they, initially, don’t consume any capacity.

The problem is that most deduplication technology is an afterthought, especially within hypervisor software. VMware introduced deduplication into vSAN years after the initial release, and Nutanix waited even longer. Adding deduplication as a bolt-on years after the initial introduction means that the algorithm adds processing overhead to the environment, dramatically impacting performance and decreasing virtual machine density.

To some extent, IT can work around the overhead of deduplication by buying more powerful servers and adding more RAM to those servers, all of which add significant costs to the infrastructure. Alternatively, IT can purchase a dedicated storage array. Still, as we explain in our article, “The High Cost of Dedicated Storage,”, that approach also increases the cost of the infrastructure.

IOclone: Eliminating Costs While Increasing Resiliency

VergeIO integrates deduplication into VergeOS, and it isn’t a bolt-on. Global Inline Deduplication has been at the core of VergeOS since day one. As a result, it operates very efficiently and with no performance impact compared to legacy solutions. This means creating a clone using VergeOS’ IOclone capability; it happens instantly with virtually no initial impact on capacity. Also, these clones are not dependent on the original copy. They are standalone and don’t impact performance, nor do they have retention limitations.

VMware snapshots have a high cost

VergeOS’ Global Inline Deduplication is also WAN aware, so IT can replicate production data and clones to remote DR sites or other data centers using minimal bandwidth and time. Moving data to a second VergeOS instance meets the “one copy off-site” requirement common in most data protection strategies.

Thanks to VergeOS’ foundational implementation of global inline deduplication, IOclone merges the best of both snapshots and clones to deliver unprecedented data protection and resilience. It is also why we refer to them as snapshots within our GUI. It is another example of the benefits of solving problems holistically at the infrastructure level instead of myopically at the data level. Watch our on-demand webinar, “Creating a Holistic Ransomware Response,” to see another example of solving problems at an infrastructure level.

While some VergeIO customers have eliminated backup as a separate process, you still may want to continue with your backup and recovery strategy, which VergeOS supports. Even if you do, the sophistication and expenses of that process are significantly reduced. While VMware snapshots have a high cost, IOclone does not. It is part of the reason customers who select VergeOS as their VMware alternative realize a reduction in the total cost of ownership by as much as 80% in addition to 30% or larger upfront licensing savings.

Filed Under: VMwareExit Tagged With: ,

by

At Verge.IO, we speak with two or three VMware customers daily, and they are all surprised when we expose VMware’s licensing paywall. Sure, they know the obvious upfront costs of VMware. Still, when they see the potential of VergeOS’s complete and fully integrated operating environment, they begin to understand that it is not just the cost of the license fee; it is also the cost associated with all the other modules or hardware you must buy because of the “modularity” of VMware’s offering.

VMware's Licensing Paywall

In our upcoming webinar, “The 4 Hidden Costs of VMware,” we dive deep into ways that, from a technical standpoint, VMware’s technology uses a paywall that effectively keeps your organization from being competitive. In this article, we will focus specifically on how VMware’s modular licensing model costs you money.

The Expensive Nature of the Three-Tier Architecture

The data center has three tiers; networking, computing, and storage. The legacy three-tier architecture consists of the following:

  1. A network built from proprietary network hardware from companies like Cisco.
  2. A server tier virtualized by something like VMware vSphere or Microsoft Hyper-V.
  3. A storage tier built from proprietary hardware from companies like Pure Storage or Dell/EMC.

The problem with this approach is it is costly and complex to manage. It typically requires experts for each tier, raising operational costs. It also requires continuous fine-tuning to ensure each workload gets the correct performance level.

Failed HCI Created a VMware Paywall

A few years ago, VMware had the idea of expanding what it did to the server tier, and virtualizing the other two tiers. They brought to market vSAN, purchased what would become NSX, and ushered in the Hyperconverged Infrastructure (HCI) era. The promise was that life would be so much simpler for overburdened IT professionals.

Fast forward to today, and most organizations continue to run a traditional three-tier architecture, and IT pros are still beleaguered with IT tasks. What went wrong with HCI nirvana?

The first problem is that from a technology standpoint, the software-defined versions of networking and storage that VMware and others have brought to market pale in comparison to the specialized versions. There is also a challenge because each of these three software components is a separate code base, each representing double-digit millions of lines of code. Jamming them into a single server and attempting to scale out with multiple servers creates performance and scale issues. These technical issues require you to increase your hardware investment or stay with the legacy three-tier architecture. We explore them in our webinar.

VMware's Licensing Paywall


The second problem is from a business standpoint. VMware charges a lot for these licenses, so the tried and true hardware approach remains more appealing. Then there are also the challenges of all of the different versions of VMware, each with its own set of limitations.

vSphere Essentials is a VMware Paywall

VMware Essentials and Essentials Plus are designed to provide small to medium-sized data centers with a cost-effective way to acquire VMWare. Essentials is limited to no more than three physical nodes and they are licensed to no more than six total processors. The typical configuration is a two or three-node cluster with two processors in each server. A processor with more than 32 cores consumes two of the processor licenses.

These solutions are priced aggressively but have the most expensive paywall to get through in order to get the features you need. Essentials features are as bare as you can get and, for the most part, provide only the virtualization layer. Essentials Plus adds the basics of what you hope to get by virtualizing servers like vMotion, Cross Switch vMotion, High Availability, and vSphere Replication. The upcharge to Essentials is significant, more than 10X the price!

Another example of VMware’s licensing paywall is that neither Essentials nor Essentials Plus includes vSAN. To get vSAN, customers need to purchase VMware HCI Kit Essentials, which is 3X the cost of Essentials Plus. The result is that most customers we speak to, use VMware Essentials Plus with a dedicated SAN, skyrocketing the infrastructure cost. As we discussed in our last article, “The High Cost of Dedicated Storage,” the delta of adding server class flash drives to a server instead of buying a dedicated array is significant. It is also important to note that neither of the two Essentials editions support Storage vMotion.

Remember networking? None of the three flavors of Essentials does much with networking beyond a virtual switch. If you want to use commodity switches instead of more expensive proprietary switches, VMware will offer you NSX. It also has more advanced capabilities like routing, firewalling, and virtual private networking. All of these capabilities can dramatically reduce data center costs, but the cost of NSX more than doubles the cost of the implementations.

VMware Essentials is a perfect example of why understanding the Total Cost of Ownership (TCO) is critical. VMware’s licensing paywall makes the TCO of your infrastructure increase with each upgrade. While the entry price may be very attractive, the total cost is not. The cost of forcing small to medium-sized businesses to use the proprietary network and storage hardware to avoid additional software licensing is significant. Each component is potentially 25X or more the cost of the Essentials software.

It doesn’t have to be this way! Both storage and networking components have long since been commoditized, with very reliable off-the-shelf alternatives available at a fraction of the cost. Yes, the software driving this hardware must be at least on par with the proprietary solutions. Again in our webinar, we will dive deep into that comparison.

Finally, there is the success penalty when your organization grows to the point that it needs more than three nodes or six processors in a cluster. The uplift from Essentials more than doubles, again, the price of your Essentials installation. Then you get to deal with a whole new level of modularity and feature compromise as VMware presents you with Standard Editions, Advanced Editions, Enterprise Editions, and Professional Editions, each with limitations and cost increases as you move to the next level.

vSphere Standard is a VMware Paywall

VMware’s licensing paywall doesn’t stop with Essentials. The story is the same for larger organizations already having vSphere Standard or vSphere Enterprise, except they are starting at a much higher price point. Pricing is still per CPU with limitations on the number of supported cores. As with Essentials adding vSAN or NSX doubles or triples the cost to license each CPU.

There are also upgrade options for “standard” users. For example, to get deduplication, you must upgrade from standard to advanced. You may be able to deduplicate data, but you inflate your price by almost 2X to get it. Do you want data-at-rest encryption? That is not in vSAN Advanced. You need to upgrade to Enterprise, almost doubling the price again!

Have you had enough?

VMware's Licensing Paywall

The Paywall-Free TCO of VergeOS

VergeOS integrates the networking, hypervisor, and storage into a single cohesive code base. It is one piece of software, not three separate modules whose only integration is that the logos match. From a technology perspective, the common code base means VergeOS can deliver better performance and greater machine density, even using your existing hardware. From a TCO perspective, it means you can get your sanity back.

VergeOS is priced per Node. You are free to put as many processors, cores, as much RAM, and storage as you want in that node. There is no additional charge. VergeOS comes with complete Layer 2 and Layer 3 network functionality, enabling you to use commodity off-the-shelf switches when you are ready, and eliminate purchasing purpose-built hardware like firewalls. To experience all the power of VergeOS’ networking capabilities, watch our latest LightBoard video, “The Advantages of VergeOS Networking.”

VergeOS also includes powerful and efficient storage functionality, including the industry’s most advanced global inline deduplication, data protection, disaster recovery, and ransomware resiliency. It leverages flash drives and hard disk drives inside the nodes to deliver the highest performance levels at a fraction of the cost of traditional storage systems.

Operational costs plummet with VergeOS. Our single code base means an IT Generalist can administer the entire environment. Our intelligent learning algorithm eliminates the need to fine-tune and manage redundancy settings. It provides complete self-optimization and self-healing.

As you transition more of your infrastructure to VergeOS, your TCO continues to improve. Our most frequent type of customer is a VMware convert, followed closely by Hyper-V customers. In most cases, they start with an upfront cost reduction of 35% to 50% and drive toward a TCO of well over 70%.

Conclusion

If you have had enough of VMware’s licensing paywall limiting how your organization can fully leverage innovations in technology to lower costs and drive innovation, then it is time to take a look at VergeOS. Reach out to us to schedule a short technical overview of the difference VergeOS can make.

Filed Under: Virtualization Tagged With: ,

by

Because Hyperconverged Infrastructure (HCI) and Software Defined Storage (SDS) have failed to live up to their promises, most IT leaders assume there is nothing they can do about the high cost of dedicated storage. A recent IDC study indicated that over 50% of IT planners ready for a storage refresh consider HCI, but they rule it out the majority of the time. As a result, three-tier architectures continue to be the default architecture for most data centers.

The Problem with Dedicated Storage Architectures

Dedicated storage architectures, either a storage area network (SAN) or a network-attached storage (NAS) system, are expensive to purchase, maintain and refresh. The primary problem is the software that drives the storage products. It is laden with features that are inefficiently implemented. As the product matures, additional features are often “tacked on,” making them even more inefficient.

The High Cost of Dedicated Storage

These inefficiencies mean that vendors must configure the storage hardware that comes with their storage software in such a way that it can mask all of its inefficiencies. This compensation dramatically increases the total solution’s cost significantly as the customer must pay for the additional computing power and memory. These inefficiencies also lead to the inexplicably short life span of storage infrastructure. It forces customers to go through a costly refresh cycle every four to five years and make costly upgrades or deploy additional storage silos as new workloads come online.

Software Defined Storage is Still a Dedicated Storage Architecture

Software Defined Storage (SDS) has the same problem as dedicated storage architectures. The software is often inefficient; you must still buy hardware and dedicate it to storage. Most SDS solutions make you buy new hardware to go with their software. They can not take advantage of your existing hardware investment.

Dedicated Storage Shouldn’t Exist

Beyond compensating for the inefficiencies of dedicated storage hardware and SDS, the reality is that the storage software that drives dedicated arrays and NAS systems, runs on the same server type that you would run a hypervisor or any other application on. That server has built-in networking, and in most cases, it has 24 or more bays for storage media. The same applies to most network hardware. They are servers running a specific application.

Buying multiple servers to do different things when in actuality, one server armed with efficient software could do it all, dramatically increases CAPEX and OPEX. The cost to manage and maintain this stack of at least three different servers is untenable. The result is a complex environment that requires storage, virtualization, and networking specialists, instead of a single IT generalist, which further raises costs. Converging these three separate software stacks is the impetus behind Hyperconverged Infrastructure (HCI).

Why HCI Didn’t End Dedicated Storage Architectures

2010 when HCI first came to market, it seemed like it was a sign of the end for dedicated storage architectures, but that never materialized. Over a decade after the first HCI solutions appeared, dedicated storage architectures are more prevalent than ever. Industry pundits like Chris Mellor label HCI a “niche market.” How could such an obvious choice for consolidating storage, virtualization, and networking, both hardware and software, not take over the market?

The first problem with HCI solutions is they didn’t converge anything. Yes, the storage and virtualization software, and in rare cases, the network software, run on the same server hardware. However, each software package has an entirely different code base and does not know that the other packages exist. There are no gains in management efficiencies as a result.

Each of the three (at least) code bases within HCI is also very inefficient because it was initially designed to run on dedicated hardware, not share hardware resources with other modules. Finally, in most cases, the storage and network software run as virtual machines within the hypervisor construct.

These realities result in HCI being deemed a good solution for medium-sized businesses. Still, as these infrastructures scale to address the demand of larger businesses and enterprises, inefficiency is stacked on top of inefficiency, making effective utilization of the available resources a significant problem. None of the HCI vendors went to work on the core HCI challenges:

  1. Storage and network operations must be equal citizens with virtualization, not run as VMs.
  2. An HCI cluster’s east-west traffic (node-to-node communications) is significant and must be specifically optimized.
  3. Optimizing operational efficiency and simplifying administration requires a unified code base, not three code bases from three different vendors that are glued together by a management interface.
The High Cost of Dedicated Storage

There is also an economic problem with HCI infrastructures. In theory, running the entire infrastructure stack on one tier instead of three tiers should be less expensive. However, HCI is almost always the same price as or more expensive than the three-tiered architectures it attempts to replace. These HCI designs require even more powerful servers with even more memory and there are still three separate licenses (storage, virtualization, and networking) that must be paid for and bundled into the solution. The final straw is that most HCI solutions require you to purchase new hardware, and often, conveniently, from the HCI vendor, further increasing the price.

The result is that HCI has no operational savings or economic advantages over the traditional three-tier model.

Ultraconverged Infrastructure Eliminates the High Cost of Dedicated Storage

VergeIO’s Ultraconverged Infrastructure (UCI) eliminates the high cost of dedicated storage by overcoming the shortcomings of SDS and HCI. VergeOS is written from scratch to combine virtualization, storage services, and layer 2 and layer 3 network functionality into a single unified code base. With VergeOS, storage, and networking are equal citizens to the hypervisor, not servants. The result is a solution that is a fraction of the code size as other solutions but provides superior features. VergeOS is typically 50% less expensive than the equivalent VMware licenses which usually include all the functionality of its add-on packages like vSAN, NSX, and vCloud Director.

VergeOS can run on just about any server hardware built within the last six years, and it will deliver better performance and longevity from that existing hardware. This hardware flexibility enables you to leverage your existing servers and enjoy additional cost savings instead of being forced into buying new servers and spending more money.

Regarding storage, VergeOS uses drives installed in the same servers running the virtualization and networking functions. Our efficiency ensures that all three functions run at top performance and do not require additional processing power or memory. The VergeOS license is not capacity based; it is priced per node so that IT can put as much capacity as possible in each node. Adding drives to an existing server instead of buying a dedicated storage system is an order of magnitude less expensive.

Global Inline Deduplication is built into the very core of VergeOS and has been from day one. It was not an afterthought added years later. The result is deduplication has no impact on performance. Since deduplication is integrated into the core of VergeOS, it drives many of our advanced features like IOclone, our answer to snapshots, IOprotect for disaster recovery, and IOfortify, our solution for rapid ransomware recovery. Again, all of these features are built into the core of the VergeOS software, not add-on modules.

Many potential customers are reaching out to us as a no-compromise alternative to VMware. Still, the compelling capabilities of VergeOS mean many others reach out to us as part of a NAS or SAN refresh project because the savings we can provide over the high cost of dedicated storage are even more significant than the savings we can provide versus VMware alone. Then add the operational savings of a truly converged infrastructure, and you’ll see why we have incredibly high customer satisfaction.

Filed Under: Storage Tagged With: ,

by

As part of considering an alternative, IT professionals should consider VMware’s cost of doing nothing. In other words, what is the cost of staying with VMware instead of exploring an alternative solution? This analysis goes beyond pricing, which is already increasing and changing to charging by core. We’ll assume, for now, that the cost will remain the same and explore other aspects of staying with VMware.

VMware’s Cost of Doing Nothing About Efficiency

Even before you examine the complexity of the VMware stack, ESXi, vSAN, and NSX, you’ll see that ESXi is inefficient. It creates a measurable virtualization tax that forces data centers to buy more powerful servers than they should have to, and even decide not to virtualize some workloads, relegating them to bare metal only. VMware’s inefficiency also forces IT professionals to refresh servers sooner than they should have to, even though the current servers have years of serviceable life.

This requirement for ever increasingly more powerful servers raises the cost of the physical assets as well as VMware licensing costs. Not one to miss out on an opportunity, VMware is switching to core-based licensing so that as you buy those more powerful servers with more cores, you will be forced to pay more for your software. VMware benefits from its inefficiency.

VMware’s Cost of Doing Nothing About Flexibility

VMware has a stringent hardware compatibility list (HCL) which limits your options as you expand your use of the solution in the future. While you can create multiple clusters within the data center to support different types of processors, enabling a VM to share assets across those clusters is difficult.

The rigid HCL and the difficulty in mixing a few servers from different manufacturers into the same VMware instance increase the cost of staying with VMware. Many customers buy their servers all at once and don’t intermix them. The problem is that after three or four years of use, the customer needs to add one or two more servers to keep up with growth. Those same servers may not be available. The customer needs to buy enough additional servers to create a new cluster. Then they must migrate and dedicate specific virtual machines to that cluster and its resources, since it can’t borrow resources from another cluster.

VMware’s Cost of Doing Nothing About Snapshots

VMware’s limitations on snapshots are legendary. They can only support 32 snapshots per virtual disk, but they only recommend two or three for performance reasons. They also recommend not maintaining a snapshot for more than 72 hours.

VMware does have excellent integration with third-party backup applications, but if three snapshots impact performance, that backup application needs to complete its backup very quickly and execute the housekeeping necessary to delete the snapshot. The problem is that now IT must count on the backup application for almost every recovery effort, which means a time-consuming process of restoring data instead of an instant “pointing” to data.

Customers now have an increased cost of a secondary backup application plus they need to spend extra money on a high-performance backup storage target. They could also buy a dedicated storage array to benefit from snapshot technology, which is yet another expensive option and typically has snapshot limitations of its own.

VMware Cost of Doing Nothing About Deduplication

VMware deduplication is a two-stage process and is not inline. The ingest tier should comprise high-performance and highly durable flash drives. As the data destages from this tier, it is deduplicated. There is a cost associated with these drives, a performance overhead in moving data a second time, and the obvious impact of running the deduplication algorithm. The two-stage approach also means that reading deduplication is done from slower drives as that data goes through the same deduplication algorithm during the read, impacting read performance.

The Cost of Doing Nothing Adds up

Whether the Broadcom acquisition happens or not, staying with VMware is expensive. VMware is already moving customers to a new per-core licensing model. You need to buy more server hardware than you should, and inflexibility makes it challenging to maximize the server investment and gradually add to it. Lastly, features like snapshots and deduplication, which are supposed to save money, force IT to spend more.

Most VMware Alternatives Can’t Solve the Problem

It seems like the door for VMware alternatives to start grabbing VMware customers is wide open, but most are not very successful at it. First, most alternative solutions force customers to replace their current server offering with new servers certified to run their hypervisor. Unless IT is ready to replace the servers and VMware, this makes the cost of a VMware alternative far more expensive than they were initially planning.

The second problem is most VMware alternative solutions aren’t any more efficient or flexible than VMware; they’re just cheaper. While saving money is essential, it is often just one of the priorities when an organization considers a platform switch.

Lastly, most VMware alternative solutions don’t have anything close to feature parity with VMware, or their features have the same shortcomings as VMware. A good example is found in networking. Most VMware alternatives have nothing that compares to VMware’s NSX, and if the organization needs that functionality, they have to go out and buy another application.

VergeOS Less Expensive, Flexible, and Feature Superiority

VMware Exit - VMware's Cost of Doing Nothing

When compared to VMware, VergeOS will cut your infrastructure software costs in half, at least. It also runs on your existing server hardware. Not only will it run on that hardware it will run more efficiently. You will see better per-virtual machine performance and improved virtual machine density. Most customers can delay or even cancel their next round of server purchases. VergeOS provides superior features to VMware, including:

  • IOclone – a powerful alternative to snapshots
  • IOfortify – redefined ransomware resiliency
  • IOprotect – WAN-aware replication that enables you to first migrate to VergeOS by creating a disaster recovery solution for VMware.

We also provide native global inline deduplication and robust software-defined networking, including complete layer 2 and 3 functionality. Most importantly, all of these capabilities are integrated into the same efficient code base and included in the product’s price. Watch our “VergeOS Networking Fundamentals” video for a deep dive into VergeOS’ networking capabilities.

Lastly, we charge by node, not by processor or core. We enable you to buy powerful servers with as many cores and storage capacity as needed. You can then add them seamlessly to the existing VergeOS environment and use them to their full potential.

Next Steps

  • Take a Test Drive – Take VergeOS for a spin. We’ll use our virtual data center technology to create your own instance of VergeOS. You can create virtual machines, learn the GUI, and test applications in it.
  • Get a Personalized Demo – Sign up for a live demonstration and see the flexibility of VergeOS in action.
  • Watch our One-Slide Webinar and learn how to break free from VMware. See a live migration from VMware to VergeOS.

Filed Under: Virtualization Tagged With: ,

by

Once ransomware breaks through an organization’s defenses, time is of the essence, and IT must execute 5 steps to rapid ransomware recovery. The need for rapid recovery and minimal data loss was the top concern of 75% of the IT professionals responding to the survey we conducted during our recent webinar, “Creating a Holistic Ransomware Recovery Strategy,” now available on-demand.

There are 5 steps to rapid ransomware recovery with minimal data loss:

StepReason
Frequent ProtectionRansomware can strike at any moment, protection copies should be made, at least every few hours.
Long RetentionSome ransomware variants strike slowly to avoid detection. Recovery may require pulling data from multiple backup copies.
Rapid AlertingThe sooner you can detect you are under attack, the sooner you can stop the attack at its source and limit the damage
Mount Don’t RestoreTraditional restoration means copying data from an alternate storage medium, which takes time.
Practice, Practice, PracticeRansomware recovery is unlike any other. Find a safe way to “infect” your data center and practice.

Rapid Ransomware Recovery Step 1: Frequent Protection

While it may seem the most obvious of the 5 steps to ransomware recovery, it is missing from most response strategies. In an ideal ransomware protection scheme, protection events should occur every hour but at least every three hours. This necessary frequency of protection creates a challenge for many data protection approaches.

For example, most snapshot technologies, especially VMware’s built-in snapshots, will degrade performance significantly if the number of managed snapshots grows beyond a handful. However, even dedicated storage systems like all-flash arrays struggle when managing many snapshots. They may perform acceptably but can’t manage a sophisticated retention schedule. The intricacies of the snapshot metadata make deleting a snapshot, which is what a retention schedule does, egregiously slow. Because of its high metadata overhead, it takes the storage system time to “unwind” an intermixed snapshot, and its deletion means updating the metadata for all other snapshots. One result of this is that snapshots consume far more capacity than they should because they are so slow to give back the space used by old snapshots.

For these reasons, most organizations can’t tap into the full theoretical potential of ideal snapshot technology and, as a result, must count on backup and recovery solutions that significantly increase costs and slow recovery efforts.

Frequent Protection with VergeOS

VergeOS is different. At the core of VergeOS is global inline deduplication. Because VergeIO started with deduplication instead of bolting it on years after shipping a product, it delivers maximum data efficiency without impacting performance. Our IOclone capability leverages global deduplication to enable the creation of full clones of virtual machine data or even entire data centers in milliseconds. These clones are space efficient and independent of each other. You can have thousands of them without impacting performance. More importantly, you can delete them, even via a sophisticated retention schedule, in seconds, meaning any space they consume is instantly returned to the environment.

Rapid Ransomware Recovery Step 2: Long-Term Retention

Ransomware can take two attack vectors. The most common is, it will try to encrypt every file it can get to as soon as it breaks into the environment. The second attack vector is more sophisticated, slowly encrypting data to avoid detection. While the second vector is more sinister, most Bad Actors don’t have the patience to let the malware sit and slowly encrypt for months. They want the money now! Frankly, given the success rate of attacks once landing their malware payload, they don’t have to be sophisticated.

While the second attack vector is not as expected, it is wise to prepare for it. Long-term and granular data retention is the key to recovering from a slow-crawl ransomware attack. Again, because of performance concerns, snapshots are unsuitable for long-term retention in most cases. Backup software is excellent at the long-term recovery aspect but, because of the infrequency mentioned above, cannot provide a lot of granularity.

Solving the Retention Problem with VergeOS

Once again, VergeOS’ IOclone provides an ideal solution for long-term data retention, providing complete clones which are independent of each other. Retaining thousands of them doesn’t impact performance, and you can maintain as granular a history as you feel necessary. Getting rid of old files is another important step in limiting ransomware damage.

As mentioned, you can develop a sophisticated retention schedule to meet these requirements. For example, you can execute hourly clones and retain each for 24 hours. You can then execute a daily clone and retain that for seven days and a weekly clone that you retain for two months, and a monthly clone for a year. This type of schedule means a lot of deletion of older copies to reclaim space. It would cause significant performance problems for traditional snapshot techniques and take weeks to return the capacity reserved by those snapshots. IOclone has no performance impact, and reserved capacity is returned almost instantly.

Rapid Ransomware Recovery Step 3: Rapid Alerting

Knowing you are under attack is a critical part of 5 Steps to Rapid Ransomware Recovery because it addresses the other part of IT concerns, “with minimal data loss.” The sooner you know your environment is under attack, the sooner you can shut down the virtual machine under attack and limit the spread. The early warning also enables IT to better identify which protected copy they should turn to when starting their data recovery.

A few storage systems will provide an alert of a potential ransomware attack. Most of these will monitor for an increase in capacity utilization. The problem is that these alerting methods often miss an attack because capacity doesn’t necessarily grow. When malware works through your environment, it typically encrypts one file at a time, and during encrypting, those files will increase in size. After encryption, the file will be almost the same size as the unencrypted file. In other words, these methods will miss the attack. You’d much rather have a false positive than a missed attack.

IOfortify Delivers Reliable Attack Alerting

5 Steps to Rapid Ransomware Recovery

VergeOS’ IOfortify capability delivers reliable attack alerting by monitoring a change in deduplication ratios instead of changes in capacity utilization which is far more accurate. Encryption may not increase capacity utilization, but those files will look like new files to a deduplication algorithm. During our “Creating a Holistic Ransomware Recovery Strategy”, we demonstrated IOfortify, first identifying and alerting, then recovering a virtual machine whose data was actively being encrypted, in real time.

Rapid Ransomware Recovery Step 4: Mount, Don’t Restore

Mounting your recovery means pointing directly to your protected copy without having to move data. Restoring means copying the data from where it is back to the production volume, which can take dozens of minutes, if not hours, depending on the size of the volume and bandwidth of the network.

Again historically, the problem with directly mounting your recovery volume is how you maintain those copies. A traditional complete clone will consume too much capacity and take too long to create to be practical and violate the other above steps. A traditional snapshot still depends on the original volume; promoting it to production may mean a complete copy/restore.

Some backup solutions have an “instant recovery” solution. The problem with this method is that while you are mounting a volume, you are mounting it from a backup storage target which typically doesn’t have the performance or availability capabilities of production storage.

IOclone instant recovery with no performance impact

IOclone enables IT to point directly at a version of the virtual machine or data center before the ransomware attack. It is online instantly, and because of its independence, it does not need to be “rolled back” to production.

Rapid Ransomware Recovery Step 5: Practice

Ransomware recovery is unlike any other, so IT must practice the recovery process. The problem with practice is risking a “leak” of the practice into production.

Virtual Data Centers Make for Perfect Practice

5 Steps to Rapid Ransomware Recovery

VergeOS’ Virtual Data Center (VDC) capabilities enable IT to create a complete, secure copy of their entire data center and “infect” it with a ransomware simulator or an encryption program. Their isolation ensures the practice attack doesn’t “leak” into production. Verge.IO even has some customers that put their VDC, with anonymized data, out as a publicly addressable honeypot so they can test their attack response against a real foe.

Conclusion

The 5 Steps to Rapid Ransomware Recovery require preplanning, and they also require better infrastructure software. Because of the “bolt-on” approach to all features and protection capabilities, platforms like VMware can’t provide the same level of protection as VergeOS. The good news is you can transition from VMware to VergeOS seamlessly and at your own pace. You’ll have a more resilient environment and reduced costs by 50% or more. To learn more about using VergeOS as a VMware exit ramp, read our VMware Alternative page. You can also start using VergeOS as a Disaster Recovery solution, including for ransomware recovery, for VMware without migration using our IOprotect capability.

Watch Creating a Ransomware Response Strategy

This field is hidden when viewing the form
This field is hidden when viewing the form
Name(Required)

VergeIO’s Inbox Respect Policy: We will send you no more than two e-mails per month

Filed Under: Ransomware Tagged With: ,

by

Ransomware counts on Patch Tuesday to successfully infiltrate an organization. While there is nothing wrong with applying patches on Tuesday, it is which Tuesday the patch is applied that can open the door that ransomware plows through. Ideally, you want to apply the patch the next Tuesday after the release; doing so would eliminate the exploits that most ransomware and other cyber threats use to do their work.

The problem is organizations wait weeks or even months to apply patches. Why? Because the IT team needs to understand how the proposed patch will impact the rest of their environment. They don’t want to apply a patch that suddenly causes other currently working environments to fail.

Today’s infrastructure solutions must enable IT to vet and apply patches quickly and eliminate Patch Tuesday altogether. IT needs a solution that can address these patching challenges:

  1. Difficulty determining where the potential conflict is because of the number of vendors involved in delivering IT services.
  2. Difficulty in assembling and maintaining a lab environment to test patches.
  3. Difficulty rolling back a patch once it is deployed.
Ransomware Counts on Patch Tuesday

Eliminate Patch Tuesday and set yourself up for ransomware recovery success by attending our live TechTalk, “Creating a Ransomware Response Strategy,” this Thursday at 1:00 PM ET.

There are Too Many Vendors to Eliminate Patch Tuesday

One of the biggest challenges facing IT as they attempt to apply patches to prepare for the next ransomware attack is the complexity of the multi-vendor data center and this is why ransomware counts on patch Tuesday. While Hyperconverged Infrastructures (HCI) were supposed to make the multi-vendor data center easier to manage, they have the opposite effect. Traditional HCI is still a vertically layered stack of multiple software solutions. At a minimum, most HCI has software-defined storage (SDS), hypervisor (VMware/Hyper-V), software-defined networking, and software that protects the environment (backup and recovery).

Many environments are only one step down the software-defined path, running a legacy three-tier stack, virtualizing only compute. As a result, legacy data centers and even more “modern” HCI data centers are equally confusing when determining the impact of applying a patch.

Ultraconverged Infrastructure Simplifies Patch Reconciliation

VergeOS rotates the traditionally vertical IT stack into a tightly integrated linear plane that provides all infrastructure services (networking, hypervisor, storage, data protection) as a data center operating system within a singular software code base. We call this ultraconverged infrastructure (UCI), and it moves beyond legacy hyperconverged infrastructure to deliver greater efficiency and scalability at a significantly lower cost.

Reducing the IT stack to a singular, horizontal layer increases efficiency and scalability and simplifies the patching process. Updates for the entire infrastructure come from a single source, and because VergeOS is inherently highly-available, IT can apply patches and updates without disruption. VergeOS applies patches one node at a time, and workloads automatically move between nodes so that applications are unaffected.

You Need a Lab to Eliminate Patch Tuesday

Patches also come from operating systems and application vendors. Properly evaluating the impact of these patches is best done in a lab. IT organizations need a lab for patch testing and various other use cases. The problem is not just the cost to configure and maintain the lab but also making sure the lab has the same settings and data as the production environment. These requirements mean that most organizations don’t have a dedicated lab environment. When one is needed, they have to scramble to put something together. As a result, the lab is nothing like the production environment they are looking to simulate.

Virtual Data Centers: The Always Ready Lab

One of the critical capabilities of VergeOS is Virtual Data Centers (VDC). Virtual Data Centers are to physical data centers, what virtual machines (VM) are to physical servers, an encapsulation. Using another VergeOS capability, IOclone, IT professionals can, within milliseconds, create a space-efficient copy of their entire data center within.

Capturing the entire data center, including the data, networking configuration, storage policies, and application setups, is critical to ensuring that IT does patch verification against an exact replica of production. Since the copy is standalone and not dependent on the original, administrators can apply the patch without concern of impacting the production environment.

IT can implement a single VDC for its entire data center or subdivide it by application or workload. For example, a VergeOS administrator may create a VDC for Oracle, another for MS-SQL, and a “core” VDC for general-purpose VMs. Each VDC can be cloned hundreds of times, and those clones can be used as golden masters, backups, development, and patch verification.

IT Needs to Eliminate Patch Tuesdays AND Surprise Wednesdays

Even with the best testing, sometimes an errant patch slips through. Depending on the level of chaos it causes, IT may have to recover from the backup infrastructure completely. Recoveries from backup, especially large ones, are time-consuming, meaning IT may deal with the Wednesday surprise for the rest of the week. The problem is most infrastructure software is too inefficient to maintain its data protection points, typically traditional snapshots, for more than a few hours. As pointed out in this article, “VMware Storage Challenges,” this problem is especially apparent in VMware environments.

IOclone: Unlimited Clones and Retention

To make surprise Wednesdays less of a concern, IT needs the ability to retain backup copies for more than a few hours. Traditional backup software can meet this need, but the time and nuances in recovering an application with an errant patch are significant. IOclone has the entire state of the VM and the entire data center or workload. No rollback is needed; point to the last known good instance, and the application is running.

Get Ahead of Ransomware

Ransomware Counts on Patch Tuesday

Because ransomware counts on patch Tuesday, applying the latest patches is critical to staying ahead of ransomware. With VergeOS, IT can apply patches almost as soon as they are released without waiting for Tuesday. They can test application patches against a mirror image of their production environment. If an errant patch slips through, they can instantly point to the non-patched version.

Even with the improved patching capabilities within VergeOS, ransomware may still slip through because of user carelessness. Our IOfortify solution takes you the rest of the way by leveraging the hardened VergeOS, IOclone, and new detection capabilities to deliver rapid restoration from an attack. During our TechTalk, “Designing a Ransomware Response Strategy,” we will conduct a live demonstration of IOfortify in action. See if we can recover a VM under attack during the webinar.

Patch Comparison: Traditional Infrastructure Software vs. VergeOS

Rapid Patch RequirementTraditional Infrastructure SoftwareVergeOS
Determining Patch ImpactDifficult – Multiple vendors makes identifying potential conflicts time consumingEasy – One Vendor
Pre-deployment TestingDifficult – Hard to setup, maintain and pay for dedicated labEasy – Virtual Data Centers and Cloning can create “Instant labs.”
Patch RollbackHard – Recovering from a backup copy is very time consumingEasy – No rollback required, just point to pre-patched clone.

Filed Under: Blog, Ransomware Tagged With: ,