Advanced, multi-dimensional security features ensure the highest security standards

inSync Enterprise-Class Security

2

inSync Security

Table of Contents

inSync Security Overview .................................................................................................4

Data in Transit ..............................................................................................................................................5

Data at Rest ...................................................................................................................................................5

Secure Client Authentication ................................................................................................................... 5

inSync On-Premise .......................................................................................................................................6

inSync On-Premise Secure Deployment ..............................................................................................6

inSync On-Premise Ports ..........................................................................................................................7

inSync On-Premise AD Integration ........................................................................................................7

inSync Cloud ....................................................................................................................................................8

inSync Cloud Security Objectives ...........................................................................................................9

Segregation of Customer Data ...............................................................................................................9

2-Factor Encryption Key Management & Authentication ...............................................................9

inSync Cloud AD Integration ..................................................................................................................11

File Retention and Version Control .....................................................................................................11

inSync Cloud Management Control Panel ........................................................................................12

inSync Cloud access by Druva employees ........................................................................................12

Data Center Security ................................................................................................................................12

Additional security mechanisms to protect Cloud infrastructure and data assets ..............................................................................................................13

3rdPartySecurityCertifications ...........................................................................................................14

Backup Security ...........................................................................................................................................15

Client Triggered Architecture ................................................................................................................15

Data Backup Session Security ...............................................................................................................15

Data Restore Session Security ..............................................................................................................15

3

inSync Security

Table of Contents continued

Device Security ............................................................................................................................................16

Data Encryption .........................................................................................................................................16

Remote Wipe ..............................................................................................................................................17

Geo-location ...............................................................................................................................................17

Mobile Security ............................................................................................................................................18

Mobile Access .............................................................................................................................................18

1. Policy-based access .............................................................................................................................18

2. Secure authentication .........................................................................................................................19

3. Securing Data in Transit .....................................................................................................................19

Private container for corporate data accessed on a mobile device..........................................19

Protecting corporate-owned mobile devices ...................................................................................19

Data encryption .........................................................................................................................................19

File Share Security ......................................................................................................................................20

IT Control ..................................................................................................................................................20

1. Control on employees who can share data .................................................................................21

2. Control on who can share and what can be shared .................................................................21

3. Control on sharing data with external partners and collaborators .....................................21

Encryption ..................................................................................................................................................22

Comparing with Consumer-Grade Sharing Options (e.g., Dropbox with SecretSync) ............................................................................................................22

Protecting Shared Data ...........................................................................................................................22

Summary .........................................................................................................................22

About Druva ..................................................................................................................................................23

4

inSync Security

OverviewWith Druva inSync, you can rest assured that your enterprise’s data is completely

secure end-to-end. inSync comprehensively protects your corporate data by adhering to strict standards that keep your data private and safe from external threats.

With data protection as its number one priority, inSync is engineered to ensure data security at every step – data transmission, data storage, and data access.

This document provides an overview of the security measures that Druva has put in place including security of data in transit and store, the on-premise deployment architecture, cloud security, and secure access to the service.

Third PartyIdP

256-bit AES Encryption

256-bit AES Encryption

2-Factor Encryption

3rd Party Security Certifications

inSync Cloud

inSync On-Premise

Corporate Firewall inSyncServer

EdgeServer

Active DirectoryServer

AD Server

Endpoints

Web Browser Access

SAML

DLP Encryption on device

256-bit SSL Encryption

Authentication

Endpoints

Web Browser Access

DLP Encryption on device

Authentication

256-bit SSL Encryption

5

inSync Security

Data in Transit

inSync is designed from the ground up for endpoints with the understanding that endpoints often connect over WANs and VPN-less networks. inSync encrypts data in transit with 256-bit SSL encryption ensuring enterprise-grade security even over WANs and VPN-less networks.

Data at Rest

In addition to strict authentication and access control, inSync secures data on the storage with 256-bit AES encryption.

Secure Client Authentication

TodeployaninSyncclient,theserversendstheclientaninSynckeyfile(.isk)thatcontainstheserverinformationand32byteuniqueauthenticationcredentialsfortheclient.Afteritsfirstconnectionwiththe server, the client re-negotiates the authentication parameters. These authentication parameters are then stored at the inSync client for all subsequent connections with the inSync server.

Even when a user self-deploys inSync on his or her device with a user ID and password, the client and server use the authentication key mechanism in the background to authenticate and authorize client activities such as backups, setting changes, and restores.

Every time the authentication key is re-generated by an administrator, the existing authentication key is reset and the connecting user sees an “Expired Key” message. This feature ensures that data never lands in the hands of a malicious user.

6

inSync Security

inSync On-PremiseinSync On-Premise is a deployment of inSync storage nodes in an enterprise’s own data center. Available in 3 editions (Professional, Enterprise & Private Cloud), inSync features a future-proof, scale-out archi-tecture that enables linear scaling with the addition of storage nodes.

INSYNC ON-PREMISE SECURE DEPLOYMENT

inSyncon-premiseserverscanbedeployedbehindthefirewallwithoutrequiringVPNconnectionsfromendusersasdepictedbyfigure1.

inSyncon-premiseserversmayalsobedeployedintheDMZasshownbyfigure2.

Figure 1. Deployment behind a firewall

7

inSync Security

Deployment of inSync Private Cloud with Edge Server

FirewallEdge 1 Master server

Storage node 1

inSync network

Storage nodes connecting

via WAN

Storage node 2

FirewallEdge 2

Storage node 3

Storage node 4

InternetinSyncclients

DMZ

INSYNC ON-PREMISE PORTS

inSync on-premise servers require the following ports to be opened to allow secure connections to the server from outside -

• Endpoint Backup: 6061 • Endpoint Restore: 443 and 6073 • Administrator Web Console (HTTPS access): 6065 • inSync storage nodes (Private Cloud edition): 6071

INSYNC ON-PREMISE AD INTEGRATION

inSyncon-premisecanbeconfiguredtointegratewithon-premiseActiveDirectoryfor-

• Integrated mass deployment of the inSync client • Automatic user provisioning/deprovisioning • User authentication • User management

Figure 2. Deployment in the DMZ

Figure 3. Deployment of inSync Private Cloud with Edge Server

8

inSync Security

inSync Cloud inSyncCloudisafully-automated,enterprise-classendpointprotectionsolutionofferedasasoftwareasaservice(SaaS).PoweredbyAmazon’sstate-of-the-artAWStechnology,inSyncCloudofferselas-tic, on-demand storage that can grow to handle any number of users and data. The service can be instantly provisioned to global users.

inSync Cloud offers secure, lightning-fast data backups and restores to and from a virtual private cloud. It operates at mul-tiple storage regions across the world for a global enterprise. The service provides high availability and enterprise-scale RPO and RTO. The service’s enterprise-class security is compliant with international standards such as SAS 70 and ISAE 3402.

On the client side, the inSync Cloud agent is a lightweight, non-intrusive client application that manages databackupalongwithotherendpointservicessuchasDLPandfilesharingoneachprotecteddevice.Itallows end users to set preferences such as folder selection and scheduling and enables them to access their shared and backed up data including data from their other devices.

Full administrative control to inSync Cloud is provided via a secure Web-based administrator control paneloverHTTPS,whichallowscorporatepoliciestobedefinedforgroupsofprotectedusers,includ-ing the ability to enable or disable users to change settings on their accounts.

Figure 4. inSync Cloud Architecture

9

inSync Security

inSync Cloud Security ObjectivesDruva strictly adheres to the following set of objectives to ensure the security of inSync Cloud.

Ensuring data security during bi-directional transfer between client machines and servers

Covered in overview and backup security sections.

Segregation of Customer Data

inSync Cloud segregates each customer’s data from other customers’ data, thereby resulting in a vir-tual private cloud for each customer.

Virtual Private Cloud for each customer is realized by:

• Compartmentalizationofcustomerconfigurationbasedonaccesscredentials • Compartmentalization of customer metadata within Dynamo DB • Compartmentalization of customer data by S3 buckets • Encrypting data of each customer using unique 256 AES encryption keys

2-Factor Encryption Key Management & Authentication

To uphold the highest security standards for enterprises, key management in inSync Cloud is modeled after a bank locker system, in which both parties hold part of the key. The encryption and authentica-tion keys are mutually shared between the customer and the Cloud. Consequently, neither has full, unencrypted access to any data on the cloud independently.

KEY POINTS TO NOTE:

• Both authentication and encryption depend upon two pieces of information:

• UPn password (held ONLY by the customer)

• UTn token (held ONLY by inSync)

• Both these pieces (UPn and UTn) are required to authenticate the user andgetthefinalkeyAKn,whichisusedtoencryptanddecryptuserdata.

• At no time is the actual key (AKn) saved by inSync; it exists only until a user or admin is authenticated and is then destroyed.

10

inSync Security

Primary admin (A1) opens a new account with inSync Cloud with password P1

inSync Cloud creates a new virtual private instance with AES 256-bit encryption key : AK1

inSync Cloud creates a new storage based on AK1, reminds the administrator that they take steps to remember the password.

inSync Cloud then creates a new security token to be stored in the cloud. The new key is created as follows: New Token T1 = encrypted with P1 (AK1 + P1 + salt) where salt is a random string generated for this operation.

The token T1 is saved in inSync Cloud while the password is held only by the admin (and NOT saved in the cloud).

inSync Cloud strongly recommends that the admin create a secondary admin account (A2), which results in the creation of a new password (P2) and a token T2. This is needed for potential scenarios where an admin forgets his or her password and only a secondary admin can reset it. Because of Druva’s stringent password policy, Druva is unable to reset admin passwords for any customer.

When a new backup user account is created (U1), inSync saves a new token (UT1) based on the user’s password (UP1), which only the user knows. Likewise, for all other users, inSync Cloud creates a username (Un) and a customized token (UTn).

Steps followed by inSync Cloud to create an account and secure data in the cloud:

1

2

3

4

5

6

7

A user or admin authenticates with a password, e.g., UP1

The password is used to decrypt the associated token UT1 and determine if a meaningful combina-tion of AK1, UP1 and salt can be achieved.

If inSync Cloud gets a meaningful combination, the user is authenticated and AK1 is used to encrypt/decrypt the user backup stream.

Thekeyisfinallydiscardedwhentheuserexits.

Authentication and Encryption Steps:

1

2

3

4

11

inSync Security

• SAML can provide integration with other 3rd party ID providers

inSync’sCloudAD-connectorextendsallthebenefitsofdeepADintegrationtoinSyncCloudenablingintegrated mass deployment of the inSync client, automatic user provisioning/deprovisioning, user authentication, and user management.

FILE RETENTION AND VERSION CONTROL

inSyncCloudenablesitscustomerstoholdinfiniterestorepoints for protected data. Administrative control provides a customertheabilitytospecifyfileretentionatanindividualbackup policy level. If this option is chosen, an automatic process(Compaction)runsdailytoremoveanyfilesoutsideof the retention rules.

Administrators with appropriate rights also have the abil-ity to selectively remove restore points from individual accounts where required. End users of the system have no controloverremovalofstoredfiles,thuskeepingtheown-ership of protected data with the customer.

INSYNC CLOUD MANAGEMENT CONTROL PANEL

Administrative access to each inSync Cloud instance is provided via an Admin Control Panel.

• Administrators access inSync Cloud using a web console over an HTTPS connection. • inSyncClouddoesnotstoretheadminpasswordbutusestheauthenticationmethodologydefinedin section above. • An administrator can create multiple other admins based on roles. There are two primary types of administrators: - Server administrator: Has overall administrator rights across all areas of service - Profileadministrator:Hastieredrightsonuserprofiles.Eachprofileadmincanhaveoneor more of following rights: create users, restore data, and run reports. • NoDruvaemployeehasServerorProfileAdministrationbasedaccesstotheinstanceunlessexpressly granted by the customer. Any Server Administrator can revoke access at any time by removing the appropriate Admin Account via the web-based Admin Control Panel.

UTn password held only by Customer

UTn token held only by inSync

INSYNC CLOUD AD INTEGRATION

inSyncCloudcanbeconfiguredtointegratewith an on-premise Active Directory using SAML, an XML-based open standard for exchanging authentication and authorization data between security domains. SAML per-mits users to securely log into inSync using their credentials on external identity services such as Microsoft Active Directory.

• AD Federation Services (AD FS 2.0) can be set up to be the ID provider for inSync Cloud

• Mobile app access can be set up for AD authentication using SAML

Figure 4. Two pieces of information required for access. Both the inSync and Customer components required to decrypt user data. Actual key is never saved by inSync.

12

inSync Security

INSYNC CLOUD ACCESS BY DRUVA EMPLOYEES

Druva employees have no direct access to any of customers’ inSync Cloud instances. Access to cloud infrastructure by Druva employees is limited to its cloud operations team that follows strict rules and regulationsdefinedundertheDruvasecuritypoliciesdocument.Thisaccessisgrantedforthepur-pose of security patching, service upgrades, and monitoring tasks.

Data Center Security

inSync Cloud is built on top of the Amazon Web Services (AWS) technology stack. Amazon has sev-eral years of experience in designing, constructing, and operating large-scale data centers. AWS infrastructure is housed in Amazon-controlled data centers throughout the world. Only those within Amazon who have a legitimate business need to have such information know the actual location of these data centers, and the data centers themselves are secured with a variety of physical barriers to prevent unauthorized access.

TheAWSnetworkprovidessignificantprotectionagainsttraditionalnetworksecurityissues.Thefol-lowing are a few examples:

DISTRIBUTED DENIAL OF SERVICE (DDOS) ATTACKS

AWS API endpoints are hosted on large, Internet-scale, world-class infrastructure that has made Amazon into the world’s largest online retailer. Additionally, AWS’s networks are multi-homed across a number of providers to achieve Internet access diversity.

MAN IN THE MIDDLE (MITM) ATTACKS

All of the AWS APIs are available via SSL-protected endpoints, which provide server authentication. AmazonEC2AMIsautomaticallygeneratesnewSSHhostcertificatesonfirstboot.

IP SPOOFING

AmazonEC2instancescannotsendspoofednetworktraffic.TheAWS-controlled,host-basedfirewallinfrastructurewillnotpermitaninstancetosendtrafficwithasourceIPorMACaddressotherthanits own.

PORT SCANNING

Unauthorized port scans by Amazon EC2 customers are a violation of the AWS Acceptable Use Policy.

PACKET SNIFFING BY OTHER TENANTS

Itisnotpossibleforavirtualinstancerunninginpromiscuousmodetoreceiveor“sniff”trafficthatisintendedforadifferentvirtualinstance.

13

inSync Security

Additional security mechanisms to protect Cloud infrastructure and data assets

REDUNDANCY

AWS data centers are designed to anticipate and tolerate failure while maintaining service levels and are built in clusters in various global regions. inSync Cloud provides multi-zone replication of various elementsofcustomerdataincludingconfiguration,metadataandtheactualdata,therebyensuringthat customer data is available in multiple availability zones to handle failure of any zone.

FIRE DETECTION AND SUPPRESSION

AWS’automaticfiredetectionandsuppressionequipmentreducerisk.Thefiredetectionsystemuti-lizes smoke detection sensors in all data center environments, mechanical and electrical infrastruc-ture spaces, air-conditioning rooms and generator equipment rooms. These areas are protected by either wet-pipe, double-interlocked pre-action or gaseous sprinkler systems.

POWER

The data center electrical power systems are designed to be fully redundant and maintainable with-out impact to operations, 24 hours a day, and seven days a week. Uninterruptible Power Supply (UPS) units provide back-up power in the event of an electrical failure for critical and essential loads in the facility. Data centers use generators to provide back-up power for the entire facility.

CLIMATE AND TEMPERATURE

Climate control is required to maintain a constant operating temperature for servers and other hard-ware, which prevents overheating and reduces the possibility of service outages. Data centers are conditioned to maintain atmospheric conditions at optimal levels. Personnel and systems control temperature and humidity at appropriate levels.

MANAGEMENT

AWS monitors electrical, mechanical and life support systems and equipment so that any issues are immediatelyidentified.Preventativemaintenanceisperformedtomaintainthecontinuedoperabilityof equipment.

3rd Party Security Certifications

AWS has achieved compliance with the following 3rd party standards and/or frameworks.

SOC 1 (SSAE 16/ISAE 3402) AND SOC 2 AND SOC 3

AWS publishes a SOC1 Type II report that is a replacement of the SAS70 Type II report. The SOC 1 report audit attests that the AWS control objectives are appropriately designed and that the controls safeguardingcustomerdataareoperatingeffectively.InadditiontotheSOC1report,AWSpublishesa SOC 2 Type II report and a SOC 3 report .

fPCI DSS LEVEL 1

AWS is Level 1 compliant under the Payment Card Industry (PCI) Data Security Standard (DSS) .

ISO 27001

AWSisISO27001certifiedundertheInternationalOrganizationforStandardization(ISO)27001stan-dard. ISO 27001 is a widely adopted global security standard that outlines the requirements for infor-mation security management systems .

14

inSync Security

fFEDRAMP

AWS has achieved Agency Authority to Operate (ATOs) under the Federal Risk and Authorization Management Program (FedRAMP) at the Moderate impact level for AWS GovCloud (US) and all US regions.

DIACAP AND FISMA

AWS enables US government agencies to achieve and sustain compliance with the Federal Information Security Management Act (FISMA).

ITAR

TheAWSGovCloud(US)regionsupportsUSInternationalTrafficinArmsRegulations (ITAR) compliance.

For more information look at http://aws.amazon.com/compliance

Inaddition,Druvahascompleteditsowncertificationsbyexternalparties.

ISAE 3000 TYPE II

DruvahascompletedanISAE3000TypeIIcertificationbyKPMG.TheISAEauditcoversthefollowingelements –

• ƒDescription of Druva’s system related to general operating environment supporting inSync Cloud Operations

• ƒDesign of controls related to the control objectives stated in the description

TRUSTE EU SAFE HARBOR

DruvahasachievedTRUSTeEUSafeHarborcertificationfacilitatingcompliancewiththeEuropeanUnion’s Data Protection Directive.

HIPAA

Druva has passed a review by KPMG validating the company’s security and privacy controls for han-dling HIPAA-compliant protected health information (PHI).

Amazon Web Services Certifications Certified Cloud Operations

ITAR SOC 1, 2, 3 FISMA Moderate

HIPAA PCI DSS

ISAE 3402FIPS 140-2

ISO 27001

MPAA

ISAE 3000

HIPAA BAA

TRUSTe

EU Safe Harbor

15

inSync Security

Backup Security

Client Triggered Architecture

With Druva inSync, backup and restore requests are always initiated by the inSync client, which aids in security and scalability of the server. The servers never initiate any request, and both backup and restore usethesame(default6061)portforallconfiguration,controlanddatarequests.

All backup and restore activities are secured using 256-bit encryption.

Data Backup Session Security:

1

2

3

4

5

The agent contacts the inSync server via TCP/IP socket.

256-bit SSL encryption is used for all communication of authentication details.

Server authenticates users with the encryption key.

The client agent sends the server blocks of data for backup over a secure SSL connection.

Blocks of data remain encrypted on the server using AES 256 bit encryption.

Data Restore Session Security:

1

2

3

4

5

6

Userlaunchesclientagent,selectsfilesfromtherestorepointsrequired.

The agent contacts the inSync server via TCP/IP socket.

256-bit SSL encryption is used for all communication of authentication details.

Theclientagentsendsalistoffilestotheservertoretrieve.

The server selects required blocks, and transmits the blocks to the client over a secure SSL connection.

inSyncoffersanoptionalsupportfordatarestoreoveraWebbrowser.Therestoreonthesedevices is encrypted (HTTPS) and can be authenticated using Active Directory.

16

inSync Security

Uses endpoint operating sys-tem’s built-in encryption tools (e.g., Windows’ Encrypting File System or EFS).

Encryption and decryption are automated, with no need for any additional user steps. Users logging into their end-point device automatically have decrypted access to theirfiles.

Selective encryption of files or folders avoids need for a heavy, full-disk encryption. Any file on the endpoint, which has been selected for backup, is encrypted. This approach is superior to alter-natives that require a heavy-weight full disk encryption orplacingallfilesonasinglelocation, either of which is sub-optimal.

Data Encryption

WithinSynccriticalfilesandfoldersonlaptopsandmobiledevicescanbeselected for data encryption to ensure that they are protected with the highest encryption standards.

On device data encryption features:

Device Security

inSyncincludesasimple,buthighlyeffectivesolutionthatreducesthetotaleconomicimpacttoanenter-prise from a lost or stolen endpoint. Its device-level security features provide powerful, multi-layered protection of critical corporate data on endpoints.

17

inSync Security

Geo-location Features:

inSync further provides the ability to track the geographical location of devices with an accuracy of 10 to 20 meters at any point in time.

• An embedded software engine uses advanced hybrid positioning algorithms based on data from Wi-Fi access points, GPS satellites, and cell towers to keep track of all your endpoints.

• Geo-location provides details such as street, city, state, or country.

• A familiar Google Maps interface provides a quick view of the coordinates for every endpoint device available on the inSync management console.

Remote Wipe

In order to prevent data breach on lost or stolen devices, inSync provides remote wipe capabilities that can be applied either by an administrator or an auto-delete policy.

Remove Wipe Features: 1. Administrators can initiate a remote decommission operation on a lost or stolen device, so the device’s data is wiped out the next time time the device connects with inSync.

2.Anauto-deletepolicycanbeconfiguredtoautomaticallywipedataoutifadevicehasn’tconnectedforaspecifiednumberofdays.

3. Data delete meets NSA security standards and protects lost or stolen devices from data breach.

inSync overwrites all files that were backed up. If a file cannot be overwritten (possible with encryptedfiles)thenthefileisdeletedrightaway.

inSyncthenoverwritestheentirefreespaceofthatpartitionbycreatinganSErasefileandincreas-ing the size of SErase until it gets a 'No free space error.’ By doing so, it is able to clean up the free space of the drive, with data written by a secure algorithm.

Next,inSyncdeletesallbackeduporsync/sharedfiles.

Then,itcreatesanSMFT(SecureMasterFileTable)0bytefiletocleantheMFTtablesothatnoonecanseethenameofthefilesthatwerethereonthesystem.

inSyncfinallydeletestheSErasefile(thefileusedtofillupthefreespace).

1

2

3

4

5

Steps followed during remove wipe:

18

inSync Security

Mobile Security

inSync’s mobile application (the inSync mobile app) allows users to access their backed up and shared dataontheirmobiledevices).inSyncoffersITadministratorsavarietyofpolicyoptionstoprotecttheircorporatedevicesandcorporatedataonuser-ownedmobiledevices.Thesepoliciesareconfigurableusing the following two basic modes:

1. Corporate owned devices: Administratorscanconfiguretheirmobilepoliciestomandatebackup&protectionofthesemobiledevices.

2. Devices owned by users (Bring Your Own Device – BYOD): Administrators can allow users to choose their backup & device protection policies; however, the cor-porate data (accessed using the inSync mobile app) on these mobile devices is always under adminis-trator control.

All of inSync’s features - secure client authentication, client triggered architecture, data backup ses-sion, data restore session and data in transit security features are applicable to mobile devices as well.

Mobile Access

inSync ensures that access to corporate data (backed up, shared) is secure in order to prevent data leaks from mobile devices. the inSync mobile app is enabled with the following security features:

1. POLICY-BASED ACCESS

AdministratorsneedtoenableaccesstodatafrommobiledevicesininSyncuserprofilestoallowemployeesaccesstotheirdatafromtheirmobiledevices.Bymakingitaprofilesetting,inSyncgivestheoption to allow only select employees mobile access to corporate data based on their roles, privileges, and security levels or even based on the projects they work on.

2. SECURE AUTHENTICATION

To access their data, employees need to login to the inSync mobile app using their Email ID and Password. The inSync mobile app is equipped to authenticate using inSync’s two-factor encryption based credentials, Active Directory password or even with an organization’s single sign-on solution using SAML 2.0.

Inaddition,administratorscanconfigurepoliciestoenforceauser-definedPINtoaccesstheinSyncmobile app. This will ensure that corporate data in the inSync mobile app is secure even if an employee hasn’tconfiguredaPINforthemobiledevice.

19

inSync Security

3. SECURING DATA IN TRANSIT

Communication between the server and the mobile device is encrypted using 256-bit SSL encryption. This ensures that data at all levels is secure until it is received by the device and presented to the authen-ticated employee using the the inSync mobile app.

Private container for corporate data accessed on a mobile device

inSync recognizes that IT administrators need to have control over corporate data stored on all end-points - company-owned devices or employee-owned devices. To help administrators achieve this, inSync employs a private container that allows administrators to wipe critical data in a compartmental-ized manner.

inSync ensures that data on stolen mobile devices can be protected. Administrators can remotely wipe a device and the data is wiped whenever the device is turned ON even if a new data/SIM card is used on the stolen mobile device.

Inaddition,adminscanenforcepoliciestodisabledownloadsoffilesaccessedviainSynconpersonaldevicesaswellaspreventtheopeningoffileswithininSyncinthirdpartyapps.

Protecting corporate-owned mobile devices

ITadministratorscanconfigureinSynctoenforcebackupanddeviceprotection on corporate-owned mobile devices. Employees cannot access their data using the inSync mobile app until these settings areacceptedandconfiguredsuccessfully.Administratorscanconfig-ure inSync to backup Contacts, Photos, and Videos on these mobile devices and even SD-card content on Android devices. These settings areconfiguredonthemobiledevicesusingencryptedcertificatesgenerated by the enterprise.

TheinSyncmobileappperiodicallybacksuptheselecteddatabasedontheconfiguredsettingsandalsoupdatesthelatestlocationofthedevicefromwhereitwasbackedup.Withthisconfiguration,inSync gives administrators the option to deactivate the entire device (as against wiping just the inSync Container). Deactivating the entire device will lead to all the data on the device being lost - equivalent to a new device purchased from the store. All the backed up data, however, continues to reside on the server.

Data encryption

inSync ensures that no data is stored in an unencrypted form on mobile devices. The inSync mobile appencryptsallofflinedatausing256-bitAESforiOSdevices&128-bitAES-CBCandESSIV:SHA256forAndroid devices. In addition, inSync also reminds employees to secure their devices using a device PIN, periodically.

20

inSync Security

File Share Security

inSync’ssecuritycapabilitiesencompassdatasynced/sharedusinginSyncShare.inSyncShareoffersadministratorstheabilitytoconfigurepoliciesforsharingdatawithintheenterpriseorwithexternalusers. In addition, all shared data is encrypted on the wire, on the server, and also on the endpoints with the DLP option.

IT Control

inSyncprovidesITwiththree-tieredcontrolovershareddatawithintheenterprise.Italsooffersadministrators visibility into data sharing activities and access at all levels to monitor and check for any unsecure sharing practices.

21

inSync Security

USER LEVEL

SHARING

FILE LEVEL

SHARING

EXTERNAL PARTY

SHARING

Control on employees who can share data

Control on who can share and what can

be shared

IT control on sharing data with external partners and collaborators

IT can control which employees can share data using inSync. Administrators canenablethissettingatagroup/userprofilelevelbasedonanemployee’sfunctional role, or projects that the employee works on.

Administrators have complete visibility over an employee’s shared data. Administrators can view sharing activities including what data has been shared and when, in the context of a single employee as well as globally (all employees).

inSyncalsooffersrequisiteprivacysettingsforcompanieswithpoliciesdisallowingadministratoraccesstoemployeedata.Employeescanconfigureprivacysettingsiftheydon’twantITtoviewtheirconfidentialdata.

IT administrators can control whether a user can share data with all other employees or only with selected groups of employees within the enterprise.Thissettingispartoftheuserprofileandisconfiguredbyspecifyingtheuserprofilesthatdatacanbesharedwith.ThissettingallowsadministratorstoconfigureinSyncforemployeesworkingingroups that have data sharing restrictions.

IT administrators can control whether a user can share data using links and whether a user can collaborate with external parties via guest accounts. Sharedlinksallowexternalpartnerstoviewordownloadthesharedfilesdependingonthelinkconfigurations.Guestaccountsfurtherallowexternaluserstoeditanduploadfilestoasharedfolder.

Administrators can determine how long shared links remain valid by setting automatic expiry policies. Administrators and employees can also manually delete links to any documents shared with external partners withimmediateeffect.Linkscanbepasswordprotectedandconfiguredas view-only.

Administrators have complete visibility on the usage of links shared with external partners and can see the number of link views and downloads. Administrators further have visibility into all activity related to guest accounts.

1 2 3

1

2

3

22

inSync Security

Encryption

Administrators can choose to encrypt data added to the inSync Share folder as part of their organiza-tions DLP policies. Data is encrypted using the endpoint’s operating system’s native encryption algo-rithms, giving much better performance than application-level encryption algorithms. For example, inSyncleveragesWindows’EncryptedFileSystemservicestoencryptanddecryptdataonthefly(andsimilarly for iOS, Android & Mac). The table below illustrates the various advantages of inSync’s encryp-tion technology.

Parameter Dropbox with SecretSync inSync Share

Functionality Limited (encrypting data synced across devices).

Complete (Encrypting data for shar-ing across users OR syncing across devices).

Tools required Multiple tools required (Dropbox & SecretSync, each with their own password & key. Also requires Java).

Singleunifiedsolution

Accessing encrypted data

Requires SecretSync key to decrypt data for every access.

Requires no additional keys - man-aged by the native OS.

Risk to data Loss of key is irreparable. No risk to employee data - admin can reset any lost password.

Performance Slow (Application level encryption). Fast (Native OS API’s).

Platforms Windows, iOS, Mac OS, Linux Windows, Mac OS, iOS, Android

Cost High (inclusive of all tools) Low The following algorithms are used to encrypt shared data. 1. Windows - 256-bit AES encryption used by Windows EFS. 2. iOS & Mac - 256-bit AES encryption. 3. Android - 128-bit AES-CBC and ESSIV:SHA256 encryption.

Protecting Shared Data

inSync’s remote wipe & auto delete DLP policies also encompass shared data. Data in the inSync Share folder can be remotely wiped by administrators by decommissioning the device. The inSync Share folder on all devices of the employee can be automatically deleted by setting an auto-delete policy in theinSyncuserprofile.

SummaryData protection is Druva’s number one priority, and inSync guarantees security at every step. By adher-ing to strict standards inSync keeps your corporate data private, protected, and safe from threats.

Druva, Inc. Americas: +1 888-248-4976Europe: +44.(0)20.3150.1722APJ: +919886120215sales@druva.comwww.druva.com

About Druva

Druva provides integrated data protection and governance solutions for enterprise laptops, PCs, smartphones and tablets. I ts f lagship product , inSync, empowers an enterprise's mobile work force and IT teams with backup, IT-managed file sharing, data loss prevention, and rich analytics. Deployed in public or private cloud scenarios or on-premise, inSync is the only solution built with both IT needs and end-user experiences in mind. With of f ices in the U.S., India and United Kingdom, Druva is privately held and is backed by Nexus Venture Partners, Sequoia Capital and Tenaya Capital. For more information, visit www.Druva.com.