1. Zerto Virtual Replication 5.0
Recovering from Ransomware in minutes

2. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo
Agenda will go through what ransomware is and the risk to the business, the spend some time refreshing the audience with tips and tricks on preventing something like a ransomware infection in the first place.
Next, we speak about what enterprises currently do, and where the gaps exist and why these solutions aren’t built for total protection or efficient/worthy recovery.
Why Zerto is here and what is so different that it will change the way you think about recovery and business resiliency.
How the recovery works and why data loss is measured in seconds and recovery is measured in minutes when using Zerto Virtual Replication.
End with actual customer testimonials (and possibly show a little demo of how easy it is to recovery; if there’s time).

3. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo

4. Ransomware Infections
What are ransomware infections? We’re not necessarily here to scare you into buying Zerto, but to educate you as to what is happening and why this is such a huge impact to the business. From data loss, costs from fees and productivity loss through recovery and rebuilding of data, and business downtime, ransomware impacts many parts of the business.

5. Big In The News
People are paying fines, because they have to, and there are times where the data still isn’t released upon payments. Bitcoin or iTunes payments are being used, which are virtually untraceable.

6. A Global Problem - Worldwide infections
50k+
50k+
150k+
5k+
50k+
5k+
Notes: If it works to identify physical presence with dots or small flags they can be placed in:
CA, AZ, OR, CO, IL, TX, OK, GA, FL, MA, NC, NY, PA, MN, CT, Western Canada, Eastern Canada
UK, Italy, Germany, Spain, Netherlands, Israel, Sweden
Malaysia, Japan, China, India, Singapore, Australia
5k+
1k+
50k+

7. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo

8. Stopping Infections Secure entry points Filter web traffic
Web, , USB, BYOD
Users, IT Dept, External
Disks, Network
Recommendations
Secure entry points
Filter web traffic
Scan attachments
Block USB devices
Isolated BYOD
No web access on VMs
Train users & IT
Anti-virus/malware
Restrict domain admins
Change control
Isolated external users
Software restriction policies
Audit file shares
Audit permissions
Apply read-only
Firewall policies
User VLANs
Honey trap & alerting
Let’s refresh all the steps the enterprise can and should be taking to help protect the business from infiltration in the first place.
External perimeter protection isn’t enough. There are so many other ways businesses are impacted and they can’t be overlooked, especially with the uptake in infections such as ransomware.
Setup a “honey trap” and alert on infiltrations to this trap in order to find problems before they impact real data.

9. It Can Still Happen! 0 Day Exploits
Protect
Respond
Restore
Recommendations
Data Protection
Secured infrastructure
Isolated test networking
Payment is never advised
Infection response
Communication
Isolate source
Control spread
Test data
Restore
Root cause analysis
No matter how safe and secure you are, it still happens. You still need to have a solid way to recovery quickly with little to no impact.

10. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo

11. Typical Data Protection Solutions
Backup
Snapshot
Snapshot
Snapshot
4h+
24h+
12:00
06:00
09:00
12:00
15:00
18:00
Typicaly “old-school” mentality dictates the business is okay with just 24-hour, 4 hours, or even 1 hour RPOs. RTOs are extended to at least hours and while this is acceptable, it’s only acceptable because it’s habit and common. The world needs to know there is a better way. There is no reason to keep accepting these undesirable efforts and results.
IT isn’t the only business impacted during an outage or recovery. Incoming changes and sales aren’t being captured. Application owners and DB admins are fixing and rebuilding apps and data. IT and org owners are spending their time doing these recovery steps and letting their day job productivity sit on hold.
Power Interruption or Hardware Failure
Cryptolocker Virus Infection
File deletion, Application or Human error
= Data Loss & Downtime

12. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo

13. Zerto Virtual Replication
30 day Journal
06:00
09:00
18:00
00:00
12:00
15:00
Minimize impact, re-wind and recover from any point in time
30 day journal covers the typically reported 90%+ of data requests being within a 2 week window.
Find your infected file and check the time stamps. Search the directory in question for newly added files.
Use the journal checkpoints to recover files from seconds before the incident, or recover entire VMs if needed. Seconds of RPOs means extremely small data loss and no time to recover and rebuild lost data.
Sites
VMs
Files
Apps

14. How Zerto Revolutionized Disaster Recovery
Hypervisor
The first Enterprise-class, Software-Defined Replication & Recovery Automation solution
Servers
Security
Networking
Zerto Hypervisor Based Replication
Replication
Back in 2011 replication in enterprise virtual environments was done at the storage layer, and at Zerto we saw this was in the wrong place as you were locked into replicating between 2 matching storage arrays.
This meant that first of all you were unable to mix and match your storage between your sites, you had the complexity of replicating per lun, it was so complicated it even required a separate mgmt software for VM integration and couldn’t fully realize all the benefits of virtualization because you were tied into the physical layer.
We revolutionized BC/DR by moving the replication into the hypervisor to make it software-defined and included all of the recovery automation, removing the need for a separate solution, and enabled the simplicity of protecting on a per VM basis.
And Zerto isn’t alone in this trend, everything from your security, networking and storage is now moving into the hypervisor to realize the benefits of being software defined.
Storage
Replication was in the wrong place – the physical layer

15. Zerto - Resilience for Evolving ITTM
Change - No lock-in, enable new tech 1 2
Protect - Automate, test, remove risk 3
Consolidate - Migrations, self-service 4
Evolve - DRaaS to Azure, AWS, IBM & MSPs 5
Simplify - Single future-proof solution

16. Architecture - How Zerto Works
Management & Orchestration 1 x Zerto Virtual Manager per vCenter/SCVMM Windows VM, restrict ports
Scale-out architecture, security hardened Virtual Replication Appliance
Compression, throttling, resilience
Prod Site
DR Site
vCenter
ZVM
vCenter
ZVM
WAN/VPN VM
VRA VM
VRA VM
VRA VM
VRA VM VM VM VM
VM-Level Replication VM VM VM VM
This basic architecture shows how to stay resilient to site outage by placing hypervisor management servers on each site, and deploying a Zerto Virtual Manager to pair with each of those.
Replication engines (VRA) are deployed per hypervisor host to ensure the same, fully-scalable architecture no matter if the business is small with a few host, or grows to hundreds of hosts. VRAs handled throttling, compression, and replication as well.
VM block level changes are captured and sent continuously to the recovery site with no impact to the protected VM, and using no snapshots what-so-ever.
Journal storage overhead is approximately 10% when using compression, and is only on the recovery site. Journal length is per VM and can be adjusted from 1 hour and up to 14 days, allowing for the creation of over a thousand point-in-time recovery checkpoints PER VM.
vDisk
vDisk
vDisk
VM block-level changes Always-on Replication, Data loss = Seconds No snapshots, scheduling, impact, storage
Storage-agnostic replication
Replica VM & Compressed Journal vDisks
Journal 1 hour to 2 weeks max, 7-10% space

17. Architecture Continuous Replication, Journaling, & Failover Testing
4. Data written to journal
3. Journal checkpoints created
8. FoT auto cleanup
1. VM writes block with no impact to VM performance
2. ZVR tracks in memory, then replicates blocks
5. FIFO Journal data committed
7. FoT changes written to scratch
6. Failover Test creates VM, reads data
Prod Site
DR Site
vCenter
ZVM
vCenter
ZVM
WAN/VPN VM
VRA
VRA VM
VM-Level Replication
Scratch
vDisk
This goes a little deeper into how the continuous replication works, and then how an isolated failover test happens, all while replication continues and there is still no impact to the protected virtual machines. Failover tests are used not only to fully test the DR strategy without downtime, but also to plan for patches and upgrades, DevOps use case, and migration tests (site/hardware/clouds/or hypervisors) before commited to a failover.
Zerto’s automated orchestration will cleanup the failover test upon completion, and produce a full report on the test statistics to be used for compliance of the DR test.
vDisk
Journal vDisk
vDisk

18. Securing Zerto - TCP Communication Ports
Windows VM - secure with firewall ZVM to vCenter, ESXi Hosts & VRAs Dual-home ZVM for segregation
ZVM to ZVM mgmt traffic
Isolate Zerto Traffic from ZVM Infection VRA to VRA data path use dedicated VLAN
Prod Site
DR Site
443
443
vCenter
ZVM
ZVM
vCenter
9081
9669
WAN Link 5 Mbps Min
9669
22/43
22/43 VM
VRA
VRA VM
Mgmt
Mgmt
This is a typical enterprise deployment and ports required. Additional ports are required (and are documented) for other installation architectures and features).
Connectivity: VPN MPLS
ESXi Hosts
ESXi Hosts
No file shares Restrict User Access to ZVM No client PC access, only IT
vDisks on storage
vSphere Data Secure from infection
Create Isolated testing port groups

19. Consistent Protection & Recovery
Production Site
LUN Consistency Group evolved = Virtual Protection Group
Simple, scalable, protection & recovery of VMs, not LUNs
Enterprise Applications
Recover multi-VM application stacks together
CRM, ERP, SQL, Oracle, SharePoint, Exchange
Point in time recovery, write ordering & application consistency VM VM VM VM VM VM VM VM VM
Prioritize replication, pre-seeding, reduce initial sync VM VM VM VM VM VM
Support virtualization features vMotion, svMotion, HA etc VM VM
CRM VPG VM
RPO 4 seconds
Zerto knows the value of application consistency and created Virtual Protection Groups that can be:
Prioritized
Recovered together
Replicated with full write-ordering for application consistency across VMs
Pre-seeded to save time and bandwidth for large amounts of data
And are fully virtually aware to support underlying actions happening on the virtualization platform.
ERP VPG VM
RPO 6 seconds
vDisk
vDisk
vDisk
vDisk
vDisk
vDisk
vDisk
vDisk
vDisk
vDisk
vDisk
vDisk
SQL VPG VM
RPO 9 seconds

20. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo

21. Recovering From Cryptolocker In Minutes
Disaster Event!
Recovery Process:
Click Failover
Select Apps
4 simple steps to recovery.
Verify
Start Failover

22. Disaster Recovery Automation
*Manual V2V export from AWS
Disaster Recovery Automation
Replicate only changes Automated Failback Configuration* Previous settings remembered
Automated & Orchestrated
VM Recovery, RTO = Minutes
Boot order, Re-IP, Scripts & Validation
Production Site
BC/DR Site
vCenter
ZVM
vCenter
ZVM
WAN VM VM VM VM
VRA
VRA VM VM
VRA
VRA
Failback
Move
Failover Test
Recovery
More features to reiterate
Small to large scale migrations
Click to Move in Minutes Seconds of lag, test before move
Click to test in isolated network
Non-disruptive Failover Testing
Not just for DR & Offsite Clone VM

23. Recovering Individual Files & Folders in Minutes
Select VM
Restore Request
File server data
Application files
SQL databases
Oracle databases
Exchange databases
Select Files & Folders
Browser download
Instant-access on ZVM
Mount network share
Data restored from seconds before
Restore Anywhere
Disks mounted
No agent or impact
Select point in time
Sales Notes:
No overhead in production, no TBs of space like a backup product
No agent required in protected VMs for this functionality
Supports crash and app consistent PITs
Data is compressed in the target site (on the fly by the ZVM backup service) before being sent over the wire to minimize bandwidth utilization
Instant-access means the data is immediately mounted to the ZVM in the recovery site, meaning you don’t have to wait to restore the data from backup to start using it
Zerto doesn’t give the workflows in the GUI for restoring app objects (like mailboxes), this can be done by mounting the data and pulling the objects out using the app tools, but Zerto has the one thing no other solution has > the actual data from the point in time required rather than the last backup
Exchange mailboxes can be mounted, with no need to download, from the ZVM with the database in recovery mode to pull mailboxes and mailbox items with no disruption to production
SQL and Oracle databases can instantly be mounted from the ZVM data, again no need to download first, to pull individual table data
The power and possibilities of this feature are endless and it enables IT to revolutionize their approach to data protection and recovery utilizing their existing DR solution. Its literally 2 solutions in 1.
SE Notes:
The disk should not be left mounted for longer than journal history configured, just like a FOT.
If the disk mount is kept for longer than the journal history, then the journal will expand just like a FOT
Performing a failover will automatically unmount and open mounts
Multiple disks can be mounted from the same checkpoint if a log and db need to be downloaded or restored

24. Virtual Awareness and Integration
Hypervisor integrated Real-time Dashboard Service level driven
Role Based Access Control
Single Solution for BC/DR REST API automation
Extrmely powerful and easy dashboard with all important info up front.
Ensure compliance
DR Test Reporting
Prove recovery capability

25. Proving Compliance and Removing Risk
Testing Regulations
PCI
ISO
SOX
HIPAA
SEC
Complaince report

26. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo

27. Real-world Zerto Customer Story
Ransomware Infection:
Real screenshot from end user PC
Encrypted files on all user mapped shares with edit permissions
Response:
PC was isolated from the network
Used ZVR to recover files from minutes before
No need to re-create files or accept data loss from using backup
No ransom paid
Impact minimized!
Custoemr example. Recovered files before uses ever noticed there was an issue.

28. Zerto Feature Summary Enterprise-Class Disaster Recovery Software
Journal Based Protection Reduce impact, recover & re-wind
Hypervisor-based Virtual Aware
Click to Test, Failover, Migrate RTO = Minutes, Prove Compliance
For On-Premise DR & DRaaS
Powerful Data Protection & Recovery
Storage & Hypervisor Agnostic
Install in Minutes Simple Scalable Software
No Snapshots Always-on, RPO = Seconds Consistency Groupings
Strategic BC/DR Platform

29. Agenda The Risk Vector Securing & Protecting Best Practices
Current Data Protection & Recovery Solutions 
The Zerto Revolution
Recovering from the Infection in Minutes 
Real-world Customer Story
Demo

30. Demo

31. Q&A