COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

Foundation & Core Architecture

1. Main Course

1.1 Welcome

Notes:

Welcome to the Commvault® Foundation & Core Architecture module for Sales
Engineers.

For your information, a PDF version of this e-learning module can be

downloaded by clicking on the resources link in the top right-hand corner of the
training window.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.2 Learning Objectives

Notes:

In this module you will learn about the core components within the Commvault®
software architecture and how these components work together to form the
Commvault data platform.

We will also discuss some of the technical advantages that Commvault software
delivers and discuss a high-level architecture consisting of the basic solution
components.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.3 CommCell® Architecture

Notes:

Let’s first discuss CommCell Architecture

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.4 Core Architectural Components

Notes:

Let’s take a quick look at some of the core infrastructure components involved in
a Commvault® solution architecture. Each of these components will be covered in
detail momentarily. Although the multi-tier data management architecture
depicted here may not appear to be unique, you will shortly discover some key
differences that set Commvault apart. All components within a Commvault
software environment are grouped logically by what is termed “a CommCell®”.

Every CommCell starts with a CommServe®, which acts as the Command and
Control Center in the CommCell. Every Commvault environment has a
CommServe as its foundation.

The MediaAgent is the data transmission manager in the CommCell environment.

It provides high performance data movement and manages the storage targets.
The CommServe server coordinates MediaAgent tasks. For scalability, there can
be more than one MediaAgent in a CommCell environment.

Storage targets are where data is stored when it is protected. Disk, tape, and
cloud storage can all be configured as a storage target. Commvault indexing and
data packaging technologies are tightly integrated with these storage targets to
provide a global, virtualized storage repository.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

These components can also be converged using Commvault HyperScale™ X, to

simplify deployment, redundancy, and scalability,

The Commvault Command Center™, is a powerful web-based user interface,

which spans entire Commvault product portfolio. The Command Center provides
provides a simplified, dashboard driven, and service-oriented approach to
managing on premise and cloud infrastructures.

Software packages, known as Agents, provide native file-system access,

application awareness, or federate management of other systems required for
successful data management operations, such as backups and restores.

Regardless of the solution you choose, whether it’s software as a service using
Metallic, a fully integrated appliance using Commvault HyperScaleTM X, or any of
the other Commvault Enterprise Data Management products - they all have one
thing in common, at the core, the Commvault architecture is the foundation of it
all. This is an important differentiator, proven technology, with code that is
developed and supported by a single, recognized market leader, For customers
this provides enhanced functionality, increased operational efficiency, and lower
risk.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.5 CommServe® - The Command & Control Center

Notes:

The CommServe® acts as the command and control center of the CommCell®
and handles all requests for activity between Media Agent and Server
components.

The CommServe serves four primary functions:

It holds the centralized configuration database and meta database for the
CommCell. The meta-database catalog housed in the CommServe includes
metadata about the nature and location of the data that is stored.
It also acts as the central point of disaster recovery in an environment.
The CommServe houses a Microsoft SQL database with configuration and media
association, which in a disaster recovery scenario is the first item that needs to
be recovered.
The CommServe also houses the centralized event and job managers that
handle the orchestration of various operations within a CommCell.
The CommServe handles all the management of security profiles and
authentication processes. This is managed through local user security groups
and or through tight-integration with external domains such as Active Directory.

Depending on solution requirements, the CommServe can be deployed on a

physical server, a virtual machine, or a cloud instance.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.6 MediaAgent – The Data Mover

Notes:

The Media Agent is a high-performance data mover server component in a

Commvault® environment. The media agent acts as the gateway between data
streams from the servers being protected and the storage targets where backup
data will reside. The Media Agents accept data from any server with the
appropriate Commvault software packages installed, and then transport that data
to a broad range of storage targets including disk, tape, or and cloud storage.
Media Agents are also used during auxiliary copy jobs , where data is copied
from one storage target to another.
The Media Agent maintains granular indexing information in its index cache
which includes detail on the jobs and objects that it has processed.
The Media Agent also hosts the de-duplication databases.
Another function that the Media Agent handles is that it interfaces with supported
primary storage arrays for IntelliSnap® snapshot management, which will be
covered in more detail in later modules.
The MediaAgent software is supported on most major operating system and can
be installed on physical servers, virtual machines, and public cloud instances.
Speaking of the cloud, Commvault provides increased efficiency and cost
reductions through cloud MediaAgent Power Management and the optimization
of cloud storage tiers. The former automatically turns on a MediaAgent when it is
required to perform various operations and turns off the MediaAgent after the
operation is complete. The latter, optimizes cloud storage to minimize read
charges from the cloud vendor at the cool and cold storage tier levels.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.7 Storage Targets

Notes:

While not strictly a Commvault® component, storage targets are certainly an

important part of any data management solution. Commvault supports a vast
amount of storage targets, which is a competitive differentiator when a solution
requires the flexibility of multi-vendor support. As mentioned previously, disk,
tape and cloud storage targets are all supported, {CLICK} including Commvault’s
own Hedvig Storage Clusters.

Commvault’s tightly integrated storage indexing techniques provide a global data

repository that makes it easy to protect, move, and recover data seamlessly in
any location, including on-premises, public cloud, hybrid cloud, and multi-cloud
environments.

Commvault software provides compression, deduplication, and encryption

natively via software, which can allow use of these technologies on cost effective
storage instead of having to purchase separate hardware or products to leverage
these technologies. We will discuss these features later in the module.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.8 Web Server and Web Console

Notes:

The Commvault web server hosts the Commvault REST API interface to
communicate with the CommServe® system. This allows access to CommCell®
and end-user operations through the Commvault Command Center™, Web
Console, and 3rd party REST API clients.

The Web Console provides web-based applications, including self-service

functionality, that allows non-administrative users to perform data management
operations such as backup, restore, download etc. In addition, the Web Console
allows users to; among other tasks, run reports, and execute automated
workflows.

As we have already discussed, the Command Center is the web-based user

interface for administration tasks.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.9 Commvault HyperScale™ X

Notes:

Commvault HyperScale™ X is our next generation of integrated appliance that

converges the core Commvault® architecture components with Commvault’s
intelligent data management software into an intuitive and easy to deploy, scale-
out appliance.

Commvault HyperScale™ X is fully integrated with the power of the Hedvig

scale-out file system, which builds the foundation to converge storage, container,
and cloud technologies allowing for automation of processes and simplification of
multi-cloud connections behind the appliance.

Commvault HyperScale™ X can also be deployed utilizing a Validated Reference

Design based on commodity hardware from several leading technology vendors.
Commvault HyperScale X has a dedicated module in this training and will be
covered in greater detail there.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.10 Backup and Restore Agents

Notes:

The Commvault data management platform uses software agents to facilitate the
protection and recovery of data on production systems. Commvault software
supports most types of operating systems, file systems, applications, databases,
hypervisors, and cloud providers in the market, as well as many popular SaaS
providers.

Commvault software packages directly interact with the file system or application
requiring protection and provide the common functionality of Commvault services
and utilities.

The Commvault software packages include the provision of application aware

and application consistent protection capabilities to ensure that data is protected
in a consistent state and is recoverable in a valid and usable format upon restore.

Each server requiring protection will have at least one software package installed,
although there are some exceptions. In some cases an agent federates the
management of other systems and or acts as a communication gateway to
perform specific data management tasks. For example virtual machines or cloud
instances can be protected without requiring the installation of a software
package, when utilizing the Commvault Virtual Server Agent.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.11 A Unified Aproach to Info & Data Management

Notes:

Wherever your customer is at on their data journey, Commvault® solutions

leverage these core infrastructure components to handle a wide variety of use
cases, including backup solutions, disaster recovery, security and compliance,
big data protection, hybrid IT, Virtualization, cloud data management,
ransomware protection, api integrations, cloud data migration, and scale-out
infrastructure.

Solutions may be deployed across both physical and virtual environments, for
structured and unstructured data, both on premise, in the cloud, across clouds,
and at the edge, spanning different server platforms, hypervisors, applications,
and disparate storage platforms.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.12 Why does a single extensible platform matter?

Notes:

With Commvault® software, organizations can leverage shared infrastructure,

consolidate and centralize the management of these functions, apply common
processes across their environments, and maximize their storage efficiency by
leveraging global deduplication.

This allows customers to minimize the learning curve associated with data
management, design for availability and disaster recovery in a holistic fashion
and minimize the amount of times that data requires processing. By doing so,
the deployment of Commvault software can drive significant economic savings
for organizations as well as dramatically increase the efficiency of their
operations.

As previously discussed, Commvault Software has many features and uses and
can provide a more holistic approach to data management. Understand that
some customers are only looking for a solution to a specific problem and
thoughts about replacing their whole infrastructure can be a concern for some
prospects. Remember, you can sell Commvault software to solve a specific
challenge and then re-visit with the customer later to address other needs that
arise. At this point, the single unified approach can become a powerful selling
tool.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.13 CommCell® Indexing

Notes:

Now let’s move on to a discussion around Commvault® software’s unique

indexing methodologies.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.14 Commvault® Software Indexing

Notes:

Commvault® software provides resiliency and maximizes infrastructure efficiency

in environments.

The CommServe® houses the CommServe database, a relational database built

on SQL that contains much of the critical metadata for a CommCell® environment.
Information such as scheduling, storage policies, activity, media management,
reporting, security and encryption is housed in the CommServe database. It is
important to note that the database only houses this lightweight metadata, which
allows Commvault to maintain a small database footprint.

Media Agents are where the index cache, and in many cases duplication
databases are stored. The index cache contains detailed job and object index
information and characteristics, for example exactly where each piece of data is
being stored on a storage target device.

The deduplication database maintains signature records for deduplicated data

blocks, which are generated using a hash algorithm.
The Index Cache is maintained locally by the Media Agents themselves and
automatically protected like the data itself to a storage target.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.15 Distributed Indexing: Inherent Resiliency, Flexible Recovery

Notes:

Commvault® software provides resiliency and maximizes infrastructure efficiency

in environments.

The CommServe® houses the CommServe database, a relational database built

on SQL that contains much of the critical metadata for a CommCell® environment.
Information such as scheduling, storage policies, activity, media management,
reporting, security and encryption is housed in the CommServe database. It is
important to note that the database only houses this lightweight metadata, which
allows Commvault to maintain a small database footprint.

Media Agents are where the index cache, and in many cases duplication
databases are stored. The index cache contains detailed job and object index
information and characteristics, for example exactly where each piece of data is
being stored on a storage target device.

The deduplication database maintains signature records for deduplicated data

blocks, which are generated using a hash algorithm.

The Index Cache is maintained locally by the Media Agents themselves and
automatically protected like the data itself to a storage target.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.16 Distributed Indexing: DR Backup

Notes:

Distributing the index across multiple layers also minimizes the footprint of
capacity consumed by the indexes.

Even in very large environments, the centralized CommServe® database

maintains a minimal footprint. This allows for portability and simplified disaster
recovery of the CommServe database.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.17 Distributed Indexing: Accelerated Time to Recovery

Notes:

In a disaster recovery scenario, the capabilities provided by Commvault®

software’s distributed indexing capabilities result in a highly accelerated time to
data recovery. Many alternative solutions in the market have monolithic
databases that can grow very large and become unmanageable.

Imagine a customer hit by a ransomware attack, the advantage of the smaller

CommServe® database becomes apparent. Given its smaller footprint it can be
protected at regular intervals through various methods, minimizing data loss, and
the time to restore it is minimal. Once the CommServe is back online, the
mediaagents will initiate the restoration of data and servers. When directly
compared to competitive solutions, customers see that the recovery of their
environment is initiated well before many competitive solutions have even
finished restoring the database.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.18 Single Pass Recovery

Notes:

Another key differentiator is how Commvault® software handles the recovery of

data in a single pass. To illustrate this process, let’s look at a simple data
protection operation.

In this example, a media agent communicates with a server to determine the

data that needs to be protected. A full backup of the data is then conducted.
Thereafter, incremental backups are conducted, in this example four incremental
backups occur after the full.

Let’s assume that at this point in time, the server experiences a catastrophic
failure and needs to be recovered. Commvault Media Agents index all data being
written to the storage target, so the administrator can view all backed up data
from any point in time, regardless of backup type.

When the recovery process is initiated, Commvault software identifies the most
current version of objects that were present after last backup. The media agent
index is leveraged in order to gather the most recent copy of each file in the
backup, which are utilized to conduct the system restore. Commvault software
intelligently knows how to combine the latest full backup with the subsequent
incremental backups to present a point in time image.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.19 Deduplication

Notes:

Now let’s move on to a discussion around Commvault® software’s deduplication

methodologies.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.20 Deduplication: Key Concepts

Notes:

In this section, we will cover several key areas to help you understand
Commvault® deduplication and the benefits that it delivers.

You can enable Deduplication for any data source although it is not a
requirement to manage storage targets. Customers can also leverage hardware
assisted deduplication provided by third-party storage vendors if required.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.21 Source and Target-side Deduplication

Notes:

Source side deduplication, which is also commonly known as client-side dedupe,

leverages a client-based disk cache known as a source side deduplication
database, which contains the signatures for the data blocks relative to that
particular client.
With source side deduplication, redundant data is identified at the client, and is
reduced prior to the network transmission of that data.
Target side deduplication on the other hand, conducts the comparison process
via a deduplication database resident on a media agent prior to writing data to
the storage target.
This is similar in fashion to many deduplication appliances which bundle a server,
software, and storage in a single target device.
Commvault® follows a similar methodology to our distributed indexing
functionality discussed previously, with the distribution of deduplication record
information. When a particular piece of data is written to the storage target, the
signature and location information relative to that object or job is also stored with
it. This allows us to only use the deduplication database for check in, or look up
processes only. An important differentiator is that the deduplication database is
not required to restore any particular piece of data.

It is key to note that with Commvault® software, customers do not have to make
an all or nothing decision when it comes to the type of deduplication appropriate
in their environment. Both source and target side deduplication may be designed
in a customer environment to suit their needs.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.22 Replication of Deduplicated Data

Notes:

DASH copy is a technology that enables the transmission of data in its

deduplicated, reduced form factor between media agents. This includes the
capability to recover data and maintain different retention periods, both
independently from the primary copy.

This reduction in bandwidth consumption facilitates disaster recovery, and also

eliminates the need for vendor specific appliances or array replication for disaster
recovery purposes.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.23 Global Deduplication Using Storage Pools

Notes:

Commvault® software also provides a global deduplication capability, wherein

copies of data from multiple storage targets may be combined and referenced
through a centralized deduplication database, this is achieved by creating what
are known as storage pools.

This allows customers to collapse wider groups of common data into a global
pool to maximize the level of efficiency with deduplication. Increased
deduplication efficiency is achieved by way of having a larger common pool of
blocks to reference against. It also provides customers a great deal of flexibility
and allows them to design fan in scenarios to maximize the utilization of storage
targets.

A global deduplication storage pool, can span secondary sets of DASH copies in
a single datacenter repository as depicted in this diagram

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.24 Core Architecture - Highly Scalable

Notes:

Commvault® software is also renowned for its scalability.

As the number of clients being managed in an environment, or the data sets

those clients generate increase to a threshold where the original number of
media agents cannot accommodate a customer’s established protection and
recovery SLAs, it is a very simple process to Scale the environment by deploying
additional media agents to accommodate the load.

This core architecture also facilitates back-end scaling of deduplication and non-
deduplication storage targets. As an environment grows and more and more
capacity is consumed, Commvault software alerts users and allows them to
easily add additional storage.

Commvault HyperScale™ X takes scalability to a whole new level by simplifying

the process of adding compute and storage resources with predictable scalability.
It allows customers to more easily plan and budget for growth while minimizing
administrative costs. Commvault HyperScale™ X is a flexible, grow-on-demand
platform with linear performance, capable of achieving multi petabyte expansion.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.25 Key Commvault® Data Logical Components

Notes:

We will start this module by covering a couple of key concepts surrounding

logical components in a Commvault® environment.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.26 Plans

Notes:

Plans, are an integral part of Commvault’s single interface, known as the

Command Center.

Plans simplify and streamline the configuration and administration of data

protection tasks through a set of optimized default parameters and settings. In a
plan you define what to backup, where to backup to, how often to run the backup
job, and how long to retain the data for.

There are plan types that include the data protection parameters that apply to the
type of data you want to protect as shown here. Most solutions are configured
using a Server Backup Plan, this includes, File Servers, Database Agents,
Virtualization, and IntelliSnap. There are also solution specific Plans for
Exchange Mailbox, Laptop, and Data Classification.

Plans are mapped to service levels and Commvault uses automatic scheduling
and dynamic priorities to achieve your defined RPOs.

Finally, more comprehensive plans can be created for certain use cases, for
example if a customer wants their data to be managed in a very specific way.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.27 Server Groups

Notes:

A server group is a logical grouping of client computers. Server groups allow an

administrator to apply the same settings one time, which are then assigned to all
server group members automatically.

Server groups can be created to configure specific options, such as Security,

Reporting, Automatic Updates, Multitenancy operations, and Geographical
Management (for example to allow for different schedule policies to be applied
depending on time zones).

Server groups may also be created to accommodate business requirements. For

example, different functional groups in an organization may have different service
levels associated with the protection of their data. Server groups can easily
accommodate scenarios such as this. As depicted here, a client may belong to
multiple Server groups.

Finally, Server groups can be configured using manual or automatic association.

Smart Server Groups using Automatic association follow a user-defined set of
rules. Based on these rules, existing or new servers are added, (or removed) to
the server group automatically.

This also includes automatic discovery of virtual machines based on specific

vendors and configured rules.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.28 Security and Recovery Readiness

Notes:

Security is a broad topic, which extends beyond the scope of this training course.
However, let’s cover the high-level features that will enable you to articulate and
differentiate the value of Commvault® software as part of a broader security
discussion.

Security is built into every aspect of the Commvault software, from an end user's
computer all the way to the backup storage. Customers can use our security
features, ransomware features, and administrative tools to enhance their own
data security plan, ensuring that their data is kept private and secure from both
internal and external threats. Commvault helps customers with recovery
readiness, which is the ability to Protect data, applications and workloads,
including the backup infrastructure, so they can restore their business operations
when needed, within their desired recovery time objectives.

The security offerings can be described by the following categories: Foundation

Hardening, Application Hardening, Ransomware Protection, Data Isolation (also
known as air gapping), and Recovery Readiness.

Starting with foundation hardening. The core components of the Commvault

platform rely on the underlying Operating System, Database, Application, and
Webserver technologies. Commvault provides validated and fully documented
hardening configurations based on NIST and CIS, standards and guidelines - to
help protect against corruption and minimize data loss.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

Commvault provides a range of features across this framework, such as Role

based user-security, integration with external domains, Secure LDAP Integration
for User Authentication, support for single sign-on with SAML integration and
external identity providers using secure protocols, credentials manager, client
owner security, and data privacy. On the Authorization side relating to Network
and Data Security, Commvault provides (FIPS) Certified Encryption, offering
Encryption in transit and at rest. Certificate authentication, and blacklist
capabilities. Finally, under accountability, Commvault provides audit trails and
reporting and the ability to create audit reports for unused security-entities, client
encryption information, APIs, and permissions.

Commvault has several Ransomware features that protect the Commvault

platform from being the conduit for spreading Ransomware to the backup data
and that can also detect ransomware to starve off potential attacks.

Isolating backup data helps mitigate cyber threats. Physical access to data is
also limited, in order to minimize internal threats that may inflict physical damage
to storage. Applying Air Gapping techniques (I.E. shutting network access to
copies of data) limits accessibility, further strengthening protection. Commvault
supports segmented networks via subnet and wildcard-based Data Interface
Pairs (DIPS). It also supports various encrypted Network Topologies, air gap
capabilities via workflows and scripts and WORM Copy Support.

Last but not least is DR Readiness, when a disaster strikes, you need your
backup environment online and functioning first-in-line, in order to recover the
next critical systems. Commvault provides several features that ensure the
CommServe is available and can be recovered in the smallest amount of time
possible. This includes features such as DR backups to the Cloud and
CommServe LiveSync replication.

The Commvault Data Protection platform is now officially “In Evaluation” status
for the Common Criteria Certification as publicly posted here:
https://cyber.gc.ca/en/products-evaluation . To get to this point, the core product
must demonstrate the right feature set, and security frameworks are in place.
Once completed, we will be certified that we conform to the standards within
PP_APP_v1.3 and we are confident the platform will succeed. This certification
brings parity with a very small number of our competitors but will provide a strong
differentiator against many.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.29 Commvault® Encryption – Secure by Design

Notes:

Encrypting data is an essential part of a data protection strategy, especially if data is

being placed on removable media or stored in the cloud. If data is stolen or becomes
accessible to unauthorized users, then sensitive information may be compromised and
cause a significant security risk for an organization.
Commvault® software is secure by design, providing FIPS certified data encryption
functionality that is built-in to the Commvault data platform as part of Commvault
complete backup and recovery.
Commvault software encryption lets customers choose where and when the encryption
is implemented, enabling them to meet their own specific security policies.
Commvault encryption can even be used together with Commvault deduplication.
Commvault software encryption provides end-to-end security, where data can be
selectively encrypted “inline” during data protection operations. Software encryption can
be initiated on the server being protected, or on the MediaAgent, and remain encrypted
when written to the storage target.
Offline or ‘copy-based’ encryption uses Commvault software encryption to secure data
during auxiliary copy jobs. Customers can preserve the primary copy encryption or
choose to re-encrypt the data with a different encryption cipher, if they wish.
Hardware encryption allows you to encrypt data on tape drives that have built-in
encryption capabilities.
Commvault software supports a wide variety of encryption algorithms based on the
required security and performance, as depicted in this table.
Finally, You can protect Commvault software encryption keys using supported third party
solutions from SafeNet and Vormetric as well as AWS and Azure Key management
servers.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.30 Wrap Up

Notes:

This concludes Module 2, Commvault® Foundation and Core Architecture

Overview.

During this module we discussed the core components within the Commvault
software architecture and functions of the Commvault software server
components.

We also discussed some of the benefits that a unified software approach

combined with the Commvault software indexing structure brings to the customer.

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.
COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.

1.34 Thank You

COMMVAULT CONFIDENTIAL AND PROPRIETARY. INTERNAL AND PARTNER UNDER NDA USE ONLY.