Category Archives: Citrix

Are the Advantages of BYOD Worth the Security Risks?

Check Point Software recently released their Third Annual Mobile Security Survey, highlighting the impact of mobile devices on IT security. They surveyed more than 700 IT and security professionals in the U.S., Canada, Germany, the U.K., Australia, and New Zealand, and the respondents were spread fairly evenly across the spectrum of business sizes, with the largest segment (29%) coming from businesses with between 100 and 1,000 employees.

Here are some of their key findings (quoted from the site linked above):

  • The Greatest Threat Resides Within Your Organization – 87 percent of surveyed professionals believed that the greater security threat to mobile devices were careless employees. Nearly two-thirds of the respondents believed that recent high-profile breaches of customer data were likely due to employee carelessness.
  • Proliferate Use of Personal Mobile Devices on the Corporate Network – Despite careless employees as the weakest link into businesses, 91% of IT professionals saw an increase in the number of personal mobile devices connecting to their networks over the past two years. In 2014, 56% of those surveyed managed business data on employee-owned devices, up from 37% in 2013.
  • Mobile Security Incidents Expected to Rise – 2015 is shaping up to be a risky year, according to those surveyed. Of the security professionals surveyed this year, 82% expect the number of security incidents to grow in 2015. Additionally, nearly all of the respondents (98%) expressed their concern about the impact of a mobile security incident, with the greatest concern being the potential for lost and stolen information.
  • Cost of Mobile Security Incidents Continue to Rise – 2014 saw an increase in remediation costs for mobile security incidents. Of the IT executives surveyed, 42% noted that mobile security incidents cost their organizations more than $250,000.

Consider some additional trend data:

  • Computerworld predicts that BYOD smartphones will continue to grow at roughly a 30% CAGR through 2017 – from only 88 million two years ago to 328 million in 2017.
  • Rapid7 quotes a Cisco prediction that by 2016 there will be 1.62 billion mobile devices (of all kinds) in the workplace. They also state that more than 80% of the mobile devices in the workplace today are employee-owned.
  • Over a year ago (back in May, 2013), Gartner predicted, based on a global survey of CIOs, that, by 2017, more than half of companies will require their employees to supply their own mobile devices.

So let’s recap: 98% of the Check Point respondents were concerned about the impact of mobile security incidents on their businesses, 42% said that such incidents had already cost their businesses more than a quarter of a million dollars, 82% expect the number of security incidents to grow in 2015. Yet nearly all have seen an increase in the number of personal mobile devices connecting to their networks over the past two years, and, by all indications, the BYOD trend will continue and, if anything accelerate. Which brings up two obvious questions: (1) If BYOD is such a security risk, why are businesses overwhelmingly moving in that direction? And (2) What can a business do to leverage the benefits of BYOD while still limiting the exposure to security risks? Let’s look at these two questions…

Why BYOD?

  • It reduces the business’ capital outlay for mobile devices. Even in cases where businesses give their employees a cash allowance to purchase the mobile device of their choice, the company generally saves money in the long run by not being responsible for the maintenance and repair of an employee-owned device.
  • Employees are more productive when working on their preferred device. Someone who has been using an iPhone for years isn’t going to be happy about being handed a company-owned BlackBerry device. A Mac user isn’t going to want to deal with a company-owned Windows laptop – and vice versa. Younger workers in particular, who have grown up with technology, want to use what they’re accustomed to using, and will be more productive if allowed to do that.
  • Employees who use mobile devices for both work and personal matters tend to put in more hours per year – some surveys suggest as many as 240 more hours per year – than those who do not.
  • Given the above, business who do not implement BYOD may find themselves at a competitive disadvantage.

How to Do BYOD Safely
First of all, more and more organizations are implementing some form of mobile device management (MDM). According to the Check Point survey, 56% of organizations were managing the business data that exists on personal devices, up from 37% in 2013. There are numerous MDM products on the market, but I would suggest that managing the mobile device itself is only part of the problem. A complete solution would also include mobile application management (MAM) - some mechanism to deploy secure applications to a mobile device…applications that would be “sandboxed” away from an employee’s personal applications, such that the data accessed by those applications would be isolated from the personal applications, and information could not be copy/pasted from a secure application into a personal application. It would also be nice if the organization could selectively wipe the secure applications and associated data from a mobile device while leaving the employee’s personal data and applications untouched. Citrix XenMobile Enterprise is such a solution, and the following 16 minute video does a great job of demonstrating the XenMobile Enterprise user experience:

And, of course, if your users need access to full-blown Windows applications, not just mobile apps, they can securely access those applications via Citrix XenApp or XenDesktop, as we’ve been doing for years.

Bottom line: BYOD is here to stay. Businesses are increasingly turning to BYOD because of its advantages, even though they recognize that it brings with it significant security risks. It is, however, possible to gain the advantages of BYOD without compromising the security of your company data, and VirtualQube, by virtue of our longstanding partnership with Citrix, can help.

A New Citrix Trade-Up Program

At the recent Citrix Synergy conference, Citrix announced a new product bundle: the Citrix Workspace Suite, which consists of XenDesktop Platinum Edition plus XenMobile Enterprise Edition. The Workspace Suite is only licensed in a per-user model. Also, as we mentioned in an update to our blog post on Citrix Subscription Advantage, it appears that, with the advent of the Workspace Suite, Citrix is continuing to move to a more traditional model of “Software Maintenance,” that covers both product upgrades and 24×7 telephone support. Subscription Advantage by itself is not available for the Workspace Suite.

Purchasing the Workspace Suite does offer a bit of savings compared to purchasing the two products separately. A Workspace Suite license is $450 (MSRP) plus $99 for the required first year of Software Maintenance, for a total acquisition cost of $549. XenDesktop Platinum is $350 per named user, and XenMobile Enterprise is $226 per named user ($185 for the license plus $41 for the required first year of Software Maintenance), so buying the two products separately would cost you $27 more than buying the Workspace Suite.

Now, Citrix has announced a trade-up promotion for existing customers who would like to move to the new Workspace Suite. The cool thing about this promotion is that it is so widely applicable. If you own any version of XenDesktop, XenApp, or XenMobile, or if you own ShareFile Enterprise licenses, you can take advantage of this trade-up. If you own XenDesktop concurrent-use licenses or XenApp licenses (which have always been concurrent), you can get two Workspace Suite licenses for each license you trade up; otherwise it’s a 1 for 1 trade-up.

The trade-up price varies depending on what product you’re trading up from, what edition of that product you own, and whether you’re current on your Subscription Advantage. For example, the XenApp trade-up pricing looks like this:

Advanced Edition Enterprise Edition Platinum Edition
SA Current $373 $323 $298
SA Not Current $423 $373 $348

Note: All prices shown are MSRP and do not include any volume license program discounts.

Citrix is also offering a 10% discount on additional Workspace Suite licenses purchased on the same order as a trade-up, or a 35% discount if you purchase enough additional licenses to cover everyone in your organization.

You can find a handy trade-up calculator at www.citrixinformation.com/cwscalculator that will let you enter your existing license information and tell you what your trade-up will cost.

Citrix Subscription Advantage

Update 6/26/2014:
There was an interesting announcement at the recent Citrix Synergy conference that may indicate the future direction of Subscription Advantage. At that conference, Citrix announced a new product bundle called the “Citrix Workspace Suite,” which consists of XenDesktop Platinum Edition + XenMobile Enterprise Edition. It does not appear that Subscription Advantage, as we have known it for lo these many years, exists for this product. Instead, Citrix appears to have moved to a more traditional (in the software industry) Software Maintenance model that includes product upgrades and 7 x 24 telephone support.

The list price for the Workspace Suite is $450 per named user (there is no concurrent-use license model for this product), plus $99/user/year for Software Maintenance. Software Maintenance is mandatory for the first year (so the first year cost is actually $549/user, not $450…less whatever discount you can get on the license itself) and optional for subsequent years. But it appears that if you choose not to renew Software Maintenance, you will also lose your access to product upgrades, just as has been the case with Software Assurance.

***** End Update *****

I’ve noticed a pattern developing: It starts with a renewal notice, usually around 90-days before Subscription Advantage (SA) is set to expire. The reply email comes back within 48 hours: “What is Subscription Advantage?” I answer and then comes question #2: “Why do I need it?” So I think it’s time once again to shed some light on this mystical annual renewal.

Subscription Advantage IS NOT MAINTENANCE!

Subscription Advantage  IS NOT SUPPORT!

Subscription Advantage IS NOT A WARRANTY!

Ok, now that that is out of the way we can focus on what SA is because it is important that you know exactly what you are paying for. Citrix SA is annual license upgrade protection. The first year is included with your license purchase - after that, there’s an annual renewal cost. What does that mean? Well it means that you bought something that is not a set-it-and-forget-it item. Data centers grow and change all time and the tools used in that data center need to change as well. So as the Citrix products evolve (or change names) you as an owner of “upgrade protection” can take advantage of these upgrades, period.

(There is one exception: it is now possible to purchase a bundle of SA and Citrix telephone support for XenApp. We covered this in an earlier blog post.)

The good news is that Citrix SA doesn’t cost as much as traditional “Software Maintenance” from companies that bundle some kind of telephone support with their upgrade protection. The general rule of SA is that it costs about 11% - 13% per year of the cost of the license. In our experience, traditional Software Maintenance that includes support will typically run you 18% - 20% per year for 5 x 8 support, and 25%+ per year for 7 x 24 support.

However, if you have not renewed your SA and wish to upgrade you will need to pay a reinstatement fee or just buy new licenses. Which option is best for you will depend on how long it’s been since you renewed SA. If your SA has been expired for more than a year, it’s going to be pretty expensive to try to get it reinstated.

Citrix upgrades its products often! So what if I have my own Citrix expert on staff and don’t plan on upgrading for 5-6 years anyway? Well, as we all know, life is what happens while you’re making other plans. What about the rest of your data center? Do you not plan to upgrade that in the next 5-6 years either? In many cases old versions of Citrix products will not be compatible with new technology releases. E.g., Citrix just released XenApp 6, which is specifically designed for Windows Server 2008 R2. Earlier versions of XenApp are not compatible with 2008 R2.

Also, Citrix frequently releases “Feature Packs” for older product versions that add functionality (within the technological constraints of the older platform). If your SA is current, you can take advantage of the new features. If not, you…can’t.

Finally, no software company can afford to indefinitely support every product version that they’ve ever released. Everything has a lifecycle. For example, Presentation Server v4.0 hit the “End of Life” point at the end of 2009. That means there is no support available for the product other than the information you may be able to dig out of the Citrix on-line Knowledge Base. Furthermore, all the downloads have been removed, so you have no way to access any security patches, service packs, hotfixes, etc. This is obviously not a good situation for your production environment - so if you’re still running Presentation Server v4.0, you should be working toward upgrading your environment as soon as you possibly can.

Bottom Line: I recommend SA renewal to everyone who buys Citrix licenses. As the person who handles all the renewal notices for our customers, I have, time and time again, seen people try to save a dollar this year but end up spending more then necessary next year. Plus it is just a headache to realize that you need to upgrade - perhaps to solve a problem that (naturally) surfaced after hours or on a weekend - but can’t get the upgrade because your subscription has expired. So, when you get that email notice from me, just remember: I’m really trying to make your life easier by insuring that you’re upgrade rights are protected!

Scott’s Book Arrived!

We are pleased to announce that Scott’s books have arrived! ‘The Business Owner’s Essential Guide to I.T.’ is 217 pages packed full of pertinent information.

For those of you who pre-purchased your books, Thank You! Your books have already been signed and shipped, you should receive them shortly and we hope you enjoy them as much as Scott enjoyed writing for you.

If you haven’t purchased your copy, click here, purchase a signed copy from us and all proceeds will be donated to the WA chapter of Mothers Against Drunk Driving (MADD).

Some Straight Talk about VDI-in-a-Box

Update: The advent of solid-state drives allows you to eliminate IOPS as a potential bottleneck. The calculations below are based on 15K SAS drives that support roughly 175 IOPS each. A typical 200 Gb SSD will support tens of thousands of IOPS. On the other hand, although SSD prices are coming down, they’re still rather pricey. Replacing the eight 146 Gb, 15K SAS drives in the example below with eight 200 Gb SSDs, and loading it up with RAM so you can support more virtual desktops, will push the price of the server to nearly $20,000. So the primary point of this post still stands: While VDI-in-a-Box is a great product, and can be competitive with physical PCs when the entire lifecycle cost is compared, you’re just not going to see significant savings in the capital expense of ViaB vs. physical PCs. That doesn’t mean it isn’t a great product, and it doesn’t mean you shouldn’t consider it. It just means that you need to validate what it’s really going to cost in your environment.

Original Post (April, 2012):
There is a lot of buzz about Citrix VDI-in-a-Box (“ViaB”), and rightly so: it’s a great product, and much simpler to install and easier to scale than a full-blown XenDesktop deployment. You don’t need a SAN, you don’t need special broker servers, you don’t need a separate license server or a SQL Server to hold configuration data. Unfortunately, some of the buzz - particularly some of the cost comparisons you see that show a $3,000 - $4,000 server for 30 or more virtual desktops, is misleading. So let’s talk seriously about the right way to deploy ViaB. For this exercise, I’m going to assume we need 50 virtual desktops. Once we’ve worked through this, you should be able to duplicate the exercise for any number you want.

First of all, I’m going to assume that we are building a system that will support Windows 7 virtual desktops - because I can’t see any valid reason why someone would invest in a virtual desktop infrastructure that couldn’t support Windows 7. There are two important data points that follow from this: (1) We should allow at least 1.5 Gb per virtual PC, and preferably 2 Gb per virtual PC. (2) We should design for an average of about 15 IOPS per Windows 7 virtual PC, because, depending on the user, a Windows 7 desktop will generate 10 - 20 IOPS. Let’s tackle the IOPS issue first.

Thanks to Dan Feller of Citrix, we know how to calculate the “functional IOPS” of a given disk subsystem. Here are the significant factors that go into that formula:

  • A desktop Operating System - unlike a server Operating System - has a read/write ratio of roughly 80% writes and 20% reads.
  • A 15K SAS drive will support approximately 175 IOPS. The total “raw IOPS” of a disk array built from 15K SAS drives is simply 175 x the number of drives in the array.
  • A RAID 10 array, which probably offers the best balance of performance and reliability, has a “write penalty” of 2.

With that in mind, the formula is:

Functional IOPS=((Total Raw IOPS x Write %)/(RAID Penalty)) + (Total Raw IOPS x Read %)

If we put eight 15K SAS drives into a RAID 10 array, the formula becomes:

Raw IOPS = 175 x 8 = 1,400

Functional IOPS = ((1,400x.8)/2)+(1,400x.2) = 560 + 280 = 840

If we are assuming an average of 15 IOPS per Win7 virtual PC, this suggests that the array in question will support roughly 56 virtual PCs. So this array should be able to comfortably support our 50 Win7 virtual PCs, unless all 50 are assigned to power users.

That’s all well and good, but we haven’t talked yet about how much actual storage space this array needs. That depends on the size of our Win7 master image, how many different Win7 master images we’re going to be using, and whether we can use “linked clones” for VDI provisioning, in which case each virtual PC will consume an average of 15% of the size of the master, or whether we’re permanently assigning desktops to users, in which case each virtual PC will consume 100% of the size of the master. For the sake of this exercise, let’s assume we’re using linked clones, and that we have three different master images, each of which is 20 Gb in size. According to the Citrix best practice, we need to reserve 120 Gb for our master images (2 x master image size x number of master images). We then need to reserve 3 Gb per virtual PC (15% of 20 Gb), which totals another 150 Gb. The ViaB virtual appliance will require 70 Gb. We also need room for the hypervisor itself (unless we’re provisioning another set of disks just for that) and for swap file, transient activity, etc., so let’s throw in another 150 Gb. That’s 490 Gb minimum. So we need to use, at a minimum, 146 Gb drives in our array, which would give us 584 Gb in our RAID 10 array.

How about RAM? If we allow 1.5 Gb per Win7 desktop, then 50 virtual desktops will consume 75 Gb. We need at least 1 Gb for the ViaB appliance, at least 1 Gb for the hypervisor, plus some overhead for server operations, so let’s just call it 96 Gb.

We can handle 6 to 10 virtual desktops per CPU core - more if the cores are hyper-threaded - so we’re probably OK with a dual-proc, quad-core server.

Now, I don’t know about you, but if I’m going to put 50 users onto a single server, I’m going to want some redundancy. I will at least want hot-plug redundant power supplies, and hot-plug disk drives. Ideally, I would provision “N+1″ redundancy, i.e., I would have one more server in my ViaB array than I need to support my users. I’m also going to want a remote access card, and probably an uplift on the manufacturer’s Warranty so if it breaks, the manufacturer will come on site and fix it.

By now, you’ve probably figured out that we are not talking about a $4,000 server here. I priced out a Dell R710 - using their public-facing configuration and quoting tool - with the following configuration, and it came out to roughly $11,000:

  • Two Intel E5640 quad-core, hyper-threaded processors, 2.66 GHz
  • 96 Gb RAM
  • Eight 146 Gb, 15K SAS drives
  • PERC H700 controller with 512 Mb cache
  • Redundant hot-plug power supplies
  • iDRAC Enterprise remote access card
  • Warranty uplift to 3-year, 24×7, 4-hour response, on-site Warranty

(NOTE: This is a point-in-time price, and hardware prices are subject to change at any time.)

The ViaB licenses themselves will cost you $195 each. Be careful of the comparisons that show the price as $160 each. ViaB is unique among Citrix products in that the base cost of the license does not include the first year of Subscription Advantage - yet the purchase of that first year is required (although you don’t necessarily have to renew it in future years). That adds $35 each to the cost of the licenses.

Finally, If you don’t have Microsoft Software Assurance on your PC desktops - and my experience is that most SMBs do not - you need to factor in the Microsoft Virtual Desktop Access (VDA) license for every user. This license is only available as an annual subscription, and will cost you approximately $100/year.

So, your up-front acquisition cost for the system we’ve been discussing looks like this:

  • Dell R710 server - $11,000
  • 50 ViaB licenses @ $195 - $9,750
  • 50 Microsoft VDA licenses @ $100 - $5,000

Total aquisition cost: $25,750, or $515/user. Not bad.

But wait - if we’re going to compare this to the cost of buying new PC, shouldn’t we look at the cost of ViaB over the same period of time that we would expect that new PC to last? If we assume, like many companies do, that a PC has a useful life of about 3 years, then we should actually factor in another two years of VDA licenses, and two years of Subscription Advantage renewal for the ViaB licenses. That pushes the 3-year cost of the ViaB licenses to $13,250, and the cost of the VDA licenses to $15,000. So the total 3-year cost of our solution is $39,250, or $785/user.

If you want N+1 redundancy, you’re going to need to buy a second server. That would push the cost to $50,250, or $1,005/user.

What conclusions can we draw from all this? Well, first, that VDI-in-a-Box is not going to be significantly less expensive than buying new PCs, if you actually do it right. However, it is competitive with the price of new PCs, which is worth noting. As long as the price is comparable, which it is, we can then start talking about the business advantages of VDI, such as being able to remotely access your virtual desktop from anywhere, with just about any device, including iPad and Android tablets, and about the ongoing management advantages of having a single point of control over multiple desktops.

Also, as you scale up the environment, the incremental cost of that extra server that’s required for N+1 redundancy gets spread over more and more users, and becomes less significant. For example, if we’re building an infrastructure that will support 150 virtual desktops, we would need four servers. Total 3-year cost: $128,750, or $858.33/user for a robust, highly redundant virtual desktop infrastructure. In my opinion, that’s a pretty compelling price point, and you won’t be able to hit that price point with a 150-user XenDesktop deployment, because of the other server and storage infrastructure components that you need to build a complete solution. On the other hand, XenDesktop does include more functionality, like the rights to use XenApp for virtual application delivery, ability to stream a desktop OS to a blade PC or a desktop PC, rights to use XenClient for client-side virtualization, etc.

But if all you want is a VDI solution, ViaB is, in my opinion, the obvious choice. It’s clear that Citrix wants to position VDI-in-a-Box as the preferred VDI solution for SMBs, meaning anyone with 250 or fewer users…and there’s no reason why ViaB can’t scale much larger than that.

For more information on ViaB, check out this video from Citrix TV, then head on over to the Citrix TV site to view the entire ViaB series

**** EDIT April 12, 2012 ****
You may already be aware of this, but Dell has announced a ViaB appliance that comes pre-configured, with both XenServer and the ViaB virtual appliance already installed. Oddly enough, even though Moose Logic is a Dell partner, I couldn’t get Dell to tell me what one would cost. Their answer was that I should call back when I had a specific customer need, and they would work up a specific configuration and quote it. I considered calling back with a fictitious customer requirement, but decided that I didn’t want to know badly enough to play that game.

They did, however, tell me what the basic server configuration was - and it was very close to the configuration I’ve outlined above: two X5675 processors, 96 Gb of RAM, eight 146 Gb drives in a RAID 10 array, Perc H700 array controller (don’t know how much cache, though), and iDRAC Enterprise remote access card. I do not know whether it has redundant power supplies (although I would certainly hope so), nor exactly what Warranty is included…perhaps that option is left up to the customer.

That gave me at least enough information to run a sanity check on the configuration. The array would provide 960 functional IOPS, which should be adequate for an 80 user system - which is how the appliance is advertised - depending, of course, on the percentage of power users. Also, the array should provide enough storage to handle the needs of most SMBs, unless they have an unusually large number of images to maintain.

One of my Citrix contacts recently told me that the Dell appliance was priced at $440/desktop for an 80 concurrent user configuration, which is very much in line with the cost per user in the post above, considering that $100 of my $515/user number was for the first year of Microsoft VDA licenses, which, to my knowledge, are not included with the Dell appliance.