Spring Independent School District thwarts ransomware attack with Cohesity on AWS

The Challenge

Like school districts everywhere, Houston-area Spring Independent School District (ISD) is strengthening defenses against growing cybersecurity threats. “We block 1.4 million attacks every month, do regular penetration testing, and offer year-round cybersecurity training to staff,” says Bobby LaFleur, Director of Application of Support. “But nothing is foolproof and IT has to be vigilant about vulnerabilities, so part of our strategy is making sure we can quickly recover failed or locked up virtual machines and files to make sure learning and administration aren’t interrupted.”

Spring ISD previously used multiple backup products: Veeam for virtual machines, Idera for SQL Server, and two different server platforms. The whole setup was replicated in a nearby co-location facility used for disaster recovery. When the co-lo lease came up for renewal, the IT team explored better solutions. “Managing four separate interfaces is complicated, and it took a lot of staff time,” LaFleur says. “The co-lo wasn’t ideal for disaster recovery because it’s susceptible to the same weather-related risks as our local backups. And a sophisticated ransomware attacker could go after our backups and exploit our data.” That’s what happened in a neighboring district that had been hit by a disruptive ransomware attack in October 2020.

The Solution

The IT team found its solution in Cohesity DataProtect, which replaces all four of the district’s legacy data-protection products. Recommended by the district’s IT partner, SHI, Cohesity automatically backs up 60 terabytes of VMs and databases in two locations—in the district server room and in AWS for archiving and disaster recovery. “Cohesity saves a lot of time for our engineers because it automates tasks we used to do manually, like replication and archiving,” says LaFleur. What’s more, the Cohesity backups are immutable, thwarting attackers’ attempts to encrypt or delete them. “If any virtual machine or SQL Server is encrypted in an attack, we can instantly restore a snapshot to any point in time,” LaFleur says.

The Results

Ransomware protection paid for itself many times over when the district was hit by an attack in November 2020—a date etched into LaFleur’s memory. “We got a call around 8:00 p.m. about errors in the remote learning systems we were using during the pandemic,” he says. When IT engineers saw that an attack was propagating through our file servers, LaFleur and his colleagues on the infrastructure and network teams rushed to the office to temporarily shut down the network.

“After the ransomware attack, Cohesity really saved us,” LaFleur says. “Though our local Active Directory servers were locked up, preventing us from restoring data from the local backup, we were able to quickly restore critical servers from Cohesity backups on AWS. Teachers taught online classes the very next day as usual, and we didn’t miss payroll. When a neighboring district that didn’t have Cohesity was hit by a similar attack, they had to pay a hefty ransom and didn’t fully recover for almost four weeks.” The remaining 200 servers—mainly secondary systems, were brought back online in a planned manner.

District IT engineers like the simplicity and efficiency of Cohesity. Before, restoring a lost or corrupt file required restoring the entire database, which took five or six hours. Now they can search for and restore an individual file in minutes. “Whether I restore data from the on-prem backup or the AWS archive, I can do it from a single user interface instead of bouncing between systems like we did before,” says Roberto Solorzano, Senior System Engineer. “Since we started using Cohesity, I get more sleep.”

The Spring ISD administration and board appreciate that stronger protection costs less, not more. “With Cohesity we lowered TCO by 10-15% by decommissioning four legacy backup products, eliminating co-lo lease and equipment costs, and simplifying management,” LaFleur says. “And ransomware protection helped us get favorable rates when we renewed our cybersecurity insurance.”

Summing up, LaFleur says, “When peers in other school districts ask what we use for data protection, I tell them it’s Cohesity—and that I’m very satisfied with our chosen partner!”